cpython-wasi-build

I've spent enough time with this now in Claude Code (and Claude.ai and Claude Code for web) to have an opinion on Fable 5: it's a beast. I'm throwing some VERY difficult problems at at - things I've been dragging my heels on for months - and it's crunching through them very happily. One that I'm willing to share (albeit from just a week ago) - I built a Python library last week that bundles MicroPython compiled to WASM to create a sandboxed code execution library: https://github.com/simonw/micropython-wasm I just told Claude.ai (not even Claude Code - this was the standard Claude chat interface) running Fable 5: Clone simonw/micropython-wasm from GitHub and research how this could use a full Python as opposed to MicroPython A few prompts later (and I uploaded the zip files from https://github.com/brettcannon/cpython-wasi-build/rele

Literally working on a product that does this, hah :) I really do think that AI + automation + carefully-designed guardrails will unleash a deluge of productivity for normies, and we've barely scratched the surface. The state of AI apps is absolutely trash right now, it’s embarrassing that these companies that raised millions are releasing the shittiest slop around without any product ethos. Obviously we're seeing what sticks, but come on guys. I'm using Brett Cannon's `https://github.com/brettcannon/cpython-wasi-build` running inside a WASI rust container with a carefully-designed host SDK (e.g. sandboxed Chromium access, diff, sandboxed filesystem, pandas subset, PDF reading, etc.). Essentially the AI sees a goal, a plan, and essentially treats the "task space" as a WASI-powered Python notebook. Mainly focused on the user experience, an

I disagree with this section about WebAssembly: > But the practical limitation is language support. You cannot run arbitrary Python scripts in WASM today without compiling the Python interpreter itself to WASM along with all its C extensions. For sandboxing arbitrary code in arbitrary languages, WASM is not yet viable. There are several versions of the Python interpreter that are compiled to WASM already - Pyodide has one, and WASM is a "Tier 2" supported target for CPython: https://peps.python.org/pep-0011/#tier-2 - unofficial builds here: https://github.com/brettcannon/cpython-wasi-build/releases Likewise I've experimented with running various JavaScript interpreters compiled to WASM, the most popular of those is probably QuickJS. Here's one of my many demos: https://tools.simonwillison.net/quickjs (I have one for MicroQuickJS too http

Wow that's almost what I want. wget https://github.com/brettcannon/cpython-wasi-build/releases/download/v3.13.0/python… unzip python-3.13.0-wasi_sdk-24.zip wasmtime run --dir .::/ python.wasm -c 'print("hello world")' So far so good! But... it looks like that --dir option mounts the current directory as both readable and writable: wasmtime run --dir .::/ python.wasm -c 'print(len(open("python.wasm", "rb").read()))' # Outputs 28775526 But malicious code can break the system like this: wasmtime run --dir .::/ python.wasm -c 'open("python.wasm", "wb").write(b"blah")' And now it fails with an error if you try to run it because we over-wrote python.wasm. Even if I move python.wasm out of the current directory I'd still be able to break things by breaking those other lib files. Although... I gues

Does anyone know what the simplest possible recipe for running a Python script in a WASM sandbox using Spin is? I basically want to do something like this: my-sandbox-cli-tool 'print("hello world") And have the snippet of Python code I provide run inside a WebAssembly container that runs one of the Python compiled to WASM builds (https://github.com/brettcannon/cpython-wasi-build for example) - with a time limit and restrictions on memory usage, and file system access, and network access. I am on a continued quest to figure out the cleanest way to achieve this, I have so many projects I would want to build on top of this capability!