cpython-wasi-build

Wow that's almost what I want. wget https://github.com/brettcannon/cpython-wasi-build/releases/download/v3.13.0/python… unzip python-3.13.0-wasi_sdk-24.zip wasmtime run --dir .::/ python.wasm -c 'print("hello world")' So far so good! But... it looks like that --dir option mounts the current directory as both readable and writable: wasmtime run --dir .::/ python.wasm -c 'print(len(open("python.wasm", "rb").read()))' # Outputs 28775526 But malicious code can break the system like this: wasmtime run --dir .::/ python.wasm -c 'open("python.wasm", "wb").write(b"blah")' And now it fails with an error if you try to run it because we over-wrote python.wasm. Even if I move python.wasm out of the current directory I'd still be able to break things by breaking those other lib files. Although... I gues

Does anyone know what the simplest possible recipe for running a Python script in a WASM sandbox using Spin is? I basically want to do something like this: my-sandbox-cli-tool 'print("hello world") And have the snippet of Python code I provide run inside a WebAssembly container that runs one of the Python compiled to WASM builds (https://github.com/brettcannon/cpython-wasi-build for example) - with a time limit and restrictions on memory usage, and file system access, and network access. I am on a continued quest to figure out the cleanest way to achieve this, I have so many projects I would want to build on top of this capability!