all posts
blog · topic

Code execution sandboxes

Executing code you did not write — from an LLM, a user, or a pull request — is a sandboxing problem first and a runtime problem second. These posts cover code interpreter architecture, Python and notebook execution, timeouts and resource limits, and why the isolation boundary matters more than the language runtime.

Code interpreter sandboxes on PandaStack

225 posts

·10 min read

Analysing APKs Nobody on Your Team Wrote: One MicroVM Per Sample

The thing that breaks your mobile-app scanning pipeline is not a shell. It is a jadx run that pins every core on one crafted DEX, an apktool that writes small files until the volume runs out of inodes, and a zip entry named ../../etc/cron.d/x. Here is the isolation shape that survives that, and what it still cannot do.

mobile-securityapk-analysismicrovm
Ajay Kumar
·11 min read

PandaStack vs Kubernetes Jobs: Where "Just Create a Job" Stops Being the Right Answer

Your first instinct is to create a Kubernetes Job, and that instinct is usually correct. Here is the hardened Job you should actually write, the four mechanisms where the model breaks for untrusted per-request code, and the shim you will own if you push through anyway.

kuberneteskubernetes-jobsmulti-tenancy
Ajay Kumar
·10 min read

The Best Sandbox APIs for PHP and Laravel AI Agents in 2026

PHP cannot sandbox PHP — eval is not a boundary and disable_functions is a denylist over a vast standard library. Here is the honest field of options for running model-written PHP, and the PHP-shaped questions that decide which one fits.

comparisonphplaravel
Ajay Kumar
·11 min read

Every In-Process Python Sandbox Leaks, and the Reason Is Structural

Removing a name from a namespace removes a name, not reachability. CPython's object graph has no partitions, and `ctypes` is a documented feature whose purpose is calling arbitrary native code. Here is where the boundary actually has to go.

pythonsandboxingrestrictedpython
Ajay Kumar
·11 min read

Pickle Is a Virtual Machine You Have Been Downloading

pickle is a stack machine with an eval loop, and you have been downloading it from the internet as model weights. Here is the disassembly, why the allowlist promises less than it looks, and the conversion gateway that fixes it once instead of forever.

pickledeserializationpython
Ajay Kumar
·10 min read

AgentCore's Code Interpreter, or a Sandbox You Hold?

The question is not which sandbox boots faster. It is how much of your agent stack you want to buy as one unit — and AgentCore is a very large unit that happens to contain a code interpreter.

awsbedrock-agentcorecode-interpreter
Ajay Kumar
·11 min read

The Best WebAssembly Runtimes in 2026 (From a MicroVM Vendor)

I sell microVMs, which makes me the wrong person to write this and therefore obliged to write it fairly. A buyer's guide to the WASM runtimes themselves: what the artifact is, what the guest can reach, what your language actually compiles to, and what stops a while(1).

comparisonwebassemblywasm
Ajay Kumar
·11 min read

PandaStack vs Gitpod / Ona: A Workspace Is Not a Sandbox

Gitpod was right about disposable development environments before most of the industry agreed. The divergence is not quality, it is the unit: a workspace a person opens, versus a sandbox an API call creates and throws away 400 times.

gitpodonacomparison
Ajay Kumar
·11 min read

Server-Side Rendering Someone Else's React Component

If your product server-renders components your customers wrote, you are running their code in your process, with your env vars and your database socket. node:vm is a sandbox for values, not for a module graph that can require("fs"). Here is the boundary that actually holds, and what it costs.

ssrreactnodejs
Ajay Kumar

More posts in this topic