all posts
blog · topic

Code execution sandboxes

Executing code you did not write — from an LLM, a user, or a pull request — is a sandboxing problem first and a runtime problem second. These posts cover code interpreter architecture, Python and notebook execution, timeouts and resource limits, and why the isolation boundary matters more than the language runtime.

Code interpreter sandboxes on PandaStack

222 posts

·11 min read

Every In-Process Python Sandbox Leaks, and the Reason Is Structural

Removing a name from a namespace removes a name, not reachability. CPython's object graph has no partitions, and `ctypes` is a documented feature whose purpose is calling arbitrary native code. Here is where the boundary actually has to go.

pythonsandboxingrestrictedpython
Ajay Kumar
·11 min read

Pickle Is a Virtual Machine You Have Been Downloading

pickle is a stack machine with an eval loop, and you have been downloading it from the internet as model weights. Here is the disassembly, why the allowlist promises less than it looks, and the conversion gateway that fixes it once instead of forever.

pickledeserializationpython
Ajay Kumar
·10 min read

AgentCore's Code Interpreter, or a Sandbox You Hold?

The question is not which sandbox boots faster. It is how much of your agent stack you want to buy as one unit — and AgentCore is a very large unit that happens to contain a code interpreter.

awsbedrock-agentcorecode-interpreter
Ajay Kumar
·11 min read

The Best WebAssembly Runtimes in 2026 (From a MicroVM Vendor)

I sell microVMs, which makes me the wrong person to write this and therefore obliged to write it fairly. A buyer's guide to the WASM runtimes themselves: what the artifact is, what the guest can reach, what your language actually compiles to, and what stops a while(1).

comparisonwebassemblywasm
Ajay Kumar
·11 min read

PandaStack vs Gitpod / Ona: A Workspace Is Not a Sandbox

Gitpod was right about disposable development environments before most of the industry agreed. The divergence is not quality, it is the unit: a workspace a person opens, versus a sandbox an API call creates and throws away 400 times.

gitpodonacomparison
Ajay Kumar
·11 min read

Server-Side Rendering Someone Else's React Component

If your product server-renders components your customers wrote, you are running their code in your process, with your env vars and your database socket. node:vm is a sandbox for values, not for a module graph that can require("fs"). Here is the boundary that actually holds, and what it costs.

ssrreactnodejs
Ajay Kumar
·10 min read

Untrusted CAD: Running Customer (and Model-Generated) Geometry Scripts in a MicroVM

A product configurator, a 3D-print shop and an AI agent that emits parametric geometry all end up in the same place: executing a script that produces a solid. "We only run geometry scripts" is not a security property. It is a hope.

cadopenscadcadquery
Ajay Kumar
·11 min read

Self-Hosting a Compiler Explorer: Running Strangers' Compilers Safely

"I'm not running their code, I'm only compiling it" is the most expensive sentence in this genre. A compiler is a programmable machine with a filesystem, a plugin loader and an unbounded appetite for RAM — and on a compiler explorer, the flags are user input too.

compiler-exploreruntrusted-codemicrovm
Ajay Kumar
·10 min read

Notebooks in Production: Parameterised Runs in Disposable microVMs

The quarterly board metric comes out of cell 34, which must be run in order, by Dmitri, on his laptop. The notebook is not the problem. The laptop is. Papermill turns the notebook into a batch artefact; a disposable microVM per run turns it into one you can trust.

notebookspapermilljupyter
Ajay Kumar

More posts in this topic