Working Python code in a sandbox with MicroPython and WASM

Working Python code in a sandbox with MicroPython and WASM

sixth June 2026

I’ve been experimenting with completely different approaches to working code in a sandbox for a number of years now, however my newest try feels prefer it would possibly lastly have the entire traits I’ve been on the lookout for. I’ve launched it as an alpha package deal known as micropython-wasm, and I’m utilizing it for a code execution sandbox plugin for Datasette Agent known as datasette-agent-micropython.

Why do I need a sandbox?

My key open supply tasks—Datasette, LLM, even sqlite-utils—all assist plugins.

I completely love plugins as a mechanism for extending software program. A rigorously designed plugin system reduces the chance concerned in attempting new issues to virtually nothing—even the wildest concepts received’t go away a long-lasting affect on the core utility itself. My software program can develop a brand new function in a single day and I don’t even must overview a pull request!

There’s one main downside: my plugin methods all use Python and Pluggy, and plugin code executes with full privileges inside my purposes. A buggy or malicious plugin may break the whole lot or leak non-public knowledge.

I’d love to have the ability to run plugin-style code in an surroundings the place it’s unable to learn unapproved information, connect with a community, or usually function in a method that’s dangerous or dangerous to the remainder of the applying or the consumer’s laptop.

My curiosity covers extra than simply plugins. For Datasette specifically there are various options I’d prefer to assist the place arbitrary code execution could be helpful. I’ve already experimented with this for Datasette Enrichments, the place code can be utilized to rework values saved in a desk. I’d like to construct a mechanism the place you may run code on a schedule that fetches JSON from an permitted location, runs a tiny little bit of code to reformat it into an inventory of dictionaries, then inserts these as rows in a SQLite database desk.

What I would like from a sandbox

My aim is to execute code safely inside my very own Python purposes. Right here’s what I want:

Dependencies that cleanly set up from PyPI, together with binary wheels throughout a number of platforms if needed. I don’t need folks utilizing my software program to must take any further steps past immediately putting in my Python package deal.
Executed code have to be topic to each reminiscence and CPU limits. I don’t need whereas True: s += “longer string” to crash my utility or the consumer’s laptop.

File entry have to be strictly managed. Both no filesystem entry in any respect or I get to outline precisely which information might be learn and which information might be written to.

Community entry is managed as effectively. Sandboxed code shouldn’t be in a position to talk with something with out going by way of a layer I totally management.
Assist for interplay with host capabilities. A sandbox isn’t a lot use if I can’t rigorously expose chosen platform options to the code that it’s working.
It must be strong, supported, and clearly documented. I’ve misplaced depend of the variety of sandbox tasks I’ve seen in repos with warnings that they aren’t actively maintained!

WebAssembly appears to be like actually promising right here

Net browsers function in probably the most hostile surroundings possible with regards to malicious code. Their job is to obtain and execute untrusted code from the online on virtually each web page load.

Given this, JavaScript engines ought to be glorious candidates for sandboxes. Sadly these engines are additionally extraordinarily difficult, and usually are not designed for straightforward embedding in different tasks. Many of the V8-in-Python tasks I’ve seen are occasionally maintained and include warnings to not use them with fully untrusted code.

WebAssembly is a a lot better candidate. It was designed from the begin to assist the entire traits I care about and has been examined in browsers for practically a decade. The wasmtime Python library brings WASM to Python, is actively maintained, and has binary wheels.

MicroPython in WebAssembly

WebAssembly engines like wasmtime run WebAssembly binaries. Some programming languages like Rust are straightforward to compile on to WebAssembly. Dynamic languages like JavaScript and Python are tougher—they assist language primitives like eval(), which implies they want a full interpreter accessible at runtime.

To run Python we want a full Python interpreter compiled to WebAssembly, wired up in a method that makes it straightforward to feed it code, hook up host capabilities and entry the outcomes.

Pyodide gives an impressive package deal for working Python utilizing WebAssembly within the browser, however utilizing Pyodide in server-side Python isn’t supported. The latest recommendation I may discover was from October 2024 stating “Pyodide is constructed by the Emscripten toolchain and might solely run in a browser or Node.js”.

The opposite day I made a decision to check out MicroPython as an possibility for this. The MicroPython web site says:

MicroPython is a lean and environment friendly implementation of the Python 3 programming language that features a small subset of the Python customary library and is optimised to run on microcontrollers and in constrained environments.

WebAssembly certain looks like a constrained surroundings to me!

Constructing the primary model

I had GPT-5.5 Professional perform some research for me, which turned up this PR in opposition to MicroPython by Yamamoto Takahashi titled “Experimental WASI assist for ports/unix”.

It then produced this analysis.md doc, so I let Codex Desktop and GPT-5.5 excessive free on it to see what would occur:

learn the analysis.md doc and construct this. You’ll most likely want to jot down a script that compiles a customized WASM model of MicroPython as a part of this mission – fetch the MicroPython code to a /tmp listing for this as a part of that script.

It labored. I now had a prototype Python library that might execute Python code inside a WebAssembly sandbox!

The trickiest piece to resolve was persistent interpreter state. The WASM construct we’re utilizing right here exposes a single entry level which begins the interpreter, runs the code after which stops the interpreter on the finish.

This works superb for one-off scripts, however for Datasette Agent I would like variables and capabilities to remain resident in reminiscence so I can reuse them throughout a number of code execution calls.

A neat factor about working with coding brokers is that you may get from an concept to a proof of idea rapidly. I prompted:

For retaining variables resident: what if we ran code inside micropython itself which known as a bunch operate get_next_python_code() after which handed that to eval() – and that host operate blocked till new code was accessible, perhaps by working in a thread with a queue? Might that or an analogous concept assist right here?

After some iteration we obtained to a model of this that works! In Python code now you can do that:

from micropython_wasm import MicroPythonSession

with MicroPythonSession() as session:
print(session.run(“x = 10nprint(x)”).stdout)
print(session.run(“x += 5nprint(x)”).stdout)
print(session.run(“print(x * 2)”).stdout)

Below the hood this begins a thread, units up a request queue after which sends messages to that queue for the session.run() command, every time ready on a reply queue for the results of that execution. Inside WASM the MicroPython interpreter blocks ready for a __session_next__() host operate to return the subsequent line of code, which it runs eval() on earlier than calling __session_result__({“id”: request_id, “okay”: True}) when every block has been efficiently executed.

The opposite piece of complexity was supporting host capabilities, so my Python library may selectively expose capabilities that might then be known as by code working in MicroPython.

Codex ended up fixing this with 78 traces of C, which finally ends up compiled into the 362KB WebAssembly blob I’m distributing with the package deal.

I’m under no circumstances a C programmer, however I’ve learn the C and had two completely different fashions clarify it to me (right here’s Claude’s rationalization) and I’ve subjected it to a barrage of exams.

The wonderful thing about working with WebAssembly is that if the C seems to be fatally flawed the worst that may occur is the WebAssembly execution will fail with an exception. I can reside with that danger.

Reminiscence limits are immediately supported by wasmtime. CPU limits are a bit tougher: wasmtime gives a “gas” idea to restrict what number of operations a WebAssembly name can execute, and that’s the right match for this downside, however the models are onerous to cause about. I’m experimenting with a 20 million default “gas” setting now however I’m not assured that it’s probably the most acceptable worth.

Strive it your self

The micropython-wasm alpha is now reside on PyPI.

You possibly can attempt it from your personal Python code as described within the README. I’ve additionally added a easy CLI mode in model 0.1a2 which implies you may attempt it utilizing uvx with out first putting in it like so:

You too can attempt it in Datasette Agent like this:

Then navigate to http://127.0.0.1:8001/-/agent and run the immediate:

present me some micropython

Must you belief my vibe-coded sandbox?

Having complained about immature, loosely-maintained sandboxing libraries, it’s deeply ironic that I’ve now constructed my very own!

I intentionally slapped an alpha launch model on it, and I’m not able to suggest it to anybody who isn’t keen to take a major danger.

I’ve put it by way of sufficient testing that I’m OK utilizing it myself. I’ve shipped my first plugin that makes use of it, datasette-agent-micropython. I’ve additionally locked GPT-5.5 xhigh in that Datasette Agent plugin and challenged it to interrupt out of the sandbox and to this point it has not managed to.

I’m hoping this implementation can persuade some corporations with skilled safety groups and high-stakes issues to decide to utilizing Python in WebAssembly as a sandboxing strategy and open supply their very own options.