Skip to content

initial sandbox #7035

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
youknowone merged 2 commits into from
Feb 8, 2026
Merged

initial sandbox #7035

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
dd10bf2
Add host_env feature for sandbox isolation
youknowone Feb 8, 2026
aae539a
Auto-format: ruff check --select I --fix
github-actions[bot] Feb 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .cspell.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,6 +113,7 @@
"pytype",
"reducelib",
"richcompare",
"rustix",
"RustPython",
"significand",
"struc",
Expand Down
17 changes: 15 additions & 2 deletions .github/workflows/ci.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,8 +16,8 @@ concurrency:
cancel-in-progress: true

env:
CARGO_ARGS: --no-default-features --features stdlib,importlib,stdio,encodings,sqlite,ssl-rustls
CARGO_ARGS_NO_SSL: --no-default-features --features stdlib,importlib,stdio,encodings,sqlite
CARGO_ARGS: --no-default-features --features stdlib,importlib,stdio,encodings,sqlite,ssl-rustls,host_env
CARGO_ARGS_NO_SSL: --no-default-features --features stdlib,importlib,stdio,encodings,sqlite,host_env
# Crates excluded from workspace builds:
# - rustpython_wasm: requires wasm target
# - rustpython-compiler-source: deprecated
Expand Down Expand Up @@ -153,6 +153,19 @@ jobs:
- name: check compilation without threading
run: cargo check ${{ env.CARGO_ARGS }}

- name: check compilation without host_env (sandbox mode)
run: |
cargo check -p rustpython-vm --no-default-features --features compiler
cargo check -p rustpython-stdlib --no-default-features --features compiler
cargo build --no-default-features --features stdlib,importlib,stdio,encodings,freeze-stdlib
if: runner.os == 'Linux'

- name: sandbox smoke test
run: |
target/debug/rustpython extra_tests/snippets/sandbox_smoke.py
target/debug/rustpython extra_tests/snippets/stdlib_re.py
if: runner.os == 'Linux'
Comment on lines +156 to +167
Copy link
Contributor

@coderabbitai coderabbitai bot Feb 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🏁 Script executed:

# Check the actual file and content at the specified lines
head -170 .github/workflows/ci.yaml | tail -25

Repository: RustPython/RustPython

Length of output: 1256

🏁 Script executed:

# Search for other uses of extra_tests/snippets in the codebase
rg "extra_tests/snippets" --type yaml --type sh -A 2 -B 2

Repository: RustPython/RustPython

Length of output: 47

🏁 Script executed:

# Check Cargo.toml to understand compiler feature
rg "compiler" Cargo.toml -A 2 -B 2 | head -50

Repository: RustPython/RustPython

Length of output: 681

🏁 Script executed:

# Look for how cargo run is typically used in RustPython workflows
rg "cargo run" .github/workflows/ -A 1 -B 1 | head -60

Repository: RustPython/RustPython

Length of output: 1057

🏁 Script executed:

# Search for how compiler feature relates to .py execution/compilation
rg "compiler" crates/vm -A 2 -B 2 | head -40

Repository: RustPython/RustPython

Length of output: 2602

🏁 Script executed:

# Check if there's any documentation or tests about sandbox mode and compiler feature
rg "sandbox" --type rust --type py -B 3 -A 3 | head -60

Repository: RustPython/RustPython

Length of output: 3899

🏁 Script executed:

# Check the feature definitions in Cargo.toml for rustpython-vm
rg "\[features\]" -A 30 rustpython-vm/Cargo.toml

Repository: RustPython/RustPython

Length of output: 129

🏁 Script executed:

# Look for any existing uses of cargo run with sandbox/no-default-features
rg "cargo.*run.*no-default-features" -A 1 -B 1

Repository: RustPython/RustPython

Length of output: 231

🏁 Script executed:

# Check the main binary's implementation to see what features it uses for .py execution
cat -n src/lib.rs | head -100

Repository: RustPython/RustPython

Length of output: 4289

🏁 Script executed:

# Look for feature guards around .py compilation/execution
rg "feature.*compiler\|feature.*parser" src/lib.rs -B 2 -A 2

Repository: RustPython/RustPython

Length of output: 47

🏁 Script executed:

# Check what features are needed for the main binary
rg "\[features\]" Cargo.toml -A 50 | head -80

Repository: RustPython/RustPython

Length of output: 1885

🏁 Script executed:

# Check the actual file reading logic in sandbox mode
cat -n src/lib.rs | sed -n '100,200p'

Repository: RustPython/RustPython

Length of output: 4296

🏁 Script executed:

# Look for how compiler feature is gated in the codebase for .py execution
rg "cfg.*compiler" src/ -B 2 -A 2 | head -50

Repository: RustPython/RustPython

Length of output: 47

🏁 Script executed:

# Check if there's a feature guard around compilation in the interpreter
ast-grep --pattern 'fn.*compile($_)' | head -30

Repository: RustPython/RustPython

Length of output: 47

🏁 Script executed:

# Check if other CI workflows use cargo run vs direct binary execution
rg "cargo run" .github/workflows/ci.yaml -B 3 -A 3

Repository: RustPython/RustPython

Length of output: 979

🏁 Script executed:

# Look for other direct binary execution in the CI
rg "target/debug" .github/workflows/ci.yaml -B 2 -A 2

Repository: RustPython/RustPython

Length of output: 286

🏁 Script executed:

# Check if there's any documentation or rationale for cargo run vs direct binary
find . -name "*.md" -o -name "*.txt" | xargs grep -l "cargo run\|direct binary" 2>/dev/null | head -5

Repository: RustPython/RustPython

Length of output: 238

🏁 Script executed:

# Verify the guideline applies to CI/workflows context by checking AGENTS.md
cat -n AGENTS.md | grep -A 5 -B 5 "extra_tests/snippets"

Repository: RustPython/RustPython

Length of output: 1029

🏁 Script executed:

# Verify the exact feature syntax by checking if stdlib,importlib,stdio,encodings,freeze-stdlib,compiler is valid
rg "features.*stdlib.*importlib.*stdio" Cargo.toml -A 1 -B 1

Repository: RustPython/RustPython

Length of output: 47

🏁 Script executed:

# Check if there are any other uses of cargo run with multiple features in CI
rg "cargo run.*--features.*," .github/workflows/ -A 1 -B 1

Repository: RustPython/RustPython

Length of output: 47

Run sandbox snippets via cargo run instead of direct binary execution.

The smoke test should follow the project guideline for extra_tests/snippets/** tests: use cargo run with debug mode for faster compilation. Additionally, add the compiler feature to the build step for consistency with the check step above it.

🔧 Suggested update 
      - name: check compilation without host_env (sandbox mode)
        run: |
          cargo check -p rustpython-vm --no-default-features --features compiler
          cargo check -p rustpython-stdlib --no-default-features --features compiler
-         cargo build --no-default-features --features stdlib,importlib,stdio,encodings,freeze-stdlib
+         cargo build --no-default-features --features stdlib,importlib,stdio,encodings,freeze-stdlib,compiler
         if: runner.os == 'Linux'

       - name: sandbox smoke test
         run: |
-          target/debug/rustpython extra_tests/snippets/sandbox_smoke.py
-          target/debug/rustpython extra_tests/snippets/stdlib_re.py
+          cargo run --no-default-features --features stdlib,importlib,stdio,encodings,freeze-stdlib,compiler -- extra_tests/snippets/sandbox_smoke.py
+          cargo run --no-default-features --features stdlib,importlib,stdio,encodings,freeze-stdlib,compiler -- extra_tests/snippets/stdlib_re.py
         if: runner.os == 'Linux'
🤖 Prompt for AI Agents 
In @.github/workflows/ci.yaml around lines 156 - 167, Update the CI job to build
with the compiler feature and run sandbox snippets using cargo run instead of
invoking the binary directly: add the compiler feature to the build line (the
step that currently runs cargo build --no-default-features --features
stdlib,importlib,stdio,encodings,freeze-stdlib) so it becomes consistent with
the check steps, and replace the two direct binary executions
(target/debug/rustpython extra_tests/snippets/sandbox_smoke.py and
target/debug/rustpython extra_tests/snippets/stdlib_re.py) in the "sandbox smoke
test" step with cargo run --bin rustpython -- <snippet-path> (run in debug mode)
to follow the extra_tests/snippets guideline and ensure faster, reproducible
builds.


- name: Test openssl build
run: cargo build --no-default-features --features ssl-openssl
if: runner.os == 'Linux'
Expand Down
3 changes: 2 additions & 1 deletion Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,8 @@ repository.workspace = true
license.workspace = true

[features]
default = ["threading", "stdlib", "stdio", "importlib", "ssl-rustls"]
default = ["threading", "stdlib", "stdio", "importlib", "ssl-rustls", "host_env"]
host_env = ["rustpython-vm/host_env", "rustpython-stdlib?/host_env"]
importlib = ["rustpython-vm/importlib"]
encodings = ["rustpython-vm/encodings"]
stdio = ["rustpython-vm/stdio"]
Expand Down
3 changes: 2 additions & 1 deletion crates/stdlib/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,8 @@ license.workspace = true
# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html

[features]
default = ["compiler"]
default = ["compiler", "host_env"]
host_env = ["rustpython-vm/host_env"]
compiler = ["rustpython-vm/compiler"]
threading = ["rustpython-common/threading", "rustpython-vm/threading"]
sqlite = ["dep:libsqlite3-sys"]
Expand Down
153 changes: 105 additions & 48 deletions crates/stdlib/src/lib.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,12 +34,15 @@ mod sha512;

mod json;

#[cfg(not(any(target_os = "ios", target_arch = "wasm32")))]
#[cfg(all(
feature = "host_env",
not(any(target_os = "ios", target_arch = "wasm32"))
))]
mod locale;

mod _opcode;
mod math;
#[cfg(any(unix, windows))]
#[cfg(all(feature = "host_env", any(unix, windows)))]
mod mmap;
mod pyexpat;
mod pystruct;
Expand All @@ -48,57 +51,83 @@ mod statistics;
mod suggestions;
// TODO: maybe make this an extension module, if we ever get those
// mod re;
#[cfg(not(target_arch = "wasm32"))]
#[cfg(all(feature = "host_env", not(target_arch = "wasm32")))]
pub mod socket;
#[cfg(all(unix, not(target_os = "redox")))]
#[cfg(all(feature = "host_env", unix, not(target_os = "redox")))]
mod syslog;
mod unicodedata;

#[cfg(feature = "host_env")]
mod faulthandler;
#[cfg(any(unix, target_os = "wasi"))]
#[cfg(all(feature = "host_env", any(unix, target_os = "wasi")))]
mod fcntl;
#[cfg(not(target_arch = "wasm32"))]
#[cfg(all(feature = "host_env", not(target_arch = "wasm32")))]
mod multiprocessing;
#[cfg(all(unix, not(target_os = "redox"), not(target_os = "android")))]
#[cfg(all(
feature = "host_env",
unix,
not(target_os = "redox"),
not(target_os = "android")
))]
mod posixshmem;
#[cfg(unix)]
#[cfg(all(feature = "host_env", unix))]
mod posixsubprocess;
// libc is missing constants on redox
#[cfg(all(
feature = "sqlite",
not(any(target_os = "android", target_arch = "wasm32"))
))]
mod _sqlite3;
#[cfg(all(unix, not(any(target_os = "android", target_os = "redox"))))]
#[cfg(all(
feature = "host_env",
unix,
not(any(target_os = "android", target_os = "redox"))
))]
mod grp;
#[cfg(windows)]
#[cfg(all(feature = "host_env", windows))]
mod overlapped;
#[cfg(all(unix, not(target_os = "redox")))]
#[cfg(all(feature = "host_env", unix, not(target_os = "redox")))]
mod resource;
#[cfg(target_os = "macos")]
#[cfg(all(feature = "host_env", target_os = "macos"))]
mod scproxy;
#[cfg(any(unix, windows, target_os = "wasi"))]
#[cfg(all(feature = "host_env", any(unix, windows, target_os = "wasi")))]
mod select;

#[cfg(all(not(target_arch = "wasm32"), feature = "ssl-openssl"))]
#[cfg(all(
feature = "host_env",
not(target_arch = "wasm32"),
feature = "ssl-openssl"
))]
mod openssl;
#[cfg(all(not(target_arch = "wasm32"), feature = "ssl-rustls"))]
#[cfg(all(
feature = "host_env",
not(target_arch = "wasm32"),
feature = "ssl-rustls"
))]
mod ssl;
#[cfg(all(feature = "ssl-openssl", feature = "ssl-rustls"))]
compile_error!("features \"ssl-openssl\" and \"ssl-rustls\" are mutually exclusive");

#[cfg(all(unix, not(target_os = "redox"), not(target_os = "ios")))]
#[cfg(all(
feature = "host_env",
unix,
not(target_os = "redox"),
not(target_os = "ios")
))]
mod termios;
#[cfg(not(any(
target_os = "android",
target_os = "ios",
target_os = "windows",
target_arch = "wasm32",
target_os = "redox",
)))]
#[cfg(all(
feature = "host_env",
not(any(
target_os = "android",
target_os = "ios",
target_os = "windows",
target_arch = "wasm32",
target_os = "redox",
))
))]
mod uuid;

#[cfg(feature = "tkinter")]
#[cfg(all(feature = "host_env", feature = "tkinter"))]
mod tkinter;

use rustpython_common as common;
Expand All @@ -122,69 +151,97 @@ pub fn stdlib_module_defs(ctx: &Context) -> Vec<&'static builtins::PyModuleDef>
cmath::module_def(ctx),
contextvars::module_def(ctx),
csv::module_def(ctx),
#[cfg(feature = "host_env")]
faulthandler::module_def(ctx),
#[cfg(any(unix, target_os = "wasi"))]
#[cfg(all(feature = "host_env", any(unix, target_os = "wasi")))]
fcntl::module_def(ctx),
#[cfg(all(unix, not(any(target_os = "android", target_os = "redox"))))]
#[cfg(all(
feature = "host_env",
unix,
not(any(target_os = "android", target_os = "redox"))
))]
grp::module_def(ctx),
hashlib::module_def(ctx),
json::module_def(ctx),
#[cfg(not(any(target_os = "ios", target_arch = "wasm32")))]
#[cfg(all(
feature = "host_env",
not(any(target_os = "ios", target_arch = "wasm32"))
))]
locale::module_def(ctx),
#[cfg(not(any(target_os = "android", target_arch = "wasm32")))]
lzma::module_def(ctx),
math::module_def(ctx),
md5::module_def(ctx),
#[cfg(any(unix, windows))]
#[cfg(all(feature = "host_env", any(unix, windows)))]
mmap::module_def(ctx),
#[cfg(not(target_arch = "wasm32"))]
#[cfg(all(feature = "host_env", not(target_arch = "wasm32")))]
multiprocessing::module_def(ctx),
#[cfg(all(not(target_arch = "wasm32"), feature = "ssl-openssl"))]
#[cfg(all(
feature = "host_env",
not(target_arch = "wasm32"),
feature = "ssl-openssl"
))]
openssl::module_def(ctx),
#[cfg(windows)]
#[cfg(all(feature = "host_env", windows))]
overlapped::module_def(ctx),
#[cfg(unix)]
#[cfg(all(feature = "host_env", unix))]
posixsubprocess::module_def(ctx),
#[cfg(all(unix, not(target_os = "redox"), not(target_os = "android")))]
#[cfg(all(
feature = "host_env",
unix,
not(target_os = "redox"),
not(target_os = "android")
))]
posixshmem::module_def(ctx),
pyexpat::module_def(ctx),
pystruct::module_def(ctx),
random::module_def(ctx),
#[cfg(all(unix, not(target_os = "redox")))]
#[cfg(all(feature = "host_env", unix, not(target_os = "redox")))]
resource::module_def(ctx),
#[cfg(target_os = "macos")]
#[cfg(all(feature = "host_env", target_os = "macos"))]
scproxy::module_def(ctx),
#[cfg(any(unix, windows, target_os = "wasi"))]
#[cfg(all(feature = "host_env", any(unix, windows, target_os = "wasi")))]
select::module_def(ctx),
sha1::module_def(ctx),
sha256::module_def(ctx),
sha3::module_def(ctx),
sha512::module_def(ctx),
#[cfg(not(target_arch = "wasm32"))]
#[cfg(all(feature = "host_env", not(target_arch = "wasm32")))]
socket::module_def(ctx),
#[cfg(all(
feature = "sqlite",
not(any(target_os = "android", target_arch = "wasm32"))
))]
_sqlite3::module_def(ctx),
#[cfg(all(not(target_arch = "wasm32"), feature = "ssl-rustls"))]
#[cfg(all(
feature = "host_env",
not(target_arch = "wasm32"),
feature = "ssl-rustls"
))]
ssl::module_def(ctx),
statistics::module_def(ctx),
suggestions::module_def(ctx),
#[cfg(all(unix, not(target_os = "redox")))]
#[cfg(all(feature = "host_env", unix, not(target_os = "redox")))]
syslog::module_def(ctx),
#[cfg(all(unix, not(any(target_os = "ios", target_os = "redox"))))]
#[cfg(all(
feature = "host_env",
unix,
not(any(target_os = "ios", target_os = "redox"))
))]
termios::module_def(ctx),
#[cfg(feature = "tkinter")]
#[cfg(all(feature = "host_env", feature = "tkinter"))]
tkinter::module_def(ctx),
unicodedata::module_def(ctx),
#[cfg(not(any(
target_os = "android",
target_os = "ios",
target_os = "windows",
target_arch = "wasm32",
target_os = "redox"
)))]
#[cfg(all(
feature = "host_env",
not(any(
target_os = "android",
target_os = "ios",
target_os = "windows",
target_arch = "wasm32",
target_os = "redox"
))
))]
uuid::module_def(ctx),
zlib::module_def(ctx),
]
Expand Down
3 changes: 2 additions & 1 deletion crates/vm/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,8 @@ repository.workspace = true
license.workspace = true

[features]
default = ["compiler", "wasmbind", "stdio", "gc"]
default = ["compiler", "wasmbind", "gc", "host_env", "stdio"]
host_env = []
stdio = []
importlib = []
encodings = ["importlib"]
Expand Down
Loading
Loading