A sealed script runner anyone can host

Open
  • Is something wrong?
#35 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
52/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Active
Tech stack
docker, typescript
Domain
backend, devops, security

Research direction

Start with the runner in packages/bim-script-runner and the hosted sandbox reference at apps/mutinybim-web/src/script-sandbox.ts; identify how the runner is bundled and which resource caps it already enforces. Then build the container and docs, and add a test showing a script cannot reach the network while the requested filesystem and resource limits hold.

Written by the indexing model from the issue text.

Description

area: scripting help wanted

From the roadmap ("Next").

The local runner in packages/bim-script-runner runs your own scripts in a fresh, capped process. To host other people's scripts safely, the same runner files need to run in a container with a deny-all network.

What to build

  • A container image and its build that bakes in the runner bundle.
  • A deny-all network, a read-only filesystem except a scratch folder, and the kit's existing memory, time and output caps.
  • Docs for running it, and a test that a script can't reach the network.

The hosted app already seals scripts with bubblewrap on its own machine (apps/mutinybim-web/src/script-sandbox.ts). That is a good reference.

Dominant language
TypeScript
Stars
85
Forks
10
Avg merge
1h 28m
Merged PRs (30d)
20

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from permitzip/mutinybim

All issues in permitzip/mutinybim

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.