Sandboxing
Sandboxed environments allow execution of untrusted code with two broad
goals in mind:
- Security: prevent untrusted code from doing unsafe operations such as
accessing memory directly, causing segfaults, etc.
- Availability: prevent untrusted code from hogging resources, e.g.
consuming all available memory or entering an infinite loop.
Duktape provides mechanisms to achieve these goals for untrusted ECMAScript
code. All C code is expected to be trusted.
See
sandboxing.rst
for a detailed discussion of how to implement sandboxing.
Sandboxing support in Duktape 2.x is still a work in progress.