Consider using v8 sandbox

[cheesycod]

v8 includes its own sandbox feature as an additional defense in depth measure against exploits which is super useful especially since openworkers is meant for running untrusted code execution (Cloudflare also uses this feature BTW)

Regarding rusty v8 support, I actually PR'd (and got merged as an experimental feature) v8 sandbox support to rusty_v8 myself for smth similar to openworkers. See https://github.com/denoland/rusty_v8?tab=readme-ov-file#experimental-features for more info on it (and if you want prebuilts, check https://github.com/luaufusion/rustyv8bins as I've published prebuilt compiles of rusty_v8 with sandboxing).

Either way, this is an awesome project

[max-lt]

Hey, thanks for this! Really cool that you got the sandbox support merged into rusty_v8.

I've been meaning to look into this. Your use case with Discord bots sounds pretty similar to what we're doing here, same kind of trust boundaries.

Quick questions:

• Did you run into any issues with Web APIs (streams, crypto.subtle, etc.) when sandbox is enabled?
• Any perf overhead you noticed?

Will definitely check out your prebuilt binaries. Would be nice to add this as a feature. Thanks for the pointer!

[max-lt]

ref denoland/rusty_v8#1861 denoland/rusty_v8#1448 denoland/rusty_v8#1859

[cheesycod]

Hey, thanks for this! Really cool that you got the sandbox support merged into rusty_v8.

I've been meaning to look into this. Your use case with Discord bots sounds pretty similar to what we're doing here, same kind of trust boundaries.

Quick questions:

• Did you run into any issues with Web APIs (streams, crypto.subtle, etc.) when sandbox is enabled?
• Any perf overhead you noticed?

Will definitely check out your prebuilt binaries. Would be nice to add this as a feature. Thanks for the pointer!

I haven’t faced any issues porting deno_core to rusty v8 with sandbox and from there, adding crypto apis is trivial (I already have support for lots of web apis already) so I haven’t faced any issues here.

While there is a startup overhead using the sandbox, this overhead is negligible if startup snapshots are used in my tests (and without snapshots, only really manifests when making millions of isolates in burst as well).