Sandboxed plugins for Node.js

Question

I'm a complete Node noob, so I apologize if this question has an obvious answer.

I'm looking to create a web app that will run plugins from untrusted sources (i.e. community submissions). So I need to lock down those plugins into a sandbox where only certain access is allowed (can't write to disk, etc.). Ideally, the plugin would only be able to use certain approved node packages and APIs.

Is this possible in Node? If so, can you point me toward a package or documentation that will get me started?

Answer 1

Here is a small list of projects that can help you:

• https://github.com/gf3/sandbox
• https://github.com/hflw/node-sandbox
• https://github.com/bcoe/sandcastle
• https://github.com/wearefractal/boxy

I suggest the first one (sandbox) since it's more mature.

Answer 2

I would also contribute to the list with my library: https://github.com/asvd/jailed. In addition to the sandboxing of the untrusted code (in a restricted subprocess), it gives an opportunity to export any set of functions inside the sandbox thus defining a custom API for the sandboxed code.