Systems
vsandbox
Runs a program in its own folder, with a clean environment and limits.
Released v1.0.0 · 2026-09-28use "stdlib/sandbox.ven"A local isolated execution environment for running a Venutian program, or an external command, confined along three real axes: its own working directory, its own environment variables and a real wall clock timeout enforced by the operating system. It is a local isolation boundary, with no network or container based sandbox.
box = sandbox_new("/tmp", new_map(), 5000, 0)
print box.workdirReference (5 functions)
API reference
sandbox_new(workdir, allowed_env, timeout_ms, memory_limit_mb = 0)
Builds a new SandboxConfig, after checking that workdir really exists.
sandbox_new("/tmp", new_map(), 5000, 0).workdirshell_quote(text)
Single-quotes text for safe interpolation into a /bin/sh -c string.
shell_quote("it's")env_prefix_text(allowed_env)
Builds the space-separated NAME=value argument list for env -i.
env_prefix_text(map_set(new_map(), "GREETING", "hi"))sandbox_run_command(config, command)
Runs an arbitrary external command inside this sandbox.
sandbox_run_command(sandbox_new("/tmp", new_map(), 5000), ["/bin/sh", "-c", "echo hi"])["stdout"]sandbox_run_venutian(config, runner, entry_path, script_args)
Runs a Venutian program inside this sandbox, with the memory ceiling applied too.
sandbox_run_venutian(sandbox_new("/tmp", new_map(), 5000), ["bin/venutian"], "hello.ven", [])["exit_code"]