I would like to generate code with Codex and execute it without reviewing the code. What is a good sandbox environment I can run on my computer? Is Firejail a good pick?
1 Like
If you’re comfortable with Docker, you can pull Docker images from Docker Hub that are built with the tools to run a container that supports the programming language of choice. I’m actually in the process of creating a Dockerized Full-Stack Webserver and I’m currently trying to integrate a system where you can spin up a Docker container on the fly on the webpage and run the code in a container where you can see the code run visually if needed (e.g. Selenium web automation), strictly through a terminal, or both if desired.
I’m still trying to figure out the most efficient way to integrate it into the webserver right now so that it can handle a wide range of programming languages, however you can pull images that support each programming language individually and run them when you need to test the code output from Codex! They’re relatively fast to spin up too.
Here are some official Docker images:
Python
Ruby
Java
And way more!
Yeah, docker containers are great. However somewhere I read/heard that Codex crashed/damaged the host system even when run inside docker.
Well, there are a few cases where that could happen. I’m unsure of this method, but if you’re looking for total sandbox isolation, then you could use virtualization to set up a virtual machine and then set up a Docker container in that where the user you’re running the code under doesn’t have root access to prevent damage. I can’t look into it extensively at the moment, but this is where I saw that idea: Docker as a sandbox for untrusted code - Information Security Stack Exchange
Here’s why you’d use virtualization (quoted from that post):
For virtualization, you start with pretty much complete isolation and provide some well-guarded, well-described interfaces; this means you can be rather sure breaking out of a virtual machine is hard. The kernel is not shared, if you have some kernel exploit allowing you to escape from user restrictions, the hypervisor is till in-between you and other virtual machines.
1 Like
Also, in that same post, there is another user who said that you could set up a virtual machine running SmartOS and then use Docker containers within that virtual machine. See also: Joyent: Run Docker On SmartOS For Greater Security
1 Like
Docker with gVisor looks perfect!
Thanks @CowDex, gVisor looks like the absolute perfect solution here! In fact, I’ll actually be moving forward with integrating gVisor into the current stack I’m working on that I’ll release to the OpenAI community once it’s finished up!