I am planning to use pyodide inside of node as a sandbox for running (testing and analyzing) Python code on a server. The Python code will be written by students. It will be submitted through a web interface. Although the system is not open to the public, I want the execution system to be as safe as possible against malicious code input. I am well aware that neither node nor pyodide were designed for this type of sandboxing, but if possible, I would like to avoid heavy machinery like virtualization.
Until now, my impression is that the system works as intended. My naive attempts at reading and writing to the file system and spawning processes from Python failed (as they should). However, I am not an IT security expert. Therefore my question is: which attack vectors should I be aware of? Do you think that the system (node+pyodide) in itself is sufficiently secure? Which additional measured so you suggest?
