# rink-sandbox

Rink-sandbox was designed to sandbox Rink queries (which can take
arbitrarily large memory/time). Rink's syntax does not expose any type
of IO, so a full security sandbox is not required.

This crate supports Windows, macOS, and Linux.

This crate was designed with some effort to making it general purpose
for other types of applications, but it may not perfectly match some
usecases.

Rink-sandbox is a crate for running app code in a contained environment, specifically:

- Memory usage is limited.
- Execution time is limited.
- Tasks can be interrupted with Ctrl+C.
- Panics are caught and surfaced to the caller.

This is achieved by running tasks in a child process. Memory is limited
using `#[global_allocator]`. Execution time is limited using a simple
timeout, rather than relying on OS scheduler-level timing.

There's no platform specific code in this crate, this is handled by
other dependencies. Unsafe code is limited to only the allocator, where
it's required.

Messages are serialized using bincode and sent through the child
process's stdin/stdout channels for best portability.

## Limitations

- This is not a security solution on its own. All network, disk, and
  other environment access is still allowed in the child process.
- Your app code needs to avoid reading from stdin or writing to stdout
  when becoming the child process. Unfortunately, there's no good
  solution for redirecting or capturing stdout: gag and stdio-redirect
  are Linux only, and shh doesn't allow reading without blocking until
  the pipe is closed. The next best solution is to write a logger and
  expect all app code to use `log` instead of `println`.
- This might not work well outside of the usecase of a CLI app, but this
  could be improved in the future.