Dancing mad with sandboxing
Summary
The article describes Kefka, a Go-native sandbox shell with coreutils and WebAssembly, and details the architecture, porting strategies, and integration approaches. It covers using POSIX-like interfaces in Go, WebAssembly for Python/JQ, and a path toward SSH-based remote sandboxing with object-storage-backed filesystems, highlighting security and automation implications. Rich code snippets illustrate the Exec/Execer interfaces and the workflow for building a reproducible sandboxed environment.