Dev tools · alternatives · 2026

24 alternatives to Sandboxing untrusted code using WebAssembly

Hi everyone, I built a runtime to isolate untrusted code using wasm sandboxes. Basically, it protects your host system from problems that untrusted code can cause. We’ve had a great discussion about sandboxing in Python lately that elaborates a bit more on the problem [1]. In TypeScript, wasm integration is even more natural thanks to the close proximity between both ecosystems. The core is built in Rust. On top of that, I use WASI 0.2 via wasmtime and the component model, along with custom SDKs that keep things as idiomatic as possible. For example, in Python we have a simple decorator:…

This is a WebAssembly-based runtime that isolates untrusted code to protect host systems from potential damage. Built in Rust with WASI 0.2 and the component model, it offers language-specific SDKs for Python and… Below are 24 products that do a similar job, ranked by how close each is in meaning and then by launch-day votes.

1
A MCP server to evaluate Python code in WASM VM using RustPython▲41
This is a pet project of mine where I build a MCP with WASM plugin system (published to OCI). I added a new plugin today that use Rust, compiled to WebAssembly to run Python code securely.
2025 · github.com · its alternatives →
2
WebAssembly runtime embedded in Godot game engine▲32
A WebAssembly runtime embedded in Godot game engine projects. Interact with Wasm modules from GDScript. Accessing Wasm modules via GDScript provides the following benefits. - Sandboxed environment allows safely loading zero-trust mods/extensions to a project. - Single target means that Wasm modules can be built from any language e.g. Rust, Go, AssemblyScript and the single binary can be run on all platforms. - Fast execution compared to GDScript allows for offloading compute-heavy operations or running bots/mods/etc. at high FPS. This might be useful for loading mods, bot AI,…
2023 · github.com · its alternatives →
3
Execute JavaScript in a WebAssembly QuickJS sandbox▲206
This TypeScript package allows you to safely execute JavaScript code within a WebAssembly sandbox using the QuickJS engine. Perfect for isolating and running untrusted code securely, it leverages the lightweight and fast QuickJS engine compiled to WebAssembly, providing a robust environment for code execution. Features - *Security*: Run untrusted JavaScript code in a safe, isolated environment. - *File System*: Can mount a virtual file system - *Custom Node Modules*: Custom node modules are mountable - *Fetch Client*: Can provide a fetch client to make http(s) calls - *Test-Runner*: Includes…
2024 · github.com · its alternatives →
4
I built a Rust crate for running unsafe code safely▲113
A Rust crate for containing memory leaks and fragmentation - brannondorsey/mem-isolate
2025 · github.com · its alternatives →
5
Create Native Desktop Apps from WebAssembly▲47
In the [first article in this series](<https://wasmer.io/posts/wasm-as-universal-binary-format-part-1-native-executables>) we demonstrated how you can c...
2022 · wasmer.io · its alternatives →
6
Run WASM in Containerd▲77
I've been working with a partner team to integrate wasm workloads with existing container toolchains with the goal of enabling wasm workloads anywhere, be it on the edge, in kubernetes, or wherever. To that end, this project implements a containerd shim which runs those wasm workloads. It is designed as a library to bring your own host implementation, but also includes an implementation for WASI. Right now the library assumes you are using wasmtime, which is embedded in. It works either standalone (run with containerd directly) or in kubernetes. Kubernetes networking and storage are wired…
2022 · github.com · its alternatives →
7
I built a WASI playground for running CLI binaries in the browser▲115
Run WebAssembly made for outside the browser, inside the browser.
2022 · runno.dev · its alternatives →
8
I wrote a WebAssembly Interpreter and Toolkit in C▲105
Web49: WebAssembly Interpeter. Contribute to FastVM/Web49 development by creating an account on GitHub.
2023 · github.com · its alternatives →
9
A minimal working Rust / SDL2 / WASM browser game▲82
"Game" is a stretch, but I put together this repo containing a pure Rust app which uses SDL2 and compiles to WASM (and can be run in a browser). Older resources were a bit out of date and a bit too verbose for my purposes, so here's a minimal working example.
2024 · github.com · its alternatives →
10
Sandy – A tiny Sandbox to run untrusted code ️▲64
A tiny "sandbox" to run untrusted code 🏖️. Contribute to craigmulligan/sandy development by creating an account on GitHub.
2020 · github.com · its alternatives →
11
Zerobox – Sandbox any command with file, network, credential controls▲141
I'm excited to introduce Zerobox, a cross-platform, single binary process sandboxing CLI written in Rust. It uses the sandboxing crates from the OpenAI Codex repo and adds additional functionalities like secret injection, SDK, etc. Watch the demo: https://www.youtube.com/watch?v=wZiPm9BOPCg Zerobox follows the same sandboxing policy as Deno which is deny by default. The only operation that the command can run is reading files, all writes and network I/O are blocked by default. No VMs, no Docker, no remote servers. Want to block reads to /etc? zerobox…
Mar 2026 · github.com · its alternatives →
12OA
Obelisk – a WASM-based deterministic workflow engine▲103
A lightweight engine for durable execution / deterministic workflows I built with Rust, wasmtime and the WASM Component Model. Its main use is running reliable, long-running workflows that can automatically resume after failures. Looking for feedback on the approach and potential use cases!
2025 · obeli.sk · its alternatives →
13
TinyWasm – A tiny WebAssembly Runtime written in Rust▲172
Show HN: TinyWasm - A tiny WebAssembly Runtime written in Rust Hi HN! I'm excited to share TinyWasm (https://github.com/explodingcamera/tinywasm), a WebAssembly Interpreter I developed for my final university project. The main goal of this project was to deepen my understanding of WebAssembly and interpreter design. TinyWasm successfully passes all the official WebAssembly 1.0 tests and also includes features from future proposals such as like bulk memory operations. Initially more of a research project, TinyWasm focuses on simplicity and portability. It has minimal…
2024 · github.com · its alternatives →
14
Ambient, a multiplayer game engine and platform using WASM/WebGPU/Rust▲90
Earlier this year, we released our open-source game engine [0] built with Rust, WebAssembly, and WebGPU. Today, we’re happy to announce the Ambient platform, which brings web deployment, server hosting, and more to the runtime. With Ambient, you can make a game, deploy it to the browser in one command, share your URL and instantly play with others, no downloads or installs needed. Our WASM use is innovative; it is being used as both a sandboxed runtime for user code, and as a way to run the entire Ambient runtime in the browser. This, paired with our ECS data model, enables a highly modular…
2023 · ambient.run · its alternatives →
15
Amla Sandbox – WASM bash shell sandbox for AI agents▲146
WASM sandbox for running LLM-generated code safely. Agents get a bash-like shell and can only call tools you provide, with constraints you define. No Docker, no subprocess, no SaaS — just pip install amla-sandbox
Jan 2026 · github.com · its alternatives →
16
Second State VM▲78
High performance secure & portable Rust functions in Node.js
2020 · secondstate.io · its alternatives →
17
WebAssembly on the server in Rust that analyzes HTTP in real time▲6
LeakSignal project uses WASM in Envoy server to check for sensitive data leaks
2022 · github.com · its alternatives →
18
Kyushu – A self-hostable WASM sandbox for JavaScript workers▲89
A self-hostable Wasm sandbox for JavaScript workers.
Jun 2026 · kyushu.dev · its alternatives →
19
Wasmer – A Go library for executing WebAssembly binaries▲44
🐹🕸️ WebAssembly runtime for Go. Contribute to wasmerio/wasmer-go development by creating an account on GitHub.
2019 · github.com · its alternatives →
20
WASM runtime for sandboxing Python code▲9
A while ago I started experimenting with compiling the Python interpreter to WASM. To build a secure, fast, and lightweight sandbox for code execution — ideal for running LLM-generated Python code.
2024 · github.com · its alternatives →
21WW
Wasmino = WASM and Arduino – Running Arduino Code in Browser▲84
2020 · blog.yifangu.com · its alternatives →
22
Wrote a tiny WebAssembly (wat2wasm) compiler in Go▲75
As a personal project I wrote a really tiny Wat 2 Wasm compiler in Go. Mainly for demonstrative and educational purposes. It was tough: I didn't know anything about WebAssembly internals and I'm a newbie with Go... so I tried to document it as much as I could for anyone that would like to approach the quest in the future! It misses a lot of features (that will be gradually implemented). Any feedback is welcomed!! Demo: https://luna-demo.vercel.app
2022 · github.com · its alternatives →
23
Pollen – distributed WASM runtime, no control plane, single binary▲137
Distributed WASM runtime. Workloads place themselves over a zero-trust mesh. One static binary. - Sambigeara/pollen
Apr 2026 · github.com · its alternatives →
24
Docker in the browser using x86-to-WASM recompilation▲119
Run KolibriOS, Linux or Windows 98 in your browser
2022 · copy.sh · its alternatives →

Also compare

Ranked by how close each launch is in meaning, then by votes. Prices were read from each product’s own site when checked and can change. Refine with your own description →