sindoq - AI Sandbox
sindoq (means "box" in Kurdish) is a Go SDK for sandboxed code execution. One API, any provider.
Installation
go get github.com/happyhackingspace/sindoq
Quick Start
One-liner Execution
result, err := sindoq.Execute(ctx, `print("Hello, World!")`)
fmt.Println(result.Stdout) // Hello, World!
With Specific Provider
sb, err := sindoq.Create(ctx, sindoq.WithProvider("docker"))
if err != nil {
log.Fatal(err)
}
defer sb.Stop(ctx)
result, err := sb.Execute(ctx, `console.log("Hello")`, sindoq.WithLanguage("JavaScript"))
fmt.Println(result.Stdout)
Streaming Output
sb, err := sindoq.Create(ctx, sindoq.WithProvider("docker"))
defer sb.Stop(ctx)
err = sb.ExecuteStream(ctx, code, func(e *executor.StreamEvent) error {
if e.Type == executor.StreamStdout {
fmt.Print(e.Data)
}
return nil
})
Async Execution
results, err := sb.ExecuteAsync(ctx, code)
// Do other work...
result := <-results
fmt.Println(result.Stdout)
Providers
| Provider |
Type |
Use Case |
docker |
Local |
Development, CI/CD |
podman |
Local |
Rootless containers |
wasmer |
Local |
Cross-platform WASM sandbox (Linux, macOS, Windows) |
nsjail |
Local |
Ultra-fast process isolation (~5ms, Linux only) |
gvisor |
Local |
Strong isolation, syscall filtering (Linux only) |
firecracker |
Local |
Maximum isolation (microVMs, Linux only) |
landlock |
Local |
Kernel-level sandboxing via Landlock LSM (Linux 5.13+) |
seatbelt |
Local |
Kernel-level sandboxing via sandbox-exec (macOS) |
kubernetes |
Cloud |
Scalable workloads |
vercel |
Cloud |
Serverless execution |
e2b |
Cloud |
AI code interpreter |
Provider Configuration
// Docker
sb, _ := sindoq.Create(ctx, sindoq.WithDockerConfig(sindoq.DockerConfig{
Host: "unix:///var/run/docker.sock",
}))
// Vercel
sb, _ := sindoq.Create(ctx, sindoq.WithVercelConfig(sindoq.VercelConfig{
Token: os.Getenv("VERCEL_TOKEN"),
}))
// E2B
sb, _ := sindoq.Create(ctx, sindoq.WithE2BConfig(sindoq.E2BConfig{
APIKey: os.Getenv("E2B_API_KEY"),
}))
// Wasmer (cross-platform)
sb, _ := sindoq.Create(ctx, sindoq.WithWasmerConfig(sindoq.WasmerConfig{
WasmerPath: "wasmer",
TimeLimit: 30,
}))
// Seatbelt (macOS)
sb, _ := sindoq.Create(ctx, sindoq.WithSeatbeltConfig(sindoq.SeatbeltConfig{
EnableNetwork: false,
}))
Features
- Multi-provider support: Docker, Podman, Wasmer, nsjail, gVisor, Firecracker, Landlock, Seatbelt, Kubernetes, Vercel, E2B
- Auto language detection: Automatically detects programming language from code
- Streaming output: Real-time stdout/stderr streaming
- Async execution: Non-blocking execution with channels
- Resource limits: Control CPU, memory, and execution time
- File system access: Read/write files in sandbox environments
References
1---2name: sindoq3description: Execute code in sandboxed environments using Docker, Podman, Wasmer, gVisor, Firecracker, Kubernetes, or cloud providers. Use when the user needs to safely run untrusted code, build AI code execution pipelines, or set up isolated sandbox environments.4---56# sindoq - AI Sandbox78sindoq (means "box" in Kurdish) is a Go SDK for sandboxed code execution. One API, any provider.910## Installation1112```bash13go get github.com/happyhackingspace/sindoq14```1516## Quick Start1718### One-liner Execution1920```go21result, err := sindoq.Execute(ctx, `print("Hello, World!")`)22fmt.Println(result.Stdout) // Hello, World!23```2425### With Specific Provider2627```go28sb, err := sindoq.Create(ctx, sindoq.WithProvider("docker"))29if err != nil {30 log.Fatal(err)31}32defer sb.Stop(ctx)3334result, err := sb.Execute(ctx, `console.log("Hello")`, sindoq.WithLanguage("JavaScript"))35fmt.Println(result.Stdout)36```3738### Streaming Output3940```go41sb, err := sindoq.Create(ctx, sindoq.WithProvider("docker"))42defer sb.Stop(ctx)4344err = sb.ExecuteStream(ctx, code, func(e *executor.StreamEvent) error {45 if e.Type == executor.StreamStdout {46 fmt.Print(e.Data)47 }48 return nil49})50```5152### Async Execution5354```go55results, err := sb.ExecuteAsync(ctx, code)56// Do other work...57result := <-results58fmt.Println(result.Stdout)59```6061## Providers6263| Provider | Type | Use Case |64|----------|------|----------|65| `docker` | Local | Development, CI/CD |66| `podman` | Local | Rootless containers |67| `wasmer` | Local | Cross-platform WASM sandbox (Linux, macOS, Windows) |68| `nsjail` | Local | Ultra-fast process isolation (~5ms, Linux only) |69| `gvisor` | Local | Strong isolation, syscall filtering (Linux only) |70| `firecracker` | Local | Maximum isolation (microVMs, Linux only) |71| `landlock` | Local | Kernel-level sandboxing via Landlock LSM (Linux 5.13+) |72| `seatbelt` | Local | Kernel-level sandboxing via sandbox-exec (macOS) |73| `kubernetes` | Cloud | Scalable workloads |74| `vercel` | Cloud | Serverless execution |75| `e2b` | Cloud | AI code interpreter |7677## Provider Configuration7879```go80// Docker81sb, _ := sindoq.Create(ctx, sindoq.WithDockerConfig(sindoq.DockerConfig{82 Host: "unix:///var/run/docker.sock",83}))8485// Vercel86sb, _ := sindoq.Create(ctx, sindoq.WithVercelConfig(sindoq.VercelConfig{87 Token: os.Getenv("VERCEL_TOKEN"),88}))8990// E2B91sb, _ := sindoq.Create(ctx, sindoq.WithE2BConfig(sindoq.E2BConfig{92 APIKey: os.Getenv("E2B_API_KEY"),93}))9495// Wasmer (cross-platform)96sb, _ := sindoq.Create(ctx, sindoq.WithWasmerConfig(sindoq.WasmerConfig{97 WasmerPath: "wasmer",98 TimeLimit: 30,99}))100101// Seatbelt (macOS)102sb, _ := sindoq.Create(ctx, sindoq.WithSeatbeltConfig(sindoq.SeatbeltConfig{103 EnableNetwork: false,104}))105```106107## Features108109- **Multi-provider support**: Docker, Podman, Wasmer, nsjail, gVisor, Firecracker, Landlock, Seatbelt, Kubernetes, Vercel, E2B110- **Auto language detection**: Automatically detects programming language from code111- **Streaming output**: Real-time stdout/stderr streaming112- **Async execution**: Non-blocking execution with channels113- **Resource limits**: Control CPU, memory, and execution time114- **File system access**: Read/write files in sandbox environments115116## References117118- Repository: https://github.com/HappyHackingSpace/sindoq
HappyHackingSpace