# License: Public Domain
import os
import subprocess

home_dir = os.path.expanduser("~")

try:
    os.makedirs("/tmp/mysandbox_root")
except FileExistsError:
    pass

def sandbox_pyexec(code):
    proc = subprocess.Popen(
        ["bwrap", "--bind", "/tmp/mysandbox_root", "/", "--ro-bind", "/bin", "/bin", # システムファイルをRead-Onlyで共有する
         "--ro-bind", "/lib", "/lib", "--ro-bind", "/lib64", "/lib64", 
         "--ro-bind", "/usr", "/usr", "--ro-bind", "/etc", "/etc", # あんまり良くない
         "--ro-bind", home_dir + "/.local/lib", home_dir + "/.local/lib", # pip ライブラリをRead-Onlyで共有する
         "--ro-bind", home_dir + "/.local/bin", home_dir + "/.local/bin",
         "--ro-bind", home_dir + "/.local/share", home_dir + "/.local/share",
         "--bind", "/proc", "/proc", "--unshare-all", "--", # なるべくホストと非共有（systemd-nspawnと違ってプロセスリストは共有してるけど）
         "bash", "-c", "python -"],  # Pythonで標準入力のコードを実行
        stdin=subprocess.PIPE,
        stdout=subprocess.PIPE,
        stderr=subprocess.PIPE,
        text=True  # stdin / stdout を文字列として扱う
    )
    result, err = proc.communicate(code)
    return (result.strip(), err.strip())
    

r, err = sandbox_pyexec( """print("これはテストです")""")

print("stdout:", r)
print("stderr:", err)
# stdout: これはテストです
# stderr: 

r, err = sandbox_pyexec( """import os
os.system("ls /")""")

print("stdout:", r)
print("stderr:", err)
# stdout: bin
# etc
# home
# lib
# lib64
# proc
# usr
# stderr: 

r, err = sandbox_pyexec( """wrong python syntax here""")

print("stdout:", r)
print("stderr:", err)
# stdout: 
# stderr: File "<stdin>", line 1
#     wrong python syntax here
#           ^^^^^^
# SyntaxError: invalid syntax

# License: Public Domain
import os
import pty
import termios
import select
import sys

home_dir = os.path.expanduser("~")
try:
    os.makedirs("/tmp/mysandbox_root")
except FileExistsError:
    pass

def disable_echo(fd):
    attrs = termios.tcgetattr(fd)
    attrs[3] = attrs[3] & ~termios.ECHO  # lflags から ECHO を落とす
    termios.tcsetattr(fd, termios.TCSANOW, attrs)

def sandbox_pyenv():
    pid, fd = pty.fork()
    if pid == 0: # child
         # sys.stdout.flush()][
         disable_echo(0)
         os.execvp("bwrap", 
            ["bwrap", "--bind", "/tmp/mysandbox_root", "/", "--ro-bind", "/bin", "/bin", # システムファイルをRead-Onlyで共有する
             "--ro-bind", "/lib", "/lib", "--ro-bind", "/lib64", "/lib64", 
             "--ro-bind", "/usr", "/usr", "--ro-bind", "/etc", "/etc", # あんまり良くない
             "--ro-bind", home_dir + "/.local/lib", home_dir + "/.local/lib", # pip ライブラリをRead-Onlyで共有する
             "--ro-bind", home_dir + "/.local/bin", home_dir + "/.local/bin",
             "--ro-bind", home_dir + "/.local/share", home_dir + "/.local/share",
             "--bind", "/proc", "/proc", "--unshare-all", "--", # なるべくホストと非共有（systemd-nspawnと違ってプロセスリストは共有してるけど）
             "python", "-i"],  # Pythonのインタラクティブモードで標準入力のコードを実行
         )
         exit()
    else:
        output = b""
        while True:
            r, _, _ = select.select([fd], [], [])
            chunk = os.read(fd, 1024)
            output += chunk

            if output.endswith(b">>> "):
                #print("debug: bunner: %s"%output)
                break

    return fd

def sandbox_pyexec(fd, code):
    output = b""
    for line in code.split("\n"):
        os.write(fd, line.encode("utf-8") + b"\n")

        while True:
            r, _, _ = select.select([fd], [], [])
            chunk = os.read(fd, 1024)
            output += chunk

            if output.endswith(b">>> ") or output.endswith(b"... "):
                output = output[:-4] # プロンプトを除去
                break

    text = output.decode(errors="ignore")
    return text

def sandbox_reset(fd):
    sandbox_pyexec(fd, """globals().clear()
import gc
gc.collect()
globals().clear()
""")

fd = sandbox_pyenv()
print("[exec]%s[/exec]"%sandbox_pyexec(fd, "a = 100")) # [exec][/exec]
print("[exec]%s[/exec]"%sandbox_pyexec(fd, "print(a)")) # [exec]100\n[/exec]
print("[exec]%s[/exec]"%sandbox_pyexec(fd, "a")) # [exec]100\n[/exec]
print("[exec]%s[/exec]"%sandbox_pyexec(fd, "b")) # [exec]Traceback (most recent call last):\n  File "<stdin>", line 1, in <module>\nNameError: name 'b' is not defined\n[/exec]

print("[exec]%s[/exec]"%sandbox_pyexec(fd, """print("aaa")\nprint("bbb")""")) # [exec]aaa\nbbb\n[/exec]
print("[exec]%s[/exec]"%sandbox_pyexec(fd, """print("aaa" + \\\n "bbb")""")) # [exec]aaabbb\n[/exec]

sandbox_reset(fd)
print("[exec]%s[/exec]"%sandbox_pyexec(fd, "a"))  # [exec]Traceback (most recent call last):\n  File "<stdin>", line 1, in <module>\nNameError: name 'a' is not defined\n[/exec]