Lua Academy · Lesson

Sandboxing Plugin Execution

Run plugins in restricted environments using setfenv/load with custom _ENV.

Lesson 3 of 413 steps

Sandboxing Plugin Execution is a free Lua Academy lesson on CoddyKit. This is lesson 3 of 4. Any 3 lessons of this learning path are free to read in full — after that, CoddyKit PRO unlocks every lesson, plus hands-on practice with a built-in code editor and a 24/7 AI tutor. It is part of the Lua Academy learning path, and your progress syncs across the web and the CoddyKit app. The Lua Academy course includes 4 lessons in total.

Why Sandbox Plugins?

Untrusted plugin code can call dangerous functions (os.execute, io.open, load) or access private application state. A sandbox restricts what code can do.

Custom _ENV in Lua 5.2+

In Lua 5.2+, each chunk's global environment is _ENV. Load a chunk with a restricted _ENV to limit its access.

local function sandbox(code, env)
  local chunk, err = load(code, "sandbox", "t", env)
  if not chunk then return nil, err end
  return pcall(chunk)
end

Building a Safe Environment

Create a whitelist environment with only safe standard library functions.

local safeEnv = {
  print  = print,
  type   = type,
  pairs  = pairs,
  ipairs = ipairs,
  tostring = tostring,
  tonumber = tonumber,
  table  = {insert=table.insert, concat=table.concat, sort=table.sort},
  string = {format=string.format, find=string.find, match=string.match},
  math   = math,
}

Blocking Dangerous Functions

Explicitly exclude: os, io, load, loadfile, dofile, require, debug. Do not copy them into safeEnv.

Loading Files in Sandbox

Load a plugin file and execute it in the sandbox environment.

local function sandboxFile(path, env)
  local chunk, err = loadfile(path, "t", env)
  if not chunk then return nil, err end
  local ok, result = pcall(chunk)
  if not ok then return nil, result end
  return result
end

Providing API Access

Give sandboxed plugins access to a restricted app API by including only safe methods in the environment.

local pluginEnv = setmetatable({
  app = {
    on       = function(e,f) app:on(e,f) end,
    emit     = function(e,...) app:emit(e,...) end,
    log      = function(msg) app:log(msg) end,
  },
}, {__index = safeEnv})

Preventing _ENV Access

Do not include _G, _ENV, or load in the sandbox. These allow escape from the restricted environment.

Instruction Counting with debug.sethook

Prevent infinite loops by counting executed instructions and aborting after a limit.

local function withLimit(fn, maxInstructions)
  local count = 0
  debug.sethook(function()
    count = count + 1
    if count > maxInstructions then
      error("Instruction limit exceeded")
    end
  end, "", 100)
  local ok, err = pcall(fn)
  debug.sethook()
  return ok, err
end

Memory Limit

Combine instruction counting with periodic collectgarbage("count") checks to abort if memory usage exceeds a threshold.

Output Capture

Replace print in the sandbox environment with a custom function that captures output to a buffer instead of writing to stdout.

Sandbox Escapes to Avoid

Known escape vectors: debug.getupvalue, getmetatable on standard objects, coroutine.wrap of dangerous code. Review all environment entries carefully.

Sandbox Question

How do you prevent sandboxed code from calling os.execute?

Answer it in the interactive lesson

Recap: Sandboxing Plugins

Create a whitelist _ENV with only safe APIs. Load plugin code with load(code, name, "t", safeEnv). Use instruction counting to prevent infinite loops. Never include load, debug, or _G in the sandbox.

Free to start

Learn Lua with an AI tutor — free

Write and run real code in your browser, get instant help from a 24/7 AI tutor, and pick up where you left off on the web or in the app.

Courses: 40
Lessons: 159

Start learning free View the full course

Frequently Asked Questions

Is the “Sandboxing Plugin Execution” lesson free?

Yes — any 3 lessons of the Lua Academy learning path, including “Sandboxing Plugin Execution”, are free to read in full here on the web. After that, CoddyKit PRO unlocks every lesson, plus interactive practice with a built-in code editor and a 24/7 AI tutor. The Lua Academy course includes 4 lessons in total.

What will I learn in “Sandboxing Plugin Execution”?

Run plugins in restricted environments using setfenv/load with custom _ENV. You practise Lua Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Lua Academy?

No prior experience is required. Lua Academy on CoddyKit is structured for beginners through advanced learners, so you can start here or from the beginning and move at your own pace. This is lesson 3 of 4.

How long does the “Sandboxing Plugin Execution” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Lua Academy lesson?

Yes. Every Lua Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to Lua Academy