Lua Academy · Lesson

Sandboxing Plugin Execution

Run plugins in restricted environments using setfenv/load with custom _ENV.

Sandboxing Plugin Execution is a free Lua Academy lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Lua Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Why Sandbox Plugins?

Untrusted plugin code can call dangerous functions (os.execute, io.open, load) or access private application state. A sandbox restricts what code can do.

Custom _ENV in Lua 5.2+

In Lua 5.2+, each chunk's global environment is _ENV. Load a chunk with a restricted _ENV to limit its access.

local function sandbox(code, env)
  local chunk, err = load(code, "sandbox", "t", env)
  if not chunk then return nil, err end
  return pcall(chunk)
end

Building a Safe Environment

Create a whitelist environment with only safe standard library functions.

local safeEnv = {
  print  = print,
  type   = type,
  pairs  = pairs,
  ipairs = ipairs,
  tostring = tostring,
  tonumber = tonumber,
  table  = {insert=table.insert, concat=table.concat, sort=table.sort},
  string = {format=string.format, find=string.find, match=string.match},
  math   = math,
}

Blocking Dangerous Functions

Explicitly exclude: os, io, load, loadfile, dofile, require, debug. Do not copy them into safeEnv.

Loading Files in Sandbox

Load a plugin file and execute it in the sandbox environment.

local function sandboxFile(path, env)
  local chunk, err = loadfile(path, "t", env)
  if not chunk then return nil, err end
  local ok, result = pcall(chunk)
  if not ok then return nil, result end
  return result
end

Providing API Access

Give sandboxed plugins access to a restricted app API by including only safe methods in the environment.

local pluginEnv = setmetatable({
  app = {
    on       = function(e,f) app:on(e,f) end,
    emit     = function(e,...) app:emit(e,...) end,
    log      = function(msg) app:log(msg) end,
  },
}, {__index = safeEnv})

Preventing _ENV Access

Do not include _G, _ENV, or load in the sandbox. These allow escape from the restricted environment.

Instruction Counting with debug.sethook

Prevent infinite loops by counting executed instructions and aborting after a limit.

local function withLimit(fn, maxInstructions)
  local count = 0
  debug.sethook(function()
    count = count + 1
    if count > maxInstructions then
      error("Instruction limit exceeded")
    end
  end, "", 100)
  local ok, err = pcall(fn)
  debug.sethook()
  return ok, err
end

Memory Limit

Combine instruction counting with periodic collectgarbage("count") checks to abort if memory usage exceeds a threshold.

Output Capture

Replace print in the sandbox environment with a custom function that captures output to a buffer instead of writing to stdout.

Sandbox Escapes to Avoid

Known escape vectors: debug.getupvalue, getmetatable on standard objects, coroutine.wrap of dangerous code. Review all environment entries carefully.

Sandbox Question

How do you prevent sandboxed code from calling os.execute?

Recap: Sandboxing Plugins

Create a whitelist _ENV with only safe APIs. Load plugin code with load(code, name, "t", safeEnv). Use instruction counting to prevent infinite loops. Never include load, debug, or _G in the sandbox.

Frequently asked questions

Is the “Sandboxing Plugin Execution” lesson free?

Yes — the full text of “Sandboxing Plugin Execution” is free to read here on the web, and the Lua Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Lua Academy course, upgrade to CoddyKit PRO.

What will I learn in “Sandboxing Plugin Execution”?

Run plugins in restricted environments using setfenv/load with custom _ENV. You practise Lua Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Lua Academy?

No prior experience is required. Lua Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Sandboxing Plugin Execution” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Lua Academy lesson?

Yes. Every Lua Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to Lua Academy