One thing to be on the lookout for luerl’s max_reductions and max_time options. Not only do you want to sandbox certain capabilities, but you likely want to protect against infinite loops and unbounded memory growth, or any other resources that could be exploited.

Have fun, I personally love luerl, big fan

One other thing worth mentioning, is that Robert has expressed interest in merging my library into Luerl. I have a few things that I want to agree on with him before this happens, but I am certainly interested in doing so.

As for Dune and Mini-Elixir, I think these are really interesting projects! I’ve chatted with Anthony at Sequin at length about Mini-Elixir, and I am quite interested in experimenting with them.

However, for my use case of using Lua as a compilation target, there are a lot of shortcuts I can take with outputting a object-oriented, mutable language. My hunch is that outputting Elixir would be a much more challenging task due to needing to track variables and propagating state, where with Lua, this can be hidden with method calls, etc.

To that end, I would love to have a different sandboxed language that was readable, an easy compilation target, and had great error messages. I’m not married to Lua, so I’m open to the possibility of switching.

With that being said, I get personal joy out of working on both Lua and Luerl, and I hope to see those libraries improve and grow!

Dave Lucia has talked about extensively using luerl for his product at tvlabs.ai to enable customer scripting. I was present for the codeBEAM talk given by Dave and Robert and the approach is compelling. My takeaway is that it is a good solution.

Thanks for the interest in Lua! Apologies for the confusing name, I wanted it to be easy to write, and it kind of stuck.

I’m happy to answer any questions you may have. I note this in my blog post from yesterday, but Luerl is certainly lacking in the error message and stacktrace department. That is certainly something I hope to improve in the coming months with the help of Robert.

As for sandboxing goes, the underlying implementation of Luerl is still Erlang, so even doing string concatenation via "hello" .. "world" may cause a binary to be allocated. As far as I’m aware, this happens on the heap and is not local to the process, so sandboxing this particular behavior is difficult. One idea I’ve had here is for Luerl to inject tracing instructions into its own VM for measuring these allocations and tracking them in the runtime. There are currently no plans to do this, but I think it would be an interesting path to explore.

As for my conference talk from Code BEAM EU 2024 with Robert, that has not been posted yet.

Latest elixirpodcast talked about a company making a safe ast thing that let them let people write elixir without fear of getting pwned.

I am not sure I would trust that myself tbf, but I think they have published some of that as open source.

However a key takeaway they mentioned in the podcast was that in their benchmarking of homegrown vs luerl vs deno etc lurerl was really fast, just a little behind homegrown thing.

We are talking microseconds here. That means that luerl will often be done executing before you have even transmitted the payload to the executor over tcp when using something like Dune or Deno.

Its also extremely simple to expose functions from your codebase to luerl.

And as Dave has said at a few conferences now, lua is a very good LLM target because its so simple grammar and logic. Meaning you can probably make great helpers if you have users who are only partial programmers.