isolated-vm -- Access to multiple isolates in nodejs
isolated-vm is a library for nodejs which gives you access to v8's Isolate interface. This
allows you to create JavaScript environments which are completely isolated from each other. This
can be a powerful tool to run code in a fresh JavaScript environment completely free of extraneous
capabilities provided by the nodejs runtime.
COMPATIBILITY
The version of isolated-vm you should be using depends on your version of nodejs.
| nodejs version | isolated-vm version |
|---|
| 22.x | 5.x or 4.x |
| 24.x | 6.x or 5.x |
| 26.x | 7.x |
You may ask "what about odd-numbered versions of nodejs" and the answer is that we can't support it
at this time.
PROJECT STATUS
isolated-vm is currently in maintenance mode. It will continue to be supported for as long as is
technically feasible. In the
experimental branch I have been working
on a new version for quite some time. It is worth taking a look if you are interested in this
project, but it is certainly not ready for serious applications.
SPONSORSHIP
Please sponsor this project if you feel like it.
CONTENTS
REQUIREMENTS
This project requires nodejs version 16.x (or later).
🚨 If you are using a version of nodejs 20.x or later, you must pass --no-node-snapshot to node.
Furthermore, to install this module you will need a compiler installed. If you run into errors while
running npm install isolated-vm it is likely you don't have a compiler set up, or your compiler is
too old.
- Windows + OS X users should follow the instructions here: node-gyp
- Ubuntu users should run:
sudo apt-get install python g++ build-essential
- Alpine users should run:
sudo apk add python3 make g++
- Amazon Linux AMI users should run:
sudo yum install gcc72 gcc72-c++
- Arch Linux users should run:
sudo pacman -S make gcc python
- Red Hat users should run:
sudo dnf install python3 make gcc gcc-c++ zlib-devel brotli-devel openssl-devel libuv-devel c-ares-devel
WHO IS USING ISOLATED-VM
-
Screeps - Screeps is an online JavaScript-based MMO+RPG game. They are
using isolated-vm to run arbitrary player-supplied code in secure environments which can persistent
for several days at a time.
-
Fly - Fly is a programmable CDN which hosts dynamic endpoints as opposed to
just static resources. They are using isolated-vm to run globally distributed applications, where
each application may have wildly different traffic patterns.
-
Algolia - Algolia is a Search as a Service provider. They use
isolated-vm to power their Custom Crawler product,
which allows them to safely execute user-provided code for content extraction.
-
Tripadvisor - Tripadvisor is the world’s largest travel platform.
They use isolated-vm to server-side render thousands of React pages per second.
SECURITY
Running untrusted code is an extraordinarily difficult problem which must be approached with great
care. Use of isolated-vm to run untrusted code does not automatically make your application safe.
Through carelessness or misuse of the library it can be possible to leak sensitive data or grant
undesired privileges to an isolate.
At a minimum you should take care not to leak any instances of isolated-vm objects (Reference,
ExternalCopy, etc) to untrusted code. It is usually trivial for an attacker to use these instances
as a springboard back into the nodejs isolate which will yield complete control over a process.
Additionally, it is wise to keep nodejs up to date through point releases which affect v8. You can
find these on the nodejs changelog by
looking for entries such as "update V8 to 9.1.269.36 (Michaël Zasso) #38273". Historically there
have usually been 3-5 of these updates within a single nodejs LTS release cycle. It is not
recommended to use odd-numbered nodejs releases since these frequently break ABI and API
compatibility and isolated-vm doesn't aim to be compatible with bleeding edge v8.
This is the beginning of the README. Read the rest at the original. Read the full README ↗
