Curious, if you don't mind, what kind of professional usage with Lua you work on? I was working on some Nginx/Openresty scripting with Lua module to implement kind of web edge service and really liked it.
We use a heavily stripped and sandboxed Lua interpreter for user scripts in a monitoring system. The initial approach was going to be WebAssembly, but that didn't pan out for a couple reasons.
Much of the functionally has been wrapped or customized to disallow any system access that doesn't go through an access control layer, including for require, and disallowing catching certain errors with pcall and through coroutines. Anything that could feasibly break the sandbox is also removed, like the debug package, and the ability to load bytecode (text sources only). The actual Lua sources are 100% vanilla, though we complete it with C++ to be compatible with the rest of the codebase.
Comments
Curious, if you don't mind, what kind of professional usage with Lua you work on? I was working on some Nginx/Openresty scripting with Lua module to implement kind of web edge service and really liked it.
We use a heavily stripped and sandboxed Lua interpreter for user scripts in a monitoring system. The initial approach was going to be WebAssembly, but that didn't pan out for a couple reasons.
Much of the functionally has been wrapped or customized to disallow any system access that doesn't go through an access control layer, including for require, and disallowing catching certain errors with pcall and through coroutines. Anything that could feasibly break the sandbox is also removed, like the debug package, and the ability to load bytecode (text sources only). The actual Lua sources are 100% vanilla, though we complete it with C++ to be compatible with the rest of the codebase.