Run code you did not write and did not read, choosing each confinement because of the specific thing it prevents, and be able to say exactly what an attacker who fully controls that code can still reach

Letting a Model Call Your Code Safely

Executing untrusted code written by a model, derived from what code can actually do to a machine and what each boundary genuinely stops.

8 lessons, written and corrected before you arrived. Reading them here needs no account. The first reads the whole way through; the others open and then stop, because a page nobody owns cannot tell who is reading it. Starting the course gives you your own copy, where every idea has problems standing under it and you can ask about any sentence.

Start reading

01What a Submitted Program Can Actually Ask ForA submitted program has no powers of its own and reaches the machine only by asking the kernel, so the honest inventory is the list of asks and what each one costs the operator.
02Four Places the Boundary Can Go, and What Each One Stopsopening onlyFour boundaries in order of strength and cost, what each actually stops of the ten things a hostile submission tries, and the budget one run is allowed to spend.
03Run It as Nobody, Owning Nothingopening onlyThe identity a submission runs under is the whole list of what it can reach, so hand it one that owns nothing and ask the kernel for only the sixty entry points the job uses.
04Five Ceilings, and the Twenty Cores They Implyopening onlyProcessor time, wall clock, memory, writing and processes each get a number, each one stops a different failure, and together they decide how many cores the service has to own.
05Give It No Route Out, Then Name the Exceptionsopening onlyA sandbox running submitted code gets no address, no route and no resolver, because a rule aimed at the public internet closes only one of the ways out.
06Nothing in the Environment Worth Stealingopening onlyA submission that can read a secret needs no connection to steal it, because the service returns whatever the program printed, so the secret has to be absent rather than guarded.
07The Narrow Door, and Nothing Elseopening onlyOnce the privileges, the limits, the network and the secrets are gone, one hole is left on purpose. Shaping it, capping it and clocking it is what keeps the last hole from giving everything back.
08Ten Checks, and the One Wall That Can Still Fallopening onlyThe ten hostile attempts become ten assertions with an expected result each. Four can be answered from inside the sandbox, six need the host, and one failure brings down all of them at once.