Security Model

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/pydantic/monty/llms.txt

Use this file to discover all available pages before exploring further.

​

Sandbox Isolation

​

What’s Blocked

• Filesystem: No direct file I/O operations
• Environment Variables: Cannot read or modify environment variables
• Network Access: No sockets or HTTP requests
• Subprocess Execution: Cannot spawn processes or run shell commands
• Import System: Cannot import modules with side effects or use __import__
• Third-party Libraries: No external Python packages
• Most Standard Library: Only a minimal subset is available

​

What’s Allowed

• External Functions: Only functions explicitly provided by the host
• OS Operations: Filesystem and network operations handled via host callbacks
• Limited Standard Library: sys, os, typing, asyncio, re modules
• Safe Operations: Pure computation, data structures, control flow

import pydantic_monty

# This code is safely sandboxed
code = """
result = x * 2
if result > 10:
    result = fetch_data()  # Only runs if you provide fetch_data
result
"""

m = pydantic_monty.Monty(code, inputs=['x'])

# You control what external functions are available
result = m.run(
    inputs={'x': 7},
    external_functions={'fetch_data': lambda: 'safe data'}
)
print(result)  # 'safe data'

​

Security Guarantees

​

Complete Host Isolation

• No filesystem access without explicit host callbacks
• No environment variable access
• No network access without explicit host callbacks
• No subprocess execution
• No access to system resources

​

Memory Safety

• No buffer overflows
• No use-after-free errors
• No null pointer dereferences
• Safe memory management with reference counting

​

Resource Limits

• Memory limits: Cap maximum heap usage
• Execution time: Timeout after specified duration
• Allocation count: Limit number of heap allocations
• Recursion depth: Prevent stack overflow (default: 1000)

​

Controlled External Access

​

External Functions

import pydantic_monty

code = "fetch(url)"
m = pydantic_monty.Monty(code, inputs=['url'])

# You control EXACTLY what the code can access
def safe_fetch(url: str) -> str:
    # Validate URL, check whitelist, add authentication, etc.
    if not url.startswith('https://api.example.com/'):
        raise ValueError('URL not allowed')
    # Your actual fetch logic here
    return "safe data"

result = m.run(
    inputs={'url': 'https://api.example.com/data'},
    external_functions={'fetch': safe_fetch}
)

​

OS Operations

# When code calls os.path.exists(path), Monty pauses
# and returns control to you via start()/resume()

progress = m.start(inputs={'path': '/some/path'})

if isinstance(progress, pydantic_monty.OsSnapshot):
    # You decide how to handle the OS operation
    if progress.function == 'path_exists':
        path = progress.args[0]
        # Apply your security checks
        result = your_safe_path_check(path)
        progress = progress.resume(return_value=result)

​

Deserialization Safety

• Monty.load(bytes)
• FunctionSnapshot.load(bytes)
• RunProgress.load(bytes)

​

Threat Model

​

Protected Against

• Code Injection: Untrusted Python code execution
• Resource Exhaustion: Memory bombs, infinite loops
• Information Disclosure: No access to host environment
• Path Traversal: No filesystem access without your control
• Regex DoS: Controlled through execution limits
• Import Abuse: Only safe minimal standard library available

​

Out of Scope

• Timing Attacks: Execution timing is observable
• Deserialization Attacks: Don’t load snapshots from untrusted sources
• Host Function Vulnerabilities: Security of external functions is your responsibility

​

Why Monty?

​

Best Practices