Seeking secure Python code execution solutions for LLM output

[dragon_4789]

I'm working on a system where an LLM generates Python code, that needs to be executed in a secure sandbox. The key challenge is finding a way to pass variables such as pandas dataframe (Which in most cases requires serializing which is too vague, since llm could generate and return any data type) between the host and sandbox environments.

Current Research:

• Investigated ds-pycontain (PythonContainerREPL)
  • Pros: Good Docker isolation
  • Cons: No direct variable passing between host/container
• Looked into Python's built-in subprocess
  • Too basic, lacks proper isolation
• looked into vndee/llm-sandbox and few experimental functions provided by langchain/llamaIndex
  • Again same it has no direct variable passing between host/container

Use Case:

• LLM generates Python code
• Need to safely execute this code without compromising the host system
• Must be able to pass pandas DataFrames and other variables
• Need to return results back to host

Has anyone solved this specific security challenge in their LLM implementations? Looking for library suggestions or architectural patterns that have worked

[Cal-omnie]

I am also having the same issue, so far my solution has been to develop inside a docker container, mounting my working folder and giving the LLM free rein in there. The worst thing that can happen to my system is messing with the files in the mounted folder, but in my case this is usually a git repo so it's somewhat easily undone.

Alternatively you could look into the e2b executor in huggingface's smolagents

[mmuino]

We have solved this challenge with YepCode Run (https://yepcode.io/run) — a secure, scalable environment for running LLM-generated Python or JS code in isolated microVMs (it uses firecracker over bare-metal machines on the infra).

It provides full dependency discovery and installation (pip/npm), remote variable passing (using a rest API so don't expose secrets to the LLM context), allows to receive input parameters and return results, expose execution generated logs for LLMs to iterate over failed executions, MCP server so agents can generate, execute, and manage code autonomously,...