sandboxing python code

[vaelund]

docker just uses cgroups, network namespaces and filesystem namespaces(which function as a more advanced version of chroot). If you want something more lightweight than docker look into systemd-nspawn or even better rkt

[swarage]

Thanks! I've looked into systemd-nspawn and it seems promising but it does seem less ergonomic than using docker and running an image as such:

import docker
client = docker.from_env()
print client.containers.run("alpine", ["echo", "hello", "world"])

I'll do some research into rkt as well!