LearnViz CompSci
Home / Learn / Security & Cryptography / Sandboxing

Advanced Topic 42 of 51 Security & Cryptography

Sandboxing

Confining code to limit what it can affect.

How it works

Sandboxing runs code in a restricted environment that limits what it can access, so that compromise or bugs cannot easily harm the rest of the system. Techniques include operating-system mechanisms such as seccomp filters, namespaces, AppArmor and macOS App Sandbox, containers, virtual machines, language-level isolation such as WebAssembly and browser process sandboxes, and capability-based designs. A broker process may mediate any needed access.

Step-by-step walkthrough

  1. Untrusted code runs inside a restricted environment.
  2. It cannot read arbitrary files or open sockets.
  3. System calls are filtered.
  4. The host stays protected if the code is malicious.
  5. Browsers, containers and seccomp all use this idea.

Where it is used

Web browsers isolate each site and renderer, mobile operating systems confine apps, malware analysts detonate samples in sandboxes, and cloud platforms run untrusted functions and plug-ins this way.

Common pitfall

A sandbox is only as strong as its smallest hole: kernel bugs and misconfiguration allow escapes. Too-permissive policies defeat the purpose, and too-strict ones break functionality. Shared resources and side channels can still leak. Use defense in depth, minimal permissions and regularly updated runtimes.

Where it fits in the course

Sandboxing is topic 42 of 51 in Security & Cryptography, rated Advanced. It follows ASLR and Stack Canaries. The next topic is Trusted Execution Environments.

Practice and explore

How to study this topic

  1. Read the explanation above and restate the definition in your own words.
  2. Open the interactive lesson and answer its mini quiz.
  3. Read the common pitfall, then write a short example that avoids it.
  4. Check your understanding in the Security & Cryptography quiz, and revisit the topic if you miss a question.

Frequently asked questions

What is Sandboxing?
Confining code to limit what it can affect. It belongs to Security & Cryptography and is an advanced-level topic.
Where do people use Sandboxing?
Web browsers isolate each site and renderer, mobile operating systems confine apps, malware analysts detonate samples in sandboxes, and cloud platforms run untrusted functions and plug-ins this way.
What is the most common mistake with Sandboxing?
A sandbox is only as strong as its smallest hole: kernel bugs and misconfiguration allow escapes.
What should I learn before this topic?
Start with ASLR and Stack Canaries, the topic just before it in Security & Cryptography.
How can I practice it?
Answer the mini quiz in the interactive lesson, then take the Security & Cryptography quiz.
Is Sandboxing hard to learn?
It is an Advanced topic. Expect to read the explanation more than once and to connect it with earlier topics. Working through a small example by hand helps most.
How long does it take to learn Sandboxing?
Most learners can read the explanation and finish the interactive lesson in under an hour. Fluency comes from applying the idea, so plan a few short practice sessions with the quiz.
Which topics are related to Sandboxing?
ASLR and Stack Canaries, Trusted Execution Environments, Return-Oriented Programming are closely connected. The full list is in the related topics section of this page.
What should I study after Sandboxing?
Continue with Trusted Execution Environments, the next topic in Security & Cryptography.

Related topics