"Sandboxed scripting engine" scenarios (and maybe Deno support?)

[luanmm]

Hello, dear maintainers!

Thank you very much for the effort regarding this project. It seems to be very promising for a lot of scenarios. In my case, I aim the support for JS "extension points", that currently I am trying to do using ClearScript. The gap from it, that I am thinking that this project could solve, is the support for a "popular runtime" (currently, NodeJS), which in my point of view is something that would support better more dynamic scenarios (giving a better customization experience in the "scripting engine" for my platform), as ClearScript is just a basic JavaScript wrapper around V8 (without support for a lot of libraries that Node and others already have from NPM and so on).

Other JS runtimes may be supported in the future.

Can we expect some efforts to deliver compatibility with runtimes like Deno too, then?

NodeJS is a great runtime, that has a lot of good stuff related to it, but Deno makes me more comfortable because "it just fits" the scenario without making me concerned about certain things like security (perhaps some kind of sandboxing), module loading, runtime installing, not being too standard-driven (EcmaScript, Web, W3C, ...), etc.

Deno is secure "by default" (and by "extension points"/"scripting", it is nice to think that "untrusted code" may be allowed by the solution), while NodeJS have a lot of gaps in its security model even in the last version (permission model is not too secure yet). Module loading does not depend on customizations (loaders or other strategies) like in Node. The runtime is simpler, distributed as a single executable or embedded (maybe this is even the way to support it in this project, btw). And every feature tries to be thought having the web standards in mind, and being "compatible with a browser as possible" for a server-side runtime.

So, for all of this points, in the "scripting engine" context, Deno seems to be (by far) the option here. The only problem is that there is no project in .NET that support it (yet) to make this "bindings"/"interop" possible, as this project does with NodeJS (and Hermes, it seems).

Anyway, hope to have some point of view from the team regarding this subject, if possible.

Thank you in advance for the attention!

[jasongin]

Deno does not support the APIs for native modules that Node.js and a few other JS engines have. It uses FFI instead. It should be possible to build similar .NET interop capabilities using Deno FFI, at least to some degree, but that will be a lot of work and probably cannot leverage very much of the existing code in this project. So at this time none of the maintainers here have the time or motivation to work on Deno support. If someone is interested in contributing in this area, then I think we would be open to discussion.

[luanmm]

I'm not sure about this level of "technicality", as I did not know what NAPI is exactly. But I've found something related in Deno core (#1 and #2) and some people using it to compatibilize with some features of Node and so on.

I think I would try first with Node and then, maybe with some help, I can try something with Deno (using this NAPI, if it is what is needed for the project, or deno_core bindings).

I've seen that there is efforts to automatize the build of "libnode", to make the lib work in a simpler way. But I tried to build (in a Linux, Ubuntu-based distro), and wasn't very successful (I built a shared version that wasn't able to be loaded for some reason). There is some guidance on how to do it in the way expected by this project? Or there is something that I can help on this subject, perhaps, to enable this "easy use" of the library?

Thanks for the attention and information!

Best regards.

[jasongin]

Ahh thanks for those links, I had forgotten that Deno added the Node API compatibility. In that case it might just work automatically - we'll have to try it out. If not then it shouldn't be a lot of work to fix.

Currently the Node.js embedding support via libnode depends on a PR that is not yet merged. So if you built libnode from the main branch that might be why you had the loading problem. Our intention is to publish pre-built libnode binaries (and nuget packages?), but that work is not yet done.

Deno embedding via deno_core might also be possible, but I don't know what that would take.

[luanmm]

Oh, I see. Based on what the Node.JS PR says, what I understood is that there is really a conflict that I think I'm having in some scenarios here: basically, I can't have a working Node runtime at the same time I have libnode in my system. This is somehow related to the problems I stated before, in fact.

Considering this, I think Deno should be even easier to work with at this time than Node.JS. Unless I use devcontainers, it is not a good option to have to choose between a project using libnode or having Node runtime installed (which is needed for other project parts or other projects).

I will try to move forward here when I got some time and, in case of a progress, I keep reporting here.

Thanks a lot for the clarifications, @jasongin!

[jasongin]

I can't have a working Node runtime at the same time I have libnode in my system.

Having libnode on your system should not impact regular Node.js processes. We run tests with libnode, while also using Node.js in other ways. So I don't understand the conflict you're referring to.

[luanmm]

This is something with my Linux distribution. The packages for Node and libnode share the same common paths. So when I install one, the other one conflicts. This is something that I could "bypass" by compiling libnode from source, which is something that I couldn't be successful here in my first tests (couldn't load it after compiling, as I stated above).

I'd prefer to try with Deno than with Node, to be honest, because it fits better in my project's scenario. Node is too much dependent of node_modules, or, in practice, of package managers (npm and similars) to work with external libs. This is something that is not so adherent to the structure here. And Deno fullfils it by working the way Web is pointing to: direct ESM imports (by URL).

So I think I will wait the libnode distribution in Nuget to try some things here. Or, if I have some time to go deeper, I would try to use Deno N-API directly (but I don't even know where I would start doing this). If you have any tips or guidance on this, it would be great.

I think I will try to get some support on this in Deno's repo too, because I don't know for sure what would be the equivalent of "libnode" for Deno.

Thanks for all the attention, @jasongin. Best regards!

[msundvick]

For what it's worth, I tried this out, and it worked perfectly the first time, so I'm guessing deno has support for the api's needed.

❯ deno
Deno 1.36.0
exit using ctrl+d, ctrl+c, or close()
REPL is running with all permissions allowed.
To specify permissions, run `deno repl` with allow flags.
> import net from "npm:node-api-dotnet";
undefined
> net.System.Console.Write("hi")
hiundefined

[luanmm]

Nice!

In my scenario, what I would need is the other way round: using Deno as scripting engine from the C#/.NET side, which need some tweaks at the "interop" level.

[jasongin]

Closing this since it appears the questions here were answered. Feel free to open another issue if you have any other problems with Deno, though we currently don't officially support it. We can consider more support in the future if there is interest from the community.