This article explains the design of a WebAssembly‑based security sandbox using QuickJS, detailing its background, goals, technical architecture, performance benchmarks, and future roadmap for building a safer, standards‑compliant open web ecosystem.
This article explains the design of a new Chromium‑based mini‑program framework that decouples from the main client, adopts Web features, integrates Node for richer JS APIs, implements custom XWeb Workers and sandboxing, and extends to games and cross‑platform SDKs, delivering higher performance and lower memory usage.
This article examines the practical design choices, sandbox limitations, preloading strategies, release handling, nested applications, cross‑app navigation, keep‑alive usage, shared dependencies, conflict detection, joint development, and progressive evolution of micro‑frontend solutions, offering insights and future directions.
The article explores the soaring prices of metaverse real estate, highlighting a player who spent $450,000 to become Snoop Dogg’s virtual neighbor in Sandbox, the rapid growth of virtual land sales, major investments from firms like SoftBank, and the broader implications for NFTs and the future digital property market.
This article provides a comprehensive overview of the qiankun micro‑frontend framework—including its background, core concepts of micro‑frontends, comparison with other solutions, detailed configuration examples for host and child applications, implementation details such as sandbox mechanisms, common pitfalls, and the overall impact on development efficiency and project complexity.
This article examines Garfish's micro‑frontend implementation by dissecting resource loading, HTML parsing, sandbox environment construction, and script execution, providing detailed code analysis and comparisons with Qiankun to reveal the core mechanics behind modern micro‑frontend solutions.
This article explains the background, challenges, and design of micro‑frontend architecture, introduces the Garfish open‑source solution with its three‑layer structure, and details core runtime components such as loader, sandbox, router, and store, while discussing advantages, drawbacks, and best‑practice integration with modern web frameworks.
This article explains the background, significance, and challenges of large‑scale web applications, introduces micro‑frontend concepts, compares SPA and MPA approaches, and details the Garfish three‑layer architecture, sandbox designs, routing strategies, deployment platform, and best practices for building enterprise‑grade micro‑frontend systems.
This article provides a comprehensive overview of micro‑frontend concepts, typical system components, governance and development tooling, runtime container responsibilities, various sandbox isolation techniques (including snapshot, Proxy, iframe, Realms, and Shadow DOM), and practical considerations such as technical debt and migration strategies.
This article explains how micro frontends, inspired by micro‑service principles, break down monolithic front‑end applications into independent sub‑applications, covering design motivations, practical implementation steps, sandbox isolation techniques, and code examples to improve maintainability and performance.
This article explains the step‑by‑step process by which kubelet creates a sandbox container, invokes the CNI interface, runs Calico’s ADD command, and sets up routes, virtual interfaces, and IP allocation for pods in a Kubernetes cluster, including relevant Go code excerpts.
Exploring the evolution of web-based editors and design tools, this article examines why traditional plugin architectures like Atom faltered, how VS Code’s more restrictive model improves performance and security, and delves into Figma’s sophisticated sandboxing techniques—including Realm, Duktape, and CSS isolation—to balance flexibility with safety.
This article explains how to dynamically load and execute a CommonJS‑style JavaScript module in a browser by reproducing Node's internal Module._compile workflow, creating a sandbox with with, Proxy, and Symbol.unscopables, and providing a complete ES6 class implementation with examples.
This article explains how Node.js's vm module creates isolated execution contexts, demonstrates several sandbox‑escape techniques using prototype chain manipulation, and offers practical solutions such as code scanning, using vm2, or building a custom interpreter to mitigate security risks.
This guide explains sandbox fundamentals, compares Windows and Adobe Reader sandboxes, and provides step‑by‑step instructions for installing and configuring a Cuckoo Linux sandbox on Ubuntu, including SystemTap syscall monitoring and signature creation illustrated with a Gonnacry ransomware case study.
This weekly tech roundup explains how JavaScript sandboxes isolate code, details a low‑cost AST‑based code‑scanning approach, compares Vue, React and Angular, and shows how domain‑driven design and CSS variables can streamline modern front‑end development.
This article explores the challenges of routing in micro‑frontend architectures, explains why correct parent‑child routing is essential, walks through progressively more sophisticated solutions—including shared routes, sandbox isolation, and message‑based synchronization—and finally presents a robust implementation that works across diverse scenarios.
This article explains why web apps still feel slower than native apps, analyzes the performance gaps of traditional client‑side rendering, and introduces a low‑cost, progressive “same‑screen rendering” approach—using a sandbox, parallel API loading, and browser‑like HTML rendering—to deliver native‑like user experiences without major rewrites.
This article explains how to use JVM SandBox, a non‑intrusive Java Agent‑based tool, to dynamically attach to a running JVM and inject exceptions at specific method call points, enabling comprehensive exception testing for server, dependency, and application failures.
This article explains how the ICE team created the AppLoader solution for Alibaba's Creator Platform, evolved it into the open‑source icestark framework, and details its architecture, loading strategies, sandbox isolation, and real‑world business value for large, multi‑team front‑end systems.
This article explains why WebAssembly needs a standardized system interface, introduces the WebAssembly System Interface (WASI) for portable and secure execution, and provides a step‑by‑step tutorial for compiling a C "cat" program with wasi‑sdk and running it via Node.js.
This guide introduces the dbdeployer tool, walks through its installation on macOS/Linux, shows how to configure sandbox paths, download MySQL binaries, and deploy various MySQL topologies such as single nodes, master‑slave replication, and group replication with one‑click commands.
The article recounts the author’s journey of building a mini‑program engine, detailing the challenges of using Vue in a sandboxed environment, the trade‑offs between single‑thread and dual‑thread models, and the architectural decisions made to balance security, performance, and native capabilities.
This article chronicles the architectural evolution of a web‑based mini‑program engine, detailing the challenges of sandboxing Vue, restricting unsafe tags, handling performance and native capability limits, and ultimately adopting a dual‑thread model to achieve security and control while preserving developer experience.
UK8S’s custom CNI plugin integrates VPC networking to give containers native cloud performance, but a bug caused kubelet to create a second sandbox container, leading to missing NETNS parameters and VPC IP leaks; the article details the investigation, root‑cause analysis, and the patch fixing the issue.
JD Security’s Silicon Valley AI security scientist unveiled a novel container‑based sandbox at BlackHat Europe, detailing how contextual behavior analysis can detect and trace malicious code by leveraging lightweight containers, improving threat detection speed and accuracy for enterprise defenses.
This article details Meituan Security's Black Hat 2018 presentation on a fully automated, Raspberry‑Pi‑based iOS malware hunting pipeline that crawls App Store apps, cracks DRM, runs dynamic sandbox analysis with Frida, and uses a Nools decision engine to detect advanced threats at scale.
This article explains how Android inherits Linux's UID/GID based permission model, details the sandbox isolation for apps, describes how system and app processes obtain their UID/GID, and shows how adb shell and framework permissions grant extensive access to the device.
This article explores Android’s sandbox mechanism, detailing how Linux‑based UID/GID permissions, file system rules, and permission groups control app isolation and access, with practical insights into adb shell behavior and permission granting.
This newsletter highlights design principles for massive JavaScript applications, secure sandboxing techniques for Node.js, the latest Node.js 10 and V8 6.6 features, WebAssembly debugging, and the CRNWEB framework enabling a single codebase across React‑Native, web, and PWA platforms.
