Forbid Python from writing anything to disk
<p>Are there any command-line options or configurations that forbids Python from writing to disk?</p>

<p>I know I can hack <code>open</code> but it doesn't sound very safe.</p>

<hr>

<p>I've hosted some Python tutorials I wrote myself on my website for friends who want to learn Python, and I want them to have access to a Python console so they can try as they learn. This is done by creating a Python subprocess from the http server.</p>

<p>However, I do not want them to accidentally or intentionally damage my server, so I need to forbid the Python process from writing anything to disk.</p>

<p>Also I'm running the server on Ubuntu Linux so doing it Python-wise or system-wise are both OK.</p>

<p>I doubt there's a way to do this in the interpreter itself: there are way too many things to patch (<code>open</code>, <code>subprocess</code>, <code>os.system</code>, <code>file</code>, and probably others). I'd suggest looking into a way of containerizing the python runtime via something like Docker. The containerization gives some guarantees restricting access, though not as much as virtualization. See <a href="http://security.stackexchange.com/questions/107850/docker-as-a-sandbox-for-untrusted-code">here</a> for more discussion about the security implications.</p>

<p>Running a jupyter/ipython notebook in the docker container would probably be the easiest way to expose a web-frontend. <code>jupyter</code> provides a collection of docker containers for this purpose: see <a href="https://github.com/jupyter/tmpnb">https://github.com/jupyter/tmpnb</a> and <a href="https://github.com/jupyter/docker-stacks">https://github.com/jupyter/docker-stacks</a></p>

python linux