Evaluate Untrusted R Code Locally
Isolated in a webR Sandbox?


rw: Rscript for webR


Henrik Bengtsson

University of California, San Francisco

R Foundation, R Consortium, Bioconductor

@HenrikBengtsson



Why do we need R code isolation?

  • Peer-to-Peer (P2P) Compute Clusters:

    plan(future.p2p::cluster)
y <- map(x, untrusted::fcn) |> futurize()

    Running tasks submitted by untrusted peers


Your computer gets assigned:

untrusted::fcn(x[[4]])

- Wait, is that safe to run?

  • Rise of LLM / AI Agents:
    AI agents dynamically generate and execute R code

AI agent may run:

system("erase harddrive")

How do we run untrusted code safely and locally?

Sandboxing:
Prevent R from accessing your local computer

WebAssembly & webR: R in the browser + isolated

  • webR is fantastic! (Shoutout to George Stagg)
    • R and R packages running in WebAssembly
  • Predominantly used in the web browser:
    • User-friendly: e.g. demo code snippets, Shiny Live, … - zero install
    • Browser provides isolation: e.g. R code cannot access local files
  • What if we want to run webR locally from the command line?
    • Introducing: the rw tool

rw: Rscript for webR

Running locally installed R from the command line:

$ Rscript -e "1+2"
[1] 3
$ Rscript main.R
Running analysis ... done!

Running R via webR from the command line:

$ rw --expr="1+2"
[1] 3
$ rw main.R
Running analysis ... done!

rw is sandboxed: No access to local file system, network, …

Protects against malicious attempts to access your private files:

$ rw --expr='readLines("/home/alice/super-secret.txt")'
Warning in file(con, "r") :
  cannot open file '/home/alice/super-secret.txt': No such file or directory
Error: cannot open the connection

Possible to give partial access, e.g. read-only access to your ~/public/ folder:

$ rw --bind=~/public:/public:ro --expr='read.csv("/public/data.csv")'
                     X  mpg cyl  disp  hp drat    wt  qsec vs am gear carb
1            Mazda RX4 21.0   6 160.0 110 3.90 2.620 16.46  0  1    4    4
2        Mazda RX4 Wag 21.0   6 160.0 110 3.90 2.875 17.02  0  1    4    4
3           Datsun 710 22.8   4 108.0  93 3.85 2.320 18.61  1  1    4    1
...

Execute untrusted code with help from trusted code

$ ls bastion/
data.csv

$ rw \
    --prologue-expr="data <- read.csv('/host/bastion/data.csv')" \  # trusted code
    --expr="res <- untrusted::fcn(data)" \
    --epilogue-expr="write.csv(res, '/host/bastion/results.csv')"   # trusted code
    
$ ls bastion/
data.csv
results.csv


  • Enables secure P2P cluster collaboration and secure agent AI coding

Thank you! + We need to think about security with R

  • Peer-to-Peer (P2P) collaboration:
    • Run remote peer jobs safely via local CLI sandbox
  • Agentic AI:
    • Protect your host system when letting AI run R scripts
  • Additional features:
    • rw makes it easy to explore webR’s capabilities and limitations
    • rw provides tools to quickly build and test an R package in webR
  • rw is just a prototype:
    • I encourage the R community to try to break it!