sandbox

So Lua seems ideal for implementing secure "user scripts" inside my application. However, most examples of embedding lua seem to include loading all the standard libraries, including "io" and "package". So I can exclude those libs from my interpreter, but even the base library includes the functions "dofile" and "loadfile" which access the filesystem. How can I remove/block any unsafe functions like these, without just ending up with an interpreter that doesn't even have basic stuff like the "ipairs" function? Karl Voigtland You can set the function environment that you run the untrusted code