SES: Cannot register `lockdown` in new VM context

Trying to lock down a new context by creating an isolatedRequire function:

function isolatedRequire(specifier) {
  const sandbox = createContext({ require, console });
  /**
   * Lock down the component context and then import the module.
   */
  const sesRequire = `
    require('ses');
    lockdown();

    require(${JSON.stringify(specifier)});
  `;
  return runInNewContext(sesRequire, sandbox)
}

But it throws:

evalmachine.<anonymous>:3
    lockdown();
    ^

ReferenceError: lockdown is not defined
    at evalmachine.<anonymous>:3:5
    at Script.runInContext (node:vm:139:12)
    at Script.runInNewContext (node:vm:144:17)
    at runInNewContext (node:vm:298:38)

It works if we require('ses') and then pass in the lockdown function for the initial context, but that locks down the parent context and kind of invalidates the scoping principle here.

Why won’t the lockdown identifier register in a new VM context?

[mhofman]

Node’s vm module is pretty barebones. Afaik it doesn’t contain any node provided APIs such as require, only v8 intrinsics. I highly recommend you don’t try to build your own isolation mechanism based on it. You may have better luck with vm2 or isolated-vm.

SES will not on its own load external modules and evaluate them in isolated Compartments. For that you need other parts of Endo. You may instead be interested in LavaMoat which uses SES/Endo under the hood, and helps you isolate your package dependencies according to policies you define.

[mhofman]

What I’m saying is that I don’t believe you’re loading the ses shim inside the context you created. You’re loading it in the parent realm.