Sandboxed Plugin architecture

Question

I was googling and searching SO for plugin architecture and I'm satisfied by general knowledge on how to implement it. Now I went further to look for a sandboxed architecture. Basically what I mean is an application with plugin whereby crashing in plugin won't crash the whole app and the plugin can be reloaded. I cannot find good documentation. I know Firefox implements it (crashing flash plugin does not affect whole FF thing and can be reloaded) Thanks!

Answer 1

The only way you can have a truly sandboxed architecture wherein a plug-in cannot directly crash the parent application's process or corrupt its memory is by placing it into a separate OS process, with a separate memory space. When doing this, you will need to rely on interprocess communication facilities of the OS (pipes, sockets, remote procedure calls, memory mapped files, shared memory, synchronization objects, etc.) to interact with the plug-in.

Answer 2

Google's native client technology may be more thorough than what you were looking for, but it might be worth a read.