How secure is Tengo for running untrusted user code?

Tengo is designed with security in mind, using a VM that isolates script execution and controlled APIs for interoperability. However, like any embedded language, it requires careful host application design to prevent vulnerabilities such as excessive resource usage or injection attacks.

Tengo vs Lua for embedding in Go: which is better?

Tengo offers tighter Go integration and better performance in benchmarks, as it's written natively in Go. Lua has a larger ecosystem and more mature tooling. Choose Tengo if you prioritize Go-native performance and security; opt for Lua if you need extensive libraries or existing Lua code reuse.

How to add custom Go functions to Tengo scripts?

You can expose Go functions by using the `Add` method on a Script instance to bind values, or define custom object types as shown in the interoperability documentation. This allows scripts to call Go code directly for extended functionality.

Does Tengo support JSON or HTTP out of the box?

Tengo's standard library is minimal and does not include built-in JSON or HTTP modules. You'll need to expose Go's standard library functions through custom bindings, which adds development overhead compared to languages with richer built-ins.

What's the performance impact of using Tengo in a Go app?

Tengo adds VM overhead, so script execution is slower than native Go but faster than many interpreters like starlark-go or otto. For CPU-intensive tasks, consider the trade-off between flexibility and performance, as shown in the Fibonacci benchmarks.

Can Tengo scripts handle concurrency or parallelism?

Tengo itself lacks built-in concurrency primitives; concurrency must be managed by the host Go application. Scripts run in a single goroutine, making it unsuitable for tasks requiring independent parallel execution without additional Go-level coordination.

tengo — Embeddable Go Scripting Language

What is tengo?

Tengo is a small, dynamic scripting language specifically designed for embedding into Go applications. It provides a fast and secure execution environment by compiling to bytecode and running on a stack-based virtual machine written entirely in Go, enabling Go programs to be extended with scripting capabilities.

Target Audience

Go developers who need to add scripting, rules engines, or dynamic configuration to their applications without relying on external language runtimes or cgo.

Value Proposition

Developers choose Tengo for its native Go implementation with no external dependencies, offering performance comparable to other embedded languages like Lua, along with secure embedding and a simple, readable syntax with features like higher-order functions and closures.

A fast script language for Go

Use Cases

Best For

Embedding a scripting language within Go applications to allow user-defined logic or plugins.
Implementing a rules engine where business rules need to be dynamically evaluated or updated.
Building state machines or data pipelines that require flexible, scriptable transitions or transformations.
Creating configuration systems that support complex, dynamic expressions beyond static files.
Developing educational tools or REPLs for teaching programming concepts with a lightweight, embeddable language.
Extending Go programs with custom logic in scenarios where performance and security are critical, such as in server-side applications.

Not Ideal For

Projects requiring extensive third-party libraries or modules common in languages like Python or JavaScript.
Applications where the absolute lowest latency is critical and VM overhead is unacceptable.
Teams already standardized on another scripting language and seeking minimal disruption to existing workflows.
Use cases needing advanced language features like built-in concurrency, metaprogramming, or complex type systems.

Pros & Cons

Pros

Native Go Implementation

The compiler and runtime are written entirely in Go with no cgo or external dependencies, ensuring seamless integration and easy deployment within Go ecosystems.

Fast Bytecode Execution

Benchmarks show Tengo outperforms similar embedded languages like go-lua and goja in Fibonacci tests, thanks to its stack-based VM and bytecode compilation.

Secure Embedding Design

Designed specifically for secure execution within Go applications, with controlled interoperability features that allow safe running of untrusted scripts.

Simple and Expressive Syntax

Features dynamic typing with coercion, higher-order functions, and closures, making scripts readable and powerful for tasks like rules engines or data pipelines.

Cons

Limited Standard Library

The built-in functions and modules are minimal compared to mature languages, so complex tasks like network operations often require custom Go bindings.

Small Community and Ecosystem

As a niche language, it lacks extensive documentation, third-party libraries, and community support, which can slow down development and troubleshooting.

Performance Overhead vs Native Go

While fast for a VM, it introduces execution overhead compared to pure Go code, which may be a concern in latency-sensitive or high-throughput applications.

Frequently Asked Questions

What is tengo?

Target Audience

Go developers who need to add scripting, rules engines, or dynamic configuration to their applications without relying on external language runtimes or cgo.

Value Proposition

Use Cases

Best For

Embedding a scripting language within Go applications to allow user-defined logic or plugins.
Implementing a rules engine where business rules need to be dynamically evaluated or updated.
Building state machines or data pipelines that require flexible, scriptable transitions or transformations.
Creating configuration systems that support complex, dynamic expressions beyond static files.
Developing educational tools or REPLs for teaching programming concepts with a lightweight, embeddable language.
Extending Go programs with custom logic in scenarios where performance and security are critical, such as in server-side applications.

Not Ideal For

Projects requiring extensive third-party libraries or modules common in languages like Python or JavaScript.
Applications where the absolute lowest latency is critical and VM overhead is unacceptable.
Teams already standardized on another scripting language and seeking minimal disruption to existing workflows.
Use cases needing advanced language features like built-in concurrency, metaprogramming, or complex type systems.

Pros & Cons

Pros

Native Go Implementation

The compiler and runtime are written entirely in Go with no cgo or external dependencies, ensuring seamless integration and easy deployment within Go ecosystems.

Fast Bytecode Execution

Benchmarks show Tengo outperforms similar embedded languages like go-lua and goja in Fibonacci tests, thanks to its stack-based VM and bytecode compilation.

Secure Embedding Design

Designed specifically for secure execution within Go applications, with controlled interoperability features that allow safe running of untrusted scripts.

Simple and Expressive Syntax

Features dynamic typing with coercion, higher-order functions, and closures, making scripts readable and powerful for tasks like rules engines or data pipelines.

Cons

Limited Standard Library

The built-in functions and modules are minimal compared to mature languages, so complex tasks like network operations often require custom Go bindings.

Small Community and Ecosystem

As a niche language, it lacks extensive documentation, third-party libraries, and community support, which can slow down development and troubleshooting.

Performance Overhead vs Native Go

While fast for a VM, it introduces execution overhead compared to pure Go code, which may be a concern in latency-sensitive or high-throughput applications.

Frequently Asked Questions

tengo

What is tengo?

Overview

Use Cases

Best For

Not Ideal For

Pros & Cons

Pros

Cons

Frequently Asked Questions

Related Projects

Found a gem we're missing?

tengo

What is tengo?

Overview

Use Cases

Best For

Not Ideal For

Pros & Cons

Pros

Cons

Frequently Asked Questions

Related Projects

Found a gem we're missing?