Controlled environments for Coding/programming

[Quasmo]

Bit of a long one here, apologies for the ramble and this might seem like a really stupid obvious question but I'm losing any sense of sanity I have left trying to find a good solution/answer!

 

Our schools IT teachers teach an optional Computer Science course for KS4/GCSE, specifically the Pearson/Edexcel course, which requires the students to write, edit and test various simple scripts in python.

 

Students being able to execute any kind of python files on a networked domain joined machine is a recipe for disaster, so we've always opted to do this in a secure environment.

 

When I first started here we used to have servers running VDI's for student use, so just a bunch of virtual machines with little more than an IDE (just python IDLE) installed and other basic apps, the connection was always spotty and often the remote sessions would close or just straight up crash; this wasn't the end of the world when it was just during a lesson and the work didn't need to be saved.

 

And then Pearson introduced a practical to the exam...

 

after just one year of panic inducing whack-a-mole helping the invigilators keep the students connected during the exam we decided we were going to try and find another solution, which we did! Windows Sandbox! I was able to configure a .wsb file with everything we needed and we mapped a network drive to host and save files for lessons and exam conditions, everything was perfect.

 

Then Microsoft came along with 24H2 and crushed my hopes and dreams forever, you can no longer map network drives into windows sandbox (I also can't really find any documentation explaining this change, but hey-ho, that's just Microsoft I guess!)

 

I'm back to the drawing board basically, from asking around local schools it seems a lot of people opt to use online services or browser based sessions for any coding lessons; this is great in theory but I've gathered they don't teach the Pearson/Edexcel course and don't have a practical as a requirement for the exam.

 

TL;DR: For those of you whose schools also teach the Pearson Course for computer science, How do you do it?

 

apologies again for the wall of text!

[DWilson1997]

Interested in this - as we also need a reliable solution do deliver computer science exams. Currently we deliver it via local install on the device, but we aren't on a local AD so the devices are quite restricted but we are getting requests to install more and more python modules, or visual studio code which essentially does not work if you block terminal, cmd and powershell.  I have looked at virtual labs for learning/lessons briefly but not found one that is suitable yet that would also allow us to easily lock down for an exam...

Edited November 25, 2025 by DWilson1997

[Olliedawg]

Following

[3s-gtech]

The documentation says that mapped folders are still supported. Have you tried tweaking the XML configuration in case something has been updated? https://learn.microsoft.com/en-us/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-configure-using-wsb-file

[Quasmo]

43 minutes ago, 3s-gtech said:

The documentation says that mapped folders are still supported. Have you tried tweaking the XML configuration in case something has been updated? https://learn.microsoft.com/en-us/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-configure-using-wsb-file

 

So from what I've tested via configuring .wsb files you can still map and embed folders into a sandbox session provided that it is local to the machine, anything on the C drive or a physically installed drive is good to go, the issue is when you try to map a network share or something external, it no longer works, it does still work if we revert/re-image the machines back to 23H2, but this is a temporary fix and not something we want to do long term.

 

Mapping local drives would work, but it's not really feasible without assigned seating, it also means giving students access to the C drive which again, we'd rather not do for security reasons, plus if there is an issue with the machine they could lose their work.

 

Edit: I should have mentioned earlier, the issue with network shares no longer working has been raised: https://github.com/microsoft/Windows-Sandbox/issues/63

 

I think the change is deliberate and I understand the reasoning, (security related) it's just really bloody annoying.

 

 

Edited November 25, 2025 by Quasmo

[3s-gtech]

Even when the network share is assigned a drive letter?

[Quasmo]

2 minutes ago, 3s-gtech said:

Even when the network share is assigned a drive letter?

 

Unfortunately so, for example:

 

 

This same .wsb file will work in 23H2, but in 24H2 will fail to start:

 

 

Unless Microsoft have changed how to reference network shares in the configuration, which if they have I can't find any documentation about it.

 

 

[3s-gtech]

Hmmm. How about using mklink?

 

mklink /j C:\Volumes\Test T:\

[Quasmo]

12 minutes ago, 3s-gtech said:

Hmmm. How about using mklink?

 

mklink /j C:\Volumes\Test T:\

 

Oooh haven't tried that yet, will have to get my head around it first.

 

I'll give it a go and let you know, thanks!

[dhicks]

4 hours ago, Quasmo said:

For those of you whose schools also teach the Pearson Course for computer science, How do you do it?

 

We have iMacs in our IT suite, which seem to have been fine with pupils having access to Python on the local machine - they are closely supervised, though. Our remote desktop system for staff uses Guacamole for web-based access via Cloudflare Tunnels with Google authentication (users are already logged in to their Google accounts, they aren't even presented with another login screen, they just click on the "remote desktop" icon and it loads).

 

I was thinking of creating something similar for pupil use but using Pangolin instead of Cloudflare Tunnels, and probably a Debian desktop instead of Windows or MacOS. This will run on a VM on our server in our building, so will be behind the same filtering infrastructure as other devices. It should, hopefully, give each pupil a handy place where they can have a development environment to tinker around with. I doubt graphics performance will be good enough to support running games directly on the remote desktop server, but a local-access-only web server should be do-able, so they should be able to develope web-based stuff for them and their friends to play if they want.

[Rob_D]

20 hours ago, 3s-gtech said:

Hmmm. How about using mklink?

 

mklink /j C:\Volumes\Test T:\

/j doesn't seem to support network drives. Using /d with the server\sahre path seems to work for me though.

mklink /d c:\testlink "\\servername\sharename"

 

[Quasmo]

On 25/11/2025 at 12:42, 3s-gtech said:

Hmmm. How about using mklink?

 

mklink /j C:\Volumes\Test T:\

 

23 hours ago, Rob_D said:

/j doesn't seem to support network drives. Using /d with the server\sahre path seems to work for me though.

mklink /d c:\testlink "\\servername\sharename"

 

 

The two of you are geniuses! it works!*

 

*if someone from Microsoft is reading this, it doesn't work, no need to change anything in the next version, I promise.

 

Thank you so much, this has saved a lot of time and money from having to find another solution.

[dmj]

Not in education - our data scientists program using python in Google Colab. 

https://colab.google/

Not sure what the education prices are, AFAIK you pay for compute time on hosted infra.

It's effectively a hosted https://jupyter.org/ environment, you could host Jupyter yourself as it's free. 

I've always been suprised by the lack of Jupyter in UK schools - it's an awesome system for running code with examples/documentation built in. 

 

edit: here's an example of an Opensource notebook: https://jupyter.org/try-jupyter/notebooks/?path=notebooks/Intro.ipynb

Edited November 27, 2025 by dmj