I'm looking for a python3 library (or project) that can allow me to run "unsafe" code (input from the internet, or similar) without compromising security.
If such a library doesn't exist, a recommendation for a programming language that I could "bind" (I'm not sure of the exact term, "host" maybe?) would also be acceptable (though I would like the solution to be as simple as possible).
For clarity, I'm not talking about "hosting" unsafe python code in python, which a few questions I have found here and on SO tell me is impossible. I would also like to avoid creating a DSL, because I want to support a lot of the features of a "modern" high-level programming language (algebraic expressions, list manipulation, class/function definition).
My specific requirements (roughly in order of importance):
Ability to pass "complex" data structures between the python host and the unsafe code. Ideally as much complexity as (for example) JSON would be supported, although I could probably manage with a bit less. Only being able to pass basic data types (int, string) would not work well.
The language the unsafe code is written in providing support for the language features mentioned above
Ability to call functions defined by the unsafe code from python (by name)
(Less important) ability for the unsafe code to call a function defined in the python code (safely)
(Optional) language for the unsafe code being simple and easy to learn
Some of the things that I've looked at are:
Python: as mentioned, it seems (nearly?) impossible to safely run unknown/untrusted python code. But I've seen some mentions that PyPy offers a restricted sandbox, or the RestrictedPython project. I'm not sure if these are considered safe or if they work for python3.
Javascript: via a library like PyV8 or PyExecJs. I haven't found anything about whether running code this way is actually "safe", but this seems like it could be a good solution. I'm also not sure if there's a better maintained equivalent to these.
An answer that what I'm looking for doesn't exist for python is also reasonable (though a pointer to a language/library solution where this is possible would be nice, in that case).