iframe.diy - Sandboxed iframes, zero server

iframe.diy

Run any web app inside a sandboxed iframe where your page controls<br>everything: every file the app loads, every API it can call. No server<br>required.

How it works

Each app gets a unique subdomain<br>(.iframe.diy) for origin isolation. A Service<br>Worker inside the iframe proxies every fetch request back to your page<br>via postMessage. Your page decides what to serve and what<br>to inject.

Parent Page iframe.diy Frame<br>┌──────────────┐ postMessage ┌─────────────────────────────────┐<br>│ │ (JSON-RPC 2.0) │ Outer Frame │<br>│ Serves files │ ◄─────────────────► │ ┌─────────────────────────┐ │<br>│ via fetch RPC│ │ │ Inner iframe │ │<br>│ │ │ │ App runs here │ │<br>└──────────────┘ │ └─────────────────────────┘ │<br>│ sw.js ─ proxies fetch → parent │<br>└─────────────────────────────────┘

Why?

Embed untrusted or third-party web apps without giving them access<br>to your origin

Polyfill APIs like window.nostr, inject configuration,<br>or add monitoring

Modify app behavior without touching its source code

All client-side — no server infrastructure needed

GitLab<br>&middot;<br>Protocol docs<br>&middot;<br>Public domain