GoKawiilDatasette Apps: Host custom HTML applications inside Datasette
Today we launched a new plugin for Datasette, datasette-apps, with this launch announcement post on the Datasette project blog. That post has the what, but I’m going to expand on that a little bit here to provide the why.
The TL;DR
Datasette Apps are self-contained HTML+JavaScript applications that run in a tightly constrained <iframe> sandbox hosted on your Datasette application. They can use JavaScript to run read-only SQL queries against data in Datasette, and can run write queries too if you configure them with some stored queries.
Here’s a very simple example and a more complex custom timeline example—the latter looks like this:
Apps are allowed to run JavaScript and render HTML and CSS. They are limited in terms of access—the <iframe sandbox="allow-scripts allow-forms"> they run in prevents them from accessing cookies or localStorage and they also have an injected CSP header (thanks to this research) which prevents them from making HTTP requests to outside hosts, preventing a malicious or buggy app from exfiltrating private data.
Datasette Apps started out as my attempt at building a Claude Artifacts mechanism for Datasette Agent, but I quickly realised that the sandboxed pattern is interesting for way more than just adding custom apps to the interface surface and promoted it to its own top-level concept within the Datasette ecosystem.
They’re also a fun way to turn my multi-year experiment in vibe-coded HTML tools into a core feature of my main project!
You can try out Datasette Apps by signing in with GitHub to the agent.datasette.io demo instance.
Why build this?
... continue reading