Secure Node.js Execution Without a Sandbox
A lightweight library for secure Node.js execution.
No containers, no VMs — just npm-compatible sandboxing out of the box.
Powered by the same tech as Cloudflare Workers.
Run untrusted code with one function call.
Run untrusted scripts against host functions you define. Your credentials stay in your process.
run.ts
import { evaluate } from "secure-exec";
import { crm } from "./crm";
import { z } from "zod";
const result = await evaluate<{ accounts: number; openTickets: number }>(
`
const accounts = await customers.findAccounts({ industry: "fintech" });
const tickets = await customers.openTickets({ account: accounts[0].id });
return { accounts: accounts.length, openTickets: tickets.length };
`,
{
hostFunctions: {
customers: {
findAccounts: { inputSchema: z.object({ industry: z.string() }), execute: ({ industry }) => crm.findAccounts(industry) },
openTickets: { inputSchema: z.object({ account: z.string() }), execute: ({ account }) => crm.openTickets(account) },
},
},
},
);Benchmarks
V8 isolates vs. sandboxes.
Cold startWhat's measured: Time from requesting an execution to first code running.
Why the gap: Secure Exec spins up a V8 isolate inside the host process. No container, no VM, no network hop. Sandboxes must boot an entire container or microVM, allocate memory, and establish a network connection before code can run.
Sandbox baseline: e2b, the fastest provider on ComputeSDK as of March 18, 2026.
Secure Exec: Median of 10,000 runs (100 iterations × 100 samples) on Intel i7-12700KF.
Our benchmarks →
Lower is better
Secure Exec
17.9 ms176x faster
Fastest sandbox
3,150 ms
Memory per instanceWhat's measured: Memory footprint added per concurrent execution.
Why the gap: V8 isolates share the host process and its V8 engine. Each additional execution only adds its own heap and stack (~3.4 MB). Sandboxes allocate a dedicated container with a minimum memory reservation, even if the code inside uses far less.
What this means: On a 1 GB server, you can run ~210 concurrent Secure Exec executions vs. ~4 sandboxes.
Sandbox baseline: 256 MB, the smallest minimum among popular providers (Modal, Cloudflare Containers) as of March 18, 2026.
Secure Exec: 3.4 MB, the converged average per execution under sustained load.
Our benchmarks →
Lower is better
Secure Exec
~3.4 MB75x smaller
Sandbox provider minimum
~256 MB
Cost per execution-secondWhat's measured: server price per second ÷ concurrent executions per server
Why it's cheaper: Each execution uses ~3.4 MB instead of a 256 MB container minimum. And you run on your own hardware, which is significantly cheaper than per-second sandbox billing.
Sandbox baseline: Cloudflare Containers, the cheapest sandbox provider benchmarked. Billed at $0.0000025/GiB·s with a 256 MB minimum (March 18, 2026).
Secure Exec: 3.4 MB baseline per execution, assuming 70% utilization. Select a hardware tier above to compare.
Our benchmarks → · Full cost breakdown →
Lower is better
Secure Exec
$0.000011/s56x cheaper
Cheapest sandbox
$0.000625/s
Why Secure Exec
Give your AI agent the ability to write and run code safely.
No infrastructure required
No Docker daemon, no hypervisor, no orchestrator. Runs anywhere Node.js, Bun, or an HTML5 browser runs. Deploy to Lambda, a VPS, or a static site — your existing deployment works.
Node.js & npm compatibility
fs, child_process, http, dns, process, os — backed by the virtual OS, not stubbed. Run Express, Hono, Next.js, and any npm package.
Built for AI agents
Give your AI agent the ability to write and run code safely. Works with the Vercel AI SDK, LangChain, and any tool-use framework.
Deny-by-default permissions
Nothing reaches the host unless you allow it. The network is denied until you opt in, and the host filesystem exposes nothing until you mount it. Permissions are set per scope: fs, network, child processes, env.
Configurable resource limits
CPU time budgets and memory caps. Runaway code is terminated deterministically with exit code 124 — no OOM crashes, no infinite loops, no host exhaustion.
Powered by V8 isolates
The same isolation primitive behind Cloudflare Workers for Platforms and every browser tab. Battle-tested at scale by the infrastructure you already trust.
Runs the Node.js libraries and CLIs your agent already reaches for, unmodified.
npm
Package manager
Next.js
Framework
React
UI library
Astro
Framework
TypeScript
Language
webpack
Bundler
esbuild
Bundler
Git
Version control
Express
HTTP server
Hono
HTTP server
A sandboxed operating system, as a library
A bare V8 isolate can only compute. Secure Exec adds a virtual operating system inside the library, so Node.js gets everything it expects from a real machine. None of it touches the host unless you allow it.
Filesystem
- Virtual POSIX filesystemnode:fs works as usual; writes never reach the host disk
- Mount anythingS3, Archil, a host directory, or a custom backend at a guest path
- Read & write filesvm.filesystem moves individual files in and out — no mount needed
Networking
- Outbound requestsfetch, node:http, node:net, and DNS over a virtual network stack
- Serversguest code listens on a virtual port; the host sends requests in
- Token injectioncredentials attached at the boundary, never in guest code
Processes
- Process treeschild_process spawns guest processes, never host ones
- Shell and coreutilsa real sh, so npm scripts and CLIs like git behave
- Pipes and PTYspiped commands and interactive programs work
Packages & runtime
- npm installpackages install into the VM's own filesystem
- TypeScriptexecute, evaluate, and type-check it
- Contextskeep variables between calls like a REPL, several in parallel
Permissions
- Deny by defaultthe network is denied until you allow it — everything, or only named hosts
- Per-scope policyfs, network, childProcess, process, env, and host functions
- Host functionsbindings run in your process; the guest sees only inputs and outputs
Resource limits
- Timeoutsrunaway code returns timed_out instead of hanging your process
- Memory capsbound the V8 heap per VM
- Kernel limitsprocesses, file descriptors, sockets, filesystem bytes, output buffers
Secure Node.js that works the way agents need it
Every other way to run untrusted JavaScript makes you trade something away. Secure Exec keeps the V8 isolate and puts a virtual OS kernel behind it.
| Approach | Full Node.js APIs & npm packagesWhat guest code gets: a virtual filesystem behind node:fs, networking through fetch, node:http and node:net, child processes with a real shell and coreutils, pipes and PTYs, and npm install into the VM's own filesystem.That is what lets unmodified packages and CLIs — Next.js, webpack, esbuild, git — run as they expect. | Securely run untrusted codeThe bar: code you did not write, and its dependencies, cannot reach your filesystem, your network, or your processes, cannot read another VM's state, and cannot exhaust the host. Secure Exec treats the guest as actively hostile: every syscall is serviced by the kernel, the network is denied by default, and CPU and memory are bounded. Security model → | LightweightPer execution: ~17.9 ms to first code running and ~3.4 MB of memory, against seconds and a ~256 MB floor for a container or microVM. It is a library, so there is no daemon, no hypervisor, no vendor account, and no egress fee. It deploys wherever your code already deploys. |
|---|---|---|---|
| Raw Node.jsnode:vm, child_process | ✓ | ✗Node's own documentation states that node:vm is not a security mechanism: guest code can escape the context and reach the host realm. child_process spawns real host processes with your permissions. | ✓ |
| Raw V8 isolate / QuickJSa bare JS engine | ✗A bare engine is only the JavaScript language. There is no fs, no net, no child_process, so most npm packages and every CLI fail. | –An isolate is a language boundary, not a complete security boundary. Embedded natively in your process it shares an address space with your secrets, so it carries real attack surface: speculative-execution side channels such as Spectre, resource exhaustion (CPU spin, heap and stack exhaustion) that takes the host down with it, and engine bugs that escape straight into your process. Containing that takes more than the isolate itself — mediated syscalls, resource accounting, and process separation. How Secure Exec handles it → | ✓ |
| Container sandboxmicroVMs, Docker | ✓ | ✓ | ✗Cold starts run to seconds, the memory floor is about 256 MB, and you need a vendor account, API keys, and per-GB egress — per execution. |
| Secure ExecV8 isolate + virtual OS | ✓ | ✓ | ✓ |
How the security compares
Secure Exec uses the same architecture as Cloudflare Workers and Chromium, so untrusted code gets the security you would expect.
Raw Node.js
Untrusted code runs on the host with full access to your operating system.
Raw V8 isolate / QuickJS
A naive architecture runs untrusted code inside your process, with subtle vulnerabilities and denial of service.
Secure Exec
Process isolation, Spectre mitigations, and resource limits run code securely.
FAQ
Secure Exec runs untrusted code inside V8 isolates — the same isolation primitive that powers every Chromium tab and Cloudflare Workers. Each execution gets its own heap, its own globals, and a deny-by-default permission boundary. There is no container, no VM, and no Docker daemon — just fast, lightweight isolation using battle-tested web technology. Architecture →
No. Secure Exec is a pure npm package —
npm install secure-exec is all you need. It has zero infrastructure dependencies: no Docker daemon, no hypervisor, no orchestrator, no sidecar. It runs anywhere Node.js or Bun runs.We are actively validating serverless platforms, but Secure Exec should work everywhere that provides a standard Node.js-like runtime. This includes Vercel Fluid Compute, AWS Lambda, and Google Cloud Run. Cloudflare Workers is not supported because it does not expose the V8 APIs that Secure Exec relies on.
Use Secure Exec when you need fast, lightweight code execution — AI tool calls, code evaluation, user-submitted scripts — without provisioning infrastructure. Use a sandbox (e2b, Modal, Daytona) when you need a full operating-system environment with persistent disk, root access, or GPU passthrough. Full comparison →
Yes. Secure Exec supports dynamic module installation via npm inside the execution environment.
Yes. Secure Exec bridges Node.js APIs including http, net, and child_process, so frameworks like Express, Hono, and Next.js work out of the box. For production deployments, pair Secure Exec with Rivet Actors to get built-in routing, scaling, and lifecycle management for each server instance.
Yes. For orchestrating stateful, long-running tasks, we recommend pairing Secure Exec with Rivet Actors. Rivet Actors provide durable state, automatic persistence, and fault-tolerant orchestration — so each long-running task survives restarts and can be monitored, paused, or resumed without you building that infrastructure yourself.
- AI agent code execution and tool use
- User-facing dev servers (Express, Hono, Next.js)
- MCP tool-code execution
- Sandboxed plugin / extension systems
- Interactive coding playgrounds
Yes. Most Node.js core modules work — including fs, child_process, http, dns, process, and os. These are bridged to real host capabilities, not stubbed. Compatibility matrix →
Yes. Secure Exec includes a virtual kernel with a system bridge that supports a granular permission model. Filesystem, network, child processes, and environment variables are all available — gated behind deny-by-default permissions.
Yes. Secure Exec runs on native V8 isolates, so your code is JIT-compiled by V8's TurboFan optimizing compiler — the same pipeline that powers Chrome and Node.js. This means full optimization tiers, inline caching, and speculative optimization out of the box.
WASM-based runtimes like QuickJS (via quickjs-emscripten) compile a separate JS engine to WebAssembly, which means your code runs through an interpreter inside WASM — not native V8. Secure Exec uses native V8 isolates directly, so you get the same JIT-compiled performance as JavaScript running on the host. No interpretation overhead, no WASM translation layer, and full Node.js API compatibility.
For those about to execute, we salute you.
Install Secure Exec, create a runtime, and execute untrusted code. All in a few lines of TypeScript.