Resource Limits

Bound runaway code in Secure Exec with timeouts and VM resource limits.

Untrusted code should always run with a timeout. Everything else is bounded by default, and you can tighten it.

Timeouts

timeoutMs is an execution option, so it works on every call, one-shot or on a VM.

import { execute } from "secure-exec";

// `timeoutMs` stops runaway code. The result reports it; nothing is thrown.
const runaway = await execute("while (true) {}", { timeoutMs: 1_000 });
console.log(runaway.outcome); // timed_out

Memory and other VM limits

limits is a VM option. Pass it on a call, or on createVm.

// VM limits bound memory and other resources for the whole VM.
const bounded = await execute(
	"const chunks = []; while (true) chunks.push(new Array(1e6).fill(0));",
	{ limits: { jsRuntime: { v8HeapLimitMb: 64 } }, timeoutMs: 30_000 },
);
console.log(bounded.outcome); // failed

When a limit is hit, the call fails with an error that names the limit. Pass onLimitWarning to hear about a limit before it is reached.

Every limit

Secure Exec accepts the agentOS limits object unchanged: processes, file descriptors, sockets, filesystem bytes, the V8 heap, output buffers, and more. Read the agentOS resource limits reference for every field and default.