Security
Overview
What Secure Exec isolates, what it denies by default, and what remains your responsibility when running untrusted code.
Secure Exec treats all guest code, and every package it loads, as hostile.
The boundary
Guest code runs in a V8 isolate inside a sidecar process, separate from yours.
It never reaches a real Node.js builtin, host socket, or host file. Every
node:fs, node:net, and node:child_process call is implemented against a
virtual kernel in the sidecar, and checked against the VM’s permission policy
before anything happens.
Defaults
| Default | |
|---|---|
| Filesystem | A virtual filesystem. The host’s is reachable only through mounts you configure |
| Network | VM-local listeners and loopback work; external access requires permission |
| Processes and environment | Virtual. Guest code can spawn processes and read its own environment, never yours |
| Resources | Bounded. See resource limits |
| State | None. Each one-shot call gets a fresh VM |
Your responsibilities
- Set
timeoutMson every call that runs code you did not write. - Treat host functions as your API surface. They run with your credentials, so validate and authorize inside them.
- Mount the minimum, read-only unless the guest must write.
- Grant hosts, not the whole network, when the code only needs one API.
Read the agentOS security model for the full trust model and what is guaranteed.