Secure Exec v0.3

Secure Exec is secure Node.js execution without a sandbox: no containers, no VMs, just npm-compatible isolation out of the box. v0.3 is a ground-up rewrite of the runtime in Rust, now running as its own isolated sidecar process for stronger isolation, leaner resource usage, and a clean path to running it from any language.

A Full Rewrite in Rust

We rewrote the entire runtime in Rust. Secure Exec now runs as a standalone sidecar process over a Unix socket.

• Process isolation. Guest code runs in a separate process, so everything it does, from filesystem reads to network calls, never touches the host process.
• No Node.js overhead. Filesystem, network, and module resolution all run natively in Rust. Previously the host TypeScript had to handle every one of these operations, which was expensive.
• Better security. A Rust core makes it far easier to reason about DoS exploits and resource bottlenecks than the previous TypeScript runtime.
• Language-agnostic. Because the runtime is just a process behind a Unix socket, it is no longer tied to Node.js. Any language can drive it.

Bun Support

Previously, Secure Exec ran V8 inside the Node process itself, so it required Node.js and was limited to specific versions.

• Now it is a separate process. Your program talks to the sidecar over a Unix-socket WebSocket instead of loading V8 in-process.
• Bun works out of the box. You can drive Secure Exec from Bun, even though Bun uses JavaScriptCore, while the sidecar keeps running guest code on V8.

Rust SDK

The sidecar is the engine that runs guest code; the new Rust SDK is the native client library your program uses to drive it. It is a highly portable way to work with Secure Exec from any language.

• Native client. The crates speak the sidecar’s wire protocol directly, with no Node.js in the loop, so you can embed Secure Exec straight into a Rust program.
• Easy bindings. Use the SDK as the foundation for first-class bindings in your language of choice, for example Python via PyO3, Go via cgo, and beyond.

Process Trees

Secure Exec can now run full process trees, all inside the virtual kernel.

• Child processes. Spawn child processes and pipe data between them.
• Servers. Run long-lived servers, with traffic routed through the runtime’s own virtual network stack.
• No host exposure. Nothing maps to real host processes, so you get full process-tree semantics without touching the host.

Granular Resource Caps

Untrusted code should never be able to exhaust the host. v0.3 enforces resource caps at the VM level, with sane defaults out of the box, so no single guest can run away with unbounded memory, disk, CPU, or I/O.

• Execution timeout. Bound how long a guest may run; a runaway program is killed when the budget elapses.
• Memory. A V8 heap limit caps how much memory guest JavaScript can allocate.
• Filesystem. Byte and inode caps bound the virtual filesystem.
• Payload and transfer. Caps on captured output, stdin buffering, event payload size, and fetch() response size bound how much data moves between guest and host.
• CPU time. A CPU-time budget bounds core usage and blocking read time independently of the wall-clock timeout.

Configurable Runtime Surface

By default, guests run with the full Node.js surface. v0.3 lets you scale that down a platform ladder, all the way to a nodeless bare runtime that exposes only the language and the core security layer.

Set the platform with a jsRuntime config when you create a VM, or omit it for full Node. Two independent knobs sit alongside it: moduleResolution controls how imports resolve, and allowedBuiltins restricts which node:* modules the guest can import.

Get Started

npm install secure-exec

• Quickstart
• Documentation
• GitHub
• Discord