Security

Filesystem & Mounts

Guest code in Secure Exec sees a virtual filesystem. Mount host directories or node_modules to share files with it.

Guest code sees a virtual Linux filesystem, never the host’s. node:fs works as usual, and whatever the code writes is discarded with the VM. A one-shot call discards it when the call ends. On a VM you created, files last until you dispose it.

To exchange individual files with a VM, use vm.filesystem. To share a whole directory with the guest, mount it. mounts is a VM option.

Mount a host directory

// Project one host directory into the VM, read-only. The guest sees only the
// mounted subtree, never the rest of the host.
const hostData = fileURLToPath(new URL("../host-data", import.meta.url));

const read = await execute(
	`
	import { readFileSync } from "node:fs";
	console.log(readFileSync("/mnt/data/greeting.txt", "utf8").trim());
	`,
	{
		mounts: [hostDirMount("/mnt/data", hostData)],
		output: { capture: "all" },
	},
);
console.log(read.stdout?.trim()); // hello from the host

Mount node_modules

// Mount a host directory of packages as the guest's node_modules, so code can
// import packages you already have with no network and no install step. Point it
// at your project's `node_modules` in a real app.
const hostModules = fileURLToPath(new URL("../host-modules", import.meta.url));

const imported = await execute(
	`
	import { greet } from "greet";
	console.log(greet("secure-exec"));
	`,
	{
		mounts: [nodeModulesMount(hostModules)],
		output: { capture: "all" },
	},
);
console.log(imported.stdout?.trim()); // hello, secure-exec

More filesystems

Secure Exec accepts agentOS mounts and rootFilesystem unchanged, including in-memory, S3, and custom backends. Read the agentOS filesystem docs for the details.