# Resource Limits

Untrusted code should always run with a timeout. Everything else is bounded by
default, and you can tighten it.

## Timeouts

`timeoutMs` is an execution option, so it works on every call, one-shot or on a
VM.

secure-exec/examples/limits/src/index.ts:

```ts
import { execute } from "secure-exec";

// `timeoutMs` stops runaway code. The result reports it; nothing is thrown.
const runaway = await execute("while (true) {}", { timeoutMs: 1_000 });
console.log(runaway.outcome); // timed_out
```

## Memory and other VM limits

`limits` is a VM option. Pass it on a call, or on `createVm`.

secure-exec/examples/limits/src/index.ts:

```ts
// VM limits bound memory and other resources for the whole VM.
const bounded = await execute(
	"const chunks = []; while (true) chunks.push(new Array(1e6).fill(0));",
	{ limits: { jsRuntime: { v8HeapLimitMb: 64 } }, timeoutMs: 30_000 },
);
console.log(bounded.outcome); // failed
```

When a limit is hit, the call fails with an error that names the limit. Pass
`onLimitWarning` to hear about a limit before it is reached.

## Every limit

Secure Exec accepts the agentOS `limits` object unchanged: processes, file
descriptors, sockets, filesystem bytes, the V8 heap, output buffers, and more.
Read the [agentOS resource limits reference](/agentos/docs/resource-limits) for
every field and default.