Only supported code
A deliberately limited runtime for Go and translated Python. No arbitrary native extensions or subprocess creation.
Minimal-authority execution for AI agents
Run code.
Not risks.
AI agents generate code you can't fully trust. Securely.run executes supported workloads with only the authority they need—without the weight of a general-purpose runtime.
Security by subtraction. Performance by design.
Execution model / simplified
Agent-generated codeSupported Go and translated Python
↓
Compile & minimizeStatic code · program-specific syscall policy
↓
Restricted native executionNamespaces · seccomp · Landlock · no capabilities
No arbitrary subprocessesControlled egressSmall footprint
The principle
Security by subtraction.
Conventional runtimes expose broad capabilities, then try to restrict them. We start with a smaller execution model and grant only what each supported program requires.
Only necessary syscalls
Binary-derived syscall inventories and per-program seccomp policies narrow the kernel interface.
Multiple boundaries
Linux namespaces, Landlock, dropped capabilities, service separation, and allowlisted HTTPS egress.
Architecture
Small by design.
Restricted by default.
Each layer limits a different kind of authority. A request must satisfy every applicable boundary before it can succeed.
General-purpose execution
- Large runtime and dependency ecosystem
- Broad operating-system compatibility
- Isolation added around general-purpose programs
Securely.run
- Constrained language and execution model
- Program-specific syscall restrictions
- Restricted filesystem and network access
- Fail-closed confinement setup
Less kernel surface. Less overhead.
Security model ↗Minimal capabilities enable lightweight, fast execution for compatible workloads.
Security posture
Designed for untrusted code.
Clear about its boundaries.
Securely.run uses defense in depth on a shared Linux kernel. Restricting syscalls reduces exposure; it does not eliminate kernel vulnerabilities or provide VM-equivalent tenant isolation.
Seccomp + Landlock
Restrict system calls and filesystem operations independently.
PAC + BTI
Hardware-assisted control-flow mitigations complement kernel confinement.
Own your boundary
Discuss deployment within your infrastructure and additional isolation for distinct trust domains.
Architecture described here reflects the Joulebox technology direction. Independent security review and stronger tenant boundaries remain important validation steps. Browser engines, arbitrary Python native packages, and general-purpose application stacks are not supported by the restricted native runtime.
Design partners
Let's measure what your agents actually need.
Explore workload compatibility, security requirements, startup latency, and infrastructure footprint.
Start a conversation ↗