One sandbox.
Every language.
Compiled binaries (Go, Rust, C/C++) and interpreted scripts (Python, Node.js, Ruby, Bash) all run in the same embedded seccomp sandbox. Same security, same limits, same GPU routing. No runtime gets special treatment. One binary, every language you use.
Runtime languages
supported
Every plugin type runs in the same embedded seccomp sandbox, with the same security, the same limits, and the same GPU routing.
| Type | Runtime | File Extension | Executor Route | Sandbox | GPU? |
|---|---|---|---|---|---|
| Compiled | Native (Go, Rust, C/C++) | Compiled binary | subprocess + embedded seccomp | Embedded seccomp | |
| Interpreted | Python | .py | python3 interpreter in sandbox | Embedded seccomp | |
| Interpreted | Node.js / JavaScript / TypeScript | .js, .ts | node interpreter in sandbox | Embedded seccomp | |
| Interpreted | Ruby | .rb | ruby interpreter in sandbox | Embedded seccomp | |
| Interpreted | Bash / Shell | .sh | bash in sandbox | Embedded seccomp |
No separate runtime components to install per language. The agent does not even distinguish between languages. Only between signed and unsigned plugins.
How execution
works
The executor routes plugins to the right runtime, always through the same sandbox.
Agent receives a job
The control plane dispatches a job to the agent with the plugin binary or script and its Ed25519 signature.
Signature verification
The agent verifies the plugin's Ed25519 signature before any execution. If the signature is invalid or missing, the job fails immediately. No unsigned code ever runs.
Runtime detection
The agent checks the plugin file extension and metadata to determine the executor route: native subprocess for compiled binaries, or language interpreter for scripts.
Sandbox initialization
The embedded seccomp filter (215 allowlisted syscalls, default-deny) is applied. Cgroups enforce memory, CPU, and wall-clock limits. GPU device access is configured if RequiresGPU is set.
Execution and audit
The plugin runs in its sandbox. All execution paths, syscalls, resource usage, GPU access, and outcome, are logged to the same audit trail regardless of plugin language.
Consistent security
across all runtimes
No runtime gets preferential treatment. The same security controls apply to every plugin.
Ed25519 signing
Every plugin signed before distribution. Agent verifies before every execution, regardless of language.
Seccomp filter
215 allowlisted syscalls, default-deny. Applied identically to native binaries and interpreted scripts.
Resource limits
Memory, CPU, wall-clock limits enforced via cgroups. Same limits apply to Go, Python, Node, Ruby, Bash.
GPU routing
RequiresGPU flag works identically across all runtimes. No separate GPU configuration per language.
One binary.
Unlimited languages.
Deploy once. Write plugins in any language. Same security, same controls, same audit trail.