Pre-release. Ophiolite runs today for design partners; public source and server image publication are in preparation.

Ophiolite

Product / Sandboxed execution

Sandboxed execution

Agents and long jobs run in containers with no network, a read-only file system and resource limits — inside your boundary.

For IT and developers who run other people's code next to their data.

  • Available Run code inside your boundary

Key features

No network
A run cannot reach the network or a registry.
Read-only root
The container's file system cannot be changed.
Resource limits
Memory, time, CPU, processes, output size and log size are bounded.
Explicit grants
Running shared work needs a member role and an execution grant.
Recorded
Each run records its inputs and outcome.
Your hardware
Runs on your servers; nothing is sent to a hosted service.

How it works

  1. A person or an approved agent starts a run.
  2. The runner starts one container for the job with its limits.
  3. Outputs are checked against their limits before they are kept.

Technical details

The limits per job, by default, are set in the runner itself:

DEFAULTS = {'memory_mb': 256, 'seconds': 60, 'cpus': 1.0, 'pids': 64

Use cases

Run an agent's script

Let an agent run code without giving it the network.

Long calculations

Move a heavy job off a laptop without moving the data.

Contain risk

Show IT exactly what a run can and cannot do.

Not yet, and not planned

  • Run code inside your boundary: No GPU or distributed scheduling

Not planned: suite-wide petrel or techlog replacement; a general application builder or marketplace; universal format conversion.

Read more