Run untrusted code in Firecracker microVMs

const source = `
import json
json.dump({"ok": True}, open("out.json", "w"))
`;

const sb = await client.sandboxes.create({ image: "python" });
await client.files.write(sb.id, "main.py", source);
await client.run(sb.id, "python3", ["main.py"]);

const out = await client.files.readText(sb.id, "out.json");
console.log(JSON.parse(out).ok);

source = """
import json
json.dump({"ok": True}, open("out.json", "w"))
"""

sb = client.sandboxes.create("python")
client.files.write(sb["id"], "main.py", source)
client.run(sb["id"], "python3", "main.py")

out = client.files.read(sb["id"], "out.json")
print(json.loads(out)["ok"])

const source = `
import json
json.dump({"ok": True}, open("out.json", "w"))
`

sb, _ := client.Sandboxes.Create(ctx, microvm.SandboxCreateParams{Image: "python"})
defer client.Sandboxes.Delete(ctx, sb.Id)

client.Files.Write(ctx, sb.Id, "main.py", []byte(source))
client.Run(ctx, sb.Id, "python3", "main.py")

out, _ := client.Files.Retrieve(ctx, sb.Id, "out.json")
fmt.Println(string(out))

import { frameText } from "@pablofdezr/microvm";

// Starting a command and watching it are two calls: a dropped
// connection no longer kills the job.
const exe = await client.executions.create(sb.id, {
  cmd: "python3",
  args: ["train.py"],
  timeout_seconds: 600,
});

// The stream replays from the start, then follows — reconnecting loses nothing.
for await (const frame of client.executions.stream(sb.id, exe.id)) {
  if (frame.type === "stdout") process.stdout.write(frameText(frame));
}

# Starting a command and watching it are two calls: a dropped
# connection no longer kills the job.
exe = client.executions.create(
    sb["id"], "python3", ["train.py"], timeout_seconds=600
)

# The stream replays from the start, then follows — reconnecting loses nothing.
for frame in client.executions.stream(sb["id"], exe["id"]):
    if frame["type"] == "stdout":
        sys.stdout.buffer.write(frame["data"])

// Starting a command and watching it are two calls: a dropped
// connection no longer kills the job.
exe, _ := client.Executions.Create(ctx, sb.Id, microvm.ExecutionCreateParams{
    Cmd:            "python3",
    Args:           &[]string{"train.py"},
    TimeoutSeconds: microvm.Ptr(600),
})

// The stream replays from the start, then follows — reconnecting loses nothing.
for frame, err := range client.Executions.Stream(ctx, sb.Id, exe.Id) {
    if err != nil {
        log.Fatal(err)
    }
    os.Stdout.Write(frame.Bytes())
}

// No sandbox to hold: the task waits for a slot anywhere in the fleet.
const task = await client.tasks.create({
  image: "node",
  cmd: "node",
  args: ["job.js"],
  files: { "job.js": source },
  vcpus: 2,
  mem_mib: 1024,
  priority: 7, // 0–10, higher runs first; equal is FIFO
});

const done = await client.tasks.wait(task.id);
console.log(done.status, done.exit_code, done.stdout);

# No sandbox to hold: the task waits for a slot anywhere in the fleet.
task = client.tasks.create(
    "node", "node",
    args=["job.js"],
    files={"job.js": source},
    vcpus=2,
    mem_mib=1024,
    priority=7,  # 0-10, higher runs first; equal is FIFO
)

done = client.tasks.wait(task["id"])
print(done["status"], done["exit_code"], done["stdout"])

// No sandbox to hold: the task waits for a slot anywhere in the fleet.
// Optional fields are pointers, so microvm.Ptr sets them inline.
task, _ := client.Tasks.Create(ctx, microvm.TaskCreateParams{
    Image:    "node",
    Cmd:      "node",
    Args:     &[]string{"job.js"},
    Vcpus:    microvm.Ptr(2),
    MemMib:   microvm.Ptr(1024),
    Priority: microvm.Ptr(7), // 0-10, higher runs first; equal is FIFO
})

done, _ := client.Tasks.Wait(ctx, task.Id)
fmt.Print(done.Stdout)

import { APIError } from "@pablofdezr/microvm";

try {
  const sb = await client.sandboxes.create({
    image: "go",
    vcpus: 2,
    mem_mib: 1024,
    cpu_cores: 0.5,   // a hard ceiling, enforced
    network: true,    // filtered egress — no RFC1918, no metadata
    ttl_seconds: 300, // killed when it elapses
  });
} catch (e) {
  // The node is full. Hand the work to the queue instead of failing.
  if (e instanceof APIError && e.isCapacity) {
    await client.tasks.create({ image: "go", cmd: "go", args: ["run", "main.go"] });
  } else throw e;
}

from microvm import APIError

try:
    sb = client.sandboxes.create(
        "go",
        vcpus=2,
        mem_mib=1024,
        cpu_cores=0.5,    # a hard ceiling, enforced
        network=True,     # filtered egress - no RFC1918, no metadata
        ttl_seconds=300,  # killed when it elapses
    )
except APIError as e:
    if not e.is_capacity:
        raise
    # The node is full. Hand the work to the queue instead of failing.
    client.tasks.create("go", "go", args=["run", "main.go"])

sb, err := client.Sandboxes.Create(ctx, microvm.SandboxCreateParams{
    Image:      "go",
    Vcpus:      microvm.Ptr(2),
    MemMib:     microvm.Ptr(1024),
    CpuCores:   microvm.Ptr(0.5),  // a hard ceiling, enforced
    Network:    microvm.Ptr(true), // filtered egress — no RFC1918, no metadata
    TtlSeconds: microvm.Ptr(300),  // killed when it elapses
})

// The node is full. Hand the work to the queue instead of failing.
if microvm.IsCapacity(err) {
    _, err = client.Tasks.Create(ctx, microvm.TaskCreateParams{
        Image: "go", Cmd: "go", Args: &[]string{"run", "main.go"},
    })
}

microvm run python main.py              # upload, run, print the output
microvm run node app.ts -network        # with filtered internet
microvm run python job.py -env KEY=v -timeout 30s

microvm submit python job.py            # queue it instead; prints a task ID
microvm result tsk_01JZ8...             # wait for it and print the output

microvm ps                              # sandboxes on this node
microvm queue                           # depth and this node's slots
microvm bench python main.py -n 10      # time each leg separately
microvm logs sb_01JZ8... exe_01JZ8...   # an execution's recorded output