One job, every sandbox

The Mandelbrot set is a mathematical picture whose intricate patterns reveal more detail as you zoom in. It is drawn by repeating a simple calculation at every pixel. We split the picture into 256 tiles and used fan-out to send the pieces across 9 kinds of sandboxes working at once. Each tile was computed twice, by two different kinds of sandboxes running the same JavaScript program. The two answers were compared byte for byte: 256 of 256 tiles agree. 57 of those pairs compared two different JavaScript engines, and 107 included a run in the cloud. Every run is signed into one bundle that anyone can check offline.

1. Where the work ran

processcontainerkernelvm

2. Split into 256 tiles

3. The finished picture

The sandboxes

A median run is the time from dispatch to answer that the run's signed record states, sandbox start included. Cost is that time multiplied by each cloud's list price per second; the provider's bill is the real figure. Where a sandbox is, is the operator's statement; the record states the provider and the tier.

Why the two answers should agree

The tile program uses only floating-point operations whose rounding the JavaScript standard specifies exactly (addition, subtraction, multiplication, division and comparison on 64-bit numbers), so every conforming engine should print the same bytes for a tile: node in most rooms, QuickJS in the WebAssembly engine. A tile whose two answers differ is painted red and needs investigating: a sandbox that ran something other than it was given, a defect in an engine, or damaged output. Agreement shows the answers match; it does not prove either one correct or any sandbox secure.

What is signed, and what is stated

Signed by the harness key made for this run, after the client checked each run's record: every request (with the room it was sent to) and every answer, including the provider and the isolation tier the daemon reported and the run's start and end. A changed, missing or moved line fails the check below. Stated by the operator, in unsigned files beside the bundle: what each room is and where (rooms.json, with the engine and the list price), and when the run started and ended, which rooms sat out and why (run.json). A tier is the daemon's report: plimsoll's configuration and the provider's evidence plus a startup smoke test, never runtime attestation, and nothing here independently proves which machine ran the code.

Check it yourself

From a checkout of the repository:

go run ./examples/fanout -verify

It checks every signature in bundle.jsonl under harness.pub (key f9c9aaaeca5f77710d41587308b8f52fcc02f95c8306b751a7f0723e7dba530d), the chain that catches a line added, removed or moved, each signed record against the request and answer stored beside it, that each run's record states the provider and tier of the room it was sent to, and that this page and the picture are what the bundle and the two stated files render. It then reports the result separately: a run with tiles that disagree still verifies, and says so. It starts no sandbox.

Words on this page

Sandbox

A place to run code someone else wrote without letting it reach the machine around it. Here each run gets a fresh one.

Isolation tier

How strong the wall is, weakest to strongest: process (a WebAssembly engine inside plimsoll's own process), container (Linux namespaces and a filter on system calls), kernel (gVisor, a separate kernel that answers the code's system calls), vm (a virtual machine with its own kernel). A tier is plimsoll's configuration and the provider's evidence plus a startup smoke test, never runtime attestation.

Fan-out, fan-in

Sending pieces of one job to many workers at once, then gathering the answers into one result.

Signed bundle

One file holding every run's request, answer and record, each signed by a key made for this run, linked in order so a missing or moved line is caught.

Placement

plimsoll's library that holds several daemons as one pool and sends each request to one of them.

Run 2026-10-23 20:00 UTC. Grid 16 by 16 tiles of 32 by 32 pixels. Rendered from the signed bundle by go run ./examples/fanout.