- admission
- The daemon's capacity check just before a run starts: it reserves a slot within the concurrency and memory limits, or refuses at once instead of queueing.
- attestation
- Cryptographic proof, usually rooted in the hardware, of exactly what software a machine is running; plimsoll's isolation tiers are evidence it collected, not attestation.
- backpressure
- An overloaded service telling its callers to slow down, and the callers doing so.
- broker
- The part of plimsoll that makes API calls for sandboxed code: it checks each call against the grant, attaches the credential itself, and counts the calls, so the code never sees the credential.
- buck converter
- A power-supply circuit that turns a higher DC voltage into a lower one by switching it on and off many times a second.
- cart-pole
- A cart on a rail with a pole hinged on top; the task is to push the cart left and right so the pole stays upright.
- cell
- Code a session runs in a Python or Node.js interpreter that it keeps alive between calls, so what one cell defines can still be there for the next, as in a notebook.
- cgroup
- The Linux kernel feature that caps and counts the memory, CPU time and number of processes a group of processes may use. More: What actually runs your container ↑
- circuit breaker
- A switch in the broker that, after the API answers 429 (too many requests) or 503 (unavailable), stops forwarding calls for a cooldown so the API can recover.
- code mode
- Letting an AI agent write a short program that calls an API and run it in a sandbox, instead of calling one tool per step.
- Connect
- An RPC framework whose Go library serves protobuf-defined procedures over ordinary HTTP; plimsolld and its Go client use that library, and the Python and TypeScript clients speak its JSON form over plain HTTP.
- container
- A process started with its own view of files, network and other processes, while still sharing the host's operating-system kernel.
- content-addressed
- Identified by a digest of its own content, so the identifier can never later point at different content.
- control law
- The formula a controller applies at each tick to turn its measurements into an action.
- controller
- A program that reads a system's state at every tick and decides how to push it, for example to keep a pole balanced on a cart.
- deny-all
- A network policy that blocks every connection unless a rule explicitly allows it.
- digest
- A SHA-256 hash of some content, used as its name: the same digest always means the same bytes.
- dispatch
- Handing a checked request to the provider so the code starts running; a request refused before dispatch ran nothing.
- Docker Cloud Sandboxes
- Docker's hosted service that runs each sandbox as a microVM on Docker-managed machines; the dockercloud provider starts one per run and is billed per use.
- DSSE
- Dead Simple Signing Envelope: a small standard format that wraps a payload together with its signatures.
- E2B
- A hosted service that runs code in Firecracker microVMs; the e2b provider starts one per run and is billed per use.
- egress
- Network traffic leaving the sandbox; plimsoll runs have none, apart from the single path a grant opens to the broker.
- escape
- A bug that lets code inside a sandbox act outside it.
- fail closed
- To refuse, rather than allow, when a check cannot be completed or a required setting is missing.
- fan-out
- Calling an API once per item of a list instead of once for the whole list; also called the N+1 pattern.
- fingerprint
- A SHA-256 hash that stands for some content: equal fingerprints mean identical bytes, and any change gives a different fingerprint.
- Firecracker
- The open-source virtual machine monitor, built by AWS, that starts and runs microVMs; E2B runs every sandbox on it.
- floor
- The weakest isolation tier a request will accept; if the daemon's provider is weaker, the request is refused and nothing runs.
- govulncheck
- Go's official vulnerability scanner, which reports known vulnerabilities only in code your program actually calls.
- grant
- Permission, attached to one run, for its code to call listed routes of one HTTP API through the broker; a run without a grant has no network at all.
- grant profile
- A grant stored on the server under a name, holding the API's address, the allowed routes, the callers allowed to use it and how its credential is made; a caller sends only the name.
- guard
- The HTTPS endpoint, served by the plimsoll daemon, that is the only address a microVM run with a grant may reach; it checks the run's guard credential and hands each call to the broker.
- guest
- The code running inside a sandbox, seen from the host machine that runs it.
- gVisor
- Google's open-source stand-in kernel, written in Go and running as an ordinary program, that handles almost every request a container's code makes itself and uses only a short, locked-down list of real kernel calls. More: What actually runs your container ↑
- hardened mode
- The startup setting PLIMSOLL_HARDENED=1, under which the daemon refuses to start unless every production safeguard is configured.
- hardware virtualization
- Processor support for running several virtual machines on one computer, each with its own kernel, kept apart by the CPU itself.
- harness
- A program outside the daemon that drives runs and checks their results; plimsoll's attest harness signs run records and verifies them later.
- hypervisor
- The program that runs virtual machines and keeps them apart, so code that breaks out of a virtual machine still has to break the hypervisor. More: What actually runs your container ↑
- in-toto
- A standard format for signed statements about software; plimsoll's harness signs each run record as an in-toto statement inside a DSSE envelope.
- isolation tier
- How strong the wall around a run is, reported as one of four levels, weakest first: process, container, kernel, vm; the disabled provider reports none, and a provider that has not yet checked its runtime reports unknown. More: What actually runs your container ↑
- Kata Containers
- An open-source container runtime that starts a small virtual machine, with its own kernel, for each sandbox, so the processor's virtualization features keep sandboxes apart. More: What actually runs your container ↑
- kernel
- The core part of the operating system that talks to the hardware and does every file, network and memory operation on every program's behalf. More: What actually runs your container ↑
- load line
- The mark painted on a ship's hull showing how low it may safely sit in the water, where anyone can check it; plimsoll is named after it.
- manifest
- A file that lists what something contains, such as the files in a release or the layers of a container image.
- MCP
- Model Context Protocol: the open standard an AI application uses to offer tools, such as a run-code tool, to a language model.
- microVM
- A small virtual machine with its own kernel, started for one run and destroyed after it.
- mint
- To create a fresh credential for one run, ideally short-lived and limited to that run's routes, so a stolen copy is soon useless.
- module run
- Running a compiled simulator that is baked into a docker image, once for each row of a table of parameters.
- namespace
- A Linux kernel feature that controls what a program can see: its own files, its own process list, its own network. More: What actually runs your container ↑
- nested virtualization
- Running a virtual machine inside another virtual machine; not every cloud server allows it.
- noexec
- A mount option that stops the kernel from running any program stored on that filesystem.
- nosuid
- A mount option that stops a program on that filesystem from gaining extra privileges through its set-user-ID bit.
- OCI runtime
- The program Docker hands a container to, which builds the walls around it, such as runc (the default), runsc (gVisor) or Kata Containers; OCI, the Open Container Initiative, wrote the standard it follows, so one can replace another without changing the image. More: What actually runs your container ↑
- OpenShell
- NVIDIA OpenShell, an agent sandbox runtime whose gateway server creates and deletes sandboxes on request; the openshell provider asks a gateway for one sandbox per run, or one per session.
- physics oracle
- The example that tests an agent-written controller by running it against a simulated cart-pole inside the sandbox and fingerprinting what happens.
- pinned
- Fixed to one exact version, usually by digest, so it changes only when someone edits the pin.
- preflight
- The configuration check a provider runs at startup and on each readiness poll: for docker it confirms the images and the runtime exist; for openshell it asks the gateway which driver it runs; for e2b and dockercloud it checks settings only.
- principal
- The authenticated identity a request comes from; in plimsolld, the caller id listed in the clients file, or static for the one caller of a shared PLIMSOLL_TOKEN.
- process
- One running program, with its own memory and its own permissions.
- prompt injection
- Instructions hidden in data, such as a tool's output, written so that a model reading the data follows them.
- protobuf
- Protocol Buffers: Google's schema-defined binary format for messages, which plimsoll uses for its RPC requests and responses.
- protocol number
- A number every request carries to name the protocol version it speaks; a daemon serving a different version refuses the request before reading it, rather than running it without fields it does not know.
- provenance
- A record of where an artifact came from and how it was built, kept so that someone else can check it.
- provider
- The backend that actually runs the code; each daemon uses exactly one: wasm, docker, e2b, dockercloud, openshell, or disabled, which runs nothing and is what an unset SANDBOX_PROVIDER selects.
- QuickJS
- A small JavaScript engine; plimsoll embeds a build of it, compiled to WebAssembly, for its wasm provider.
- RPC
- Remote procedure call: one program sending a request to another over the network and getting an answer back.
- run record
- The statement plimsolld attaches to every answered run: SHA-256 digests of the request and the result, the isolation evidence, and the start and end times; the official Go, Python and TypeScript clients recompute the digests and reject a mismatch.
- runc
- Docker's default container runtime, and usually Kubernetes's too, which separates containers with the kernel's namespaces and cgroups while they all share the host's kernel. More: What actually runs your container ↑
- runsc
- gVisor's container runtime: the program docker calls instead of runc to start a container under gVisor. More: What actually runs your container ↑
- RuntimeClass
- The Kubernetes setting that chooses which container runtime, such as gVisor's runsc, runs a pod.
- sandbox
- A place where code runs with something stopping it from reaching the rest of the machine.
- seccomp
- A Linux kernel feature that limits which system calls a process may make; plimsoll ships a profile listing the calls its containers may use.
- session
- One sandbox kept open for many calls: the files a call writes are there for the next, a cleanup between calls ends what a call left running, and an interpreter kept for cells can carry its state from one call to the next.
- shed
- To refuse extra work at once, instead of queueing it, when a limit is reached.
- side channel
- A way to learn about another program through how long or how hard something works, such as shared CPU caches, rather than through any permission.
- supply chain
- Everything outside your own code that ends up in what you run: dependencies, base images, build tools, and the people and servers that publish them.
- syscall
- A request from a program to the operating-system kernel, such as opening a file, starting a process or opening a network connection.
- TCB
- Trusted computing base: the code that has to be correct for a security promise to hold, so a bug anywhere in it can break the promise.
- threat model
- The list of attackers and attacks a system is designed to hold out against.
- tick
- One fixed time step of a simulation; the cart-pole examples take 10 ms per tick, so 100 ticks make one simulated second.
- tmpfs
- A filesystem held in memory, with a size limit set when it is mounted; its contents disappear when the container stops.
- token bucket
- A rate limit that allows short bursts: each caller's allowance refills at a steady rate and each run spends one unit of it.
- trajectory
- The full record of a simulation run: every state at every tick, in order.
- Trigger.dev
- A hosted job runner for TypeScript whose durable chat agents can sleep between messages; the trigger-chat example gives one an executeCode tool backed by plimsoll.
- virtual machine
- A complete computer simulated in software, with its own kernel, kept apart from other virtual machines by the processor's virtualization features. More: What actually runs your container ↑
- wazero
- A WebAssembly runtime written in pure Go; plimsoll uses it to run QuickJS inside the daemon with a hard memory cap.
- WebAssembly
- A portable bytecode format that runs inside a host program, which decides everything the code can reach: no files, network or system calls unless the host provides them.