plimsoll trainer · 00 / start here

Plain English

The idea behind every other page, for a reader who assumes nothing. Underneath all of them is one question: if a stranger's code turns out to be malicious, how many walls stand between it and your stuff? Start with the picture.

How many walls

Untrusted code has to run somewhere. Move it, and watch what stands between it and the things you care about. The captions say what happens if the wall has a bug, because no wall is perfect and that is the only honest way to compare them.

Where does the stranger's code run?

YOUR MACHINE YOUR PROGRAM · plimsoll runs inside it SEALED ENGINE stranger's code your memory, your files, your permissions are one thin seal away no operating-system wall at all YOUR MACHINE YOUR PROGRAM plimsoll, your files, your permissions THE BOX (a container) stranger's code THE MACHINE'S CORE (operating system), shared by both YOUR MACHINE YOUR PROGRAM plimsoll, your files, your permissions THE BOX (a container) STAND-IN CORE (gVisor) stranger's code THE MACHINE'S CORE: the box never touches it directly YOUR MACHINE YOUR PROGRAM plimsoll sends the code away and waits for the answer nothing of yours is in the same building SOMEBODY ELSE'S CLOUD A THROWAWAY COMPUTER walled off by the hardware itself stranger's code used once, then destroyed

There is no single safest choice. Each step to the right buys a thicker wall and costs you speed, setup, and (for the cloud computer) money per run. The right door is the weakest wall you can live with for the code in front of you, not the strongest one that exists. The rest of this page only explains the words hiding in that sentence.

One sentence, two ways

Here is what plimsoll is, written the way the other pages write it. Flip it to plain words, or tap any underlined term for what it means and why you would care. Every other term the docs use has a one-sentence entry in the glossary (INTERNAL · trainer site →).

What happens to one piece of code

The whole trip, in five steps and no internals. The Concepts and Architecture pages walk the same trip with the real names for each gate.

  1. You hand over some code, and a time limit.You never bundle a password or an API key with it. If the code needs to reach one of your services, that permission travels a separate path and the code never sees the key.
  2. A bouncer checks you before anything runs.Are you allowed in, and is the request a sensible size? A bad request is turned away here, before a single line of your code is looked at.
  3. It picks the door you configured.Inside your program, a box on your machine, or a throwaway computer in the cloud. This is the moment the walls go up. If you asked for a thicker wall than the door has, the code is turned away instead.
  4. The code runs behind the wall.It does its thing, fenced in. If it tries something nasty, the wall is what stops it reaching the rest of your machine.
  5. You get the result, plus a receipt.What the code printed, whether it succeeded, and a note saying exactly which wall ran it, so you are never asked to take that on faith. Your code itself is never written to any log.

Which door for which job

Pick the job. A door lights up when the job calls for one. The last job, reading your API, does not depend on the door: any door can use the broker, the part of plimsoll that makes the API call for the code, so the code never holds your key.

Inside your programthe real name: wasm

Wall
Thin: a sealed engine, no operating-system wall.
Speed
Instant. Nothing to start.
Can run
One JavaScript snippet. No files, no build tools.
If the wall cracks
The code is inside your program.

A box on your machinethe real name: docker

Wall
Solid. For a second wall, add the stand-in core, gVisor: it answers the code's requests to the operating system itself, so the real core is never touched directly.
Speed
Quick. A box starts in well under a second.
Can run
Snippets, whole projects, and compiled simulators.
If the wall cracks
Stuck in the box. Still your machine.

A throwaway computerthe real names: e2b, dockercloud

Wall
Strongest: a separate computer, walled by hardware.
Speed
Slowest. A computer has to boot, and each run costs money.
Can run
Snippets and whole projects.
If the wall cracks
Trapped in a disposable machine that is not yours.

Keep reading