EPHEM0RA CELL · SHIPS TODAY
Explicit capabilities.
Hard resource limits.
Ephemeral execution.
one direction · no arrow points back
WHAT IT IS
Cell runs code you did not write: a script a model generated, a tool call, a plugin a customer brought. It gets only the access you name, it stops at the ceilings you set, and the sandbox is destroyed when the run ends. All of it happens on your machine — no cloud account, no API key in the loop.
It is an execution primitive, not an LLM, not an agent framework and not a general VM.
TECHNICAL DETAIL · HOW THE BOUNDARY WORKS
WebAssembly and WASI on wasmtime, on the Preview1 and the 0.2 interface. Capabilities are resolved before the first instruction runs, and the fuel, memory, epoch and host-I/O budgets hold during it, with no switch the guest can turn. The guest runs inside your own process; run_isolated() puts a module from outside your build into one disposable worker behind OS-level limits.
A run that outlives its wall-clock budget (30 s by default) stops on the engine's epoch interruption and returns timeout; the isolated path grants the worker a parent-side process kill on top. Running out of fuel returns fuel_exhausted, an over-cap heap returns memory_exceeded, host work past the I/O budget returns io_budget_exceeded. In all four cases the sandbox is destroyed and the record written, and how a run ended is one of its fields.
$ ephemora-cell run tool.wasm --profile llm
✓policydeny-by-default
✓networkblocked
✓filesystemno preopens
✓fuel2,000,000 units
✓memory128 MiB cap
✓timeout30 s, set by the caller
✓recordsign-ready
exit 0 · sandbox destroyed
REPRODUCIBLE PERFORMANCE
0.33–0.34 ms of boundary per execution, wall time minus guest time.
0.485 ms mean for a cold Cell invocation in this committed workload, against 185.9 ms mean for Docker.
About 3M executions per hour per core in this sample.
Source: benchmarks/results · conditions and commands are committed in the repository
CONTEXT, NOT A SLOGAN
Three boundaries, three different questions.
Boundary Application packaging. The wall sits at the container edge, and the host kernel stays underneath every container on that machine.
Best for Images you build once and run as they are, with the tooling around them intact.
Trade-off The shared kernel surface. Cold start for python:3.12-slim measured 185.9 ms mean in the committed run.
Boundary A user-space kernel between container and host, so the workload reaches the real kernel through a smaller surface.
Best for Linux workloads that need container semantics and stronger container isolation around them.
Trade-off Application compatibility and syscall overhead. Our eight intents through runsc release-20260914.0 stayed available to the guest, 8 of 8 as the expectation matrix had it: execve, fork, sockets, threads, symlinks. The host is walled off, the Linux ABI is not, and that is not a ranking.
Boundary Bounded WASM execution. The capabilities are named before the run and the budgets hold while it runs.
Best for Code you did not write, arriving as a module or a component, inside your own process.
Trade-off WASM only: no arbitrary binary and no Linux ABI. The budgets are not free, 0.33–0.34 ms of boundary per execution and 0.485 ms mean for a cold invocation in that same sample.
Different boundaries solve different problems.
SECURITY AND CONFORMANCE EVIDENCE
The repository replays real MCP CVE paths, runs official suites and commits the raw evidence. Conformance is not a security certification; the scope stays visible.
Reproduce: conformance/ · MCP CVE replay · threat model
THE LIMITS ARE PART OF THE PRODUCT
Cell is not a general VM, container orchestrator, malware detector or complete multi-tenant platform. It is a focused execution and evidence layer.
START WITH THE PUBLIC LAYER
Install Cell, inspect the code, run the benchmarks and bring us the workload you want to make temporary.
← drag, scroll or use arrow keys →