mirror of
https://github.com/hanzoai/runtime.git
synced 2026-10-30 18:23:13 +00:00
zeekayandHanzo Dev
a386271c80
Every sandbox was created privileged under the daemon's default runtime, and the setting that would have changed it defaulted to an empty string that silently meant runc. For a service whose whole premise is running code somebody else wrote, that is not a boundary. An org sets its isolation and the create request carries it, so a sandbox records what it was made with: changing the policy moves new sandboxes and leaves running ones alone. gvisor is the default. firecracker is delivered through kata's shim, which is why it is one name rather than two. runc is refused unless the runner names that org, and an empty list names nobody. Absent means the default, unknown is a refusal, and a runtime the daemon does not have is a refusal. Nothing substitutes quietly. The runner took an organization in a field called UserId with a note beside it saying so. Deciding who may have runc through a field named after something else is not reviewable. Privileged is replaced by dropping everything and granting the eight the daemon uses. Nothing the sandbox does broke; what stopped working is mount, mknod, raw sockets, chroot, writing to proc, and seeing the host's disks. AUDIT_WRITE is among them because without it sudo works and complains every time. The creation histogram's lowest bucket was a tenth of a second, so the metric could not observe the claim the product makes about its own speed. It can now, and it carries the isolation, so comparing them is a query. Co-authored-by: Hanzo Dev <[email protected]>
Hanzo Runtime
AI Generated Code Execution Runtime
Secure, Fast, and Scalable Infrastructure for
AI-Generated Code Execution.
Documentation · Report Bug · Request Feature · Visit Hanzo AI
Installation
Python SDK
pip install hanzo-runtime
TypeScript SDK
npm install @hanzo/runtime
Features
- Lightning-Fast Infrastructure: Sub-90ms Sandbox creation from code to execution.
- Separated & Isolated Runtime: Execute AI-generated code with zero risk to your infrastructure.
- Massive Parallelization for Concurrent AI Workflows: Fork Sandbox filesystem and memory state (Coming soon!)
- Programmatic Control: File, Git, LSP, and Execute API
- Unlimited Persistence: Your Sandboxes can live forever
- OCI/Docker Compatibility: Use any OCI/Docker image to create a Sandbox
Quick Start
- Create an account at https://hanzo.ai
- Generate a new API key from your dashboard
- Start using the Hanzo Runtime SDK
Creating your first Sandbox
Python SDK
from hanzo_runtime import HanzoRuntime, HanzoRuntimeConfig, CreateSandboxParams
# Initialize the Hanzo Runtime client
runtime = HanzoRuntime(HanzoRuntimeConfig(api_key="YOUR_API_KEY"))
# Create the Sandbox instance
sandbox = runtime.create(CreateSandboxParams(language="python"))
# Run code securely inside the Sandbox
response = sandbox.process.code_run('print("Sum of 3 and 4 is " + str(3 + 4))')
if response.exit_code != 0:
print(f"Error running code: {response.exit_code} {response.result}")
else:
print(response.result)
# Clean up the Sandbox
runtime.remove(sandbox)
Typescript SDK
import { HanzoRuntime } from '@hanzo/runtime'
async function main() {
// Initialize the Hanzo Runtime client
const runtime = new HanzoRuntime({
apiKey: 'YOUR_API_KEY',
})
let sandbox
try {
// Create the Sandbox instance
sandbox = await runtime.create({
language: 'python',
})
// Run code securely inside the Sandbox
const response = await sandbox.process.codeRun('print("Sum of 3 and 4 is " + str(3 + 4))')
if (response.exitCode !== 0) {
console.error('Error running code:', response.exitCode, response.result)
} else {
console.log(response.result)
}
} catch (error) {
console.error('Sandbox flow error:', error)
} finally {
if (sandbox) await runtime.remove(sandbox)
}
}
main().catch(console.error)
Contributing
Hanzo Runtime is Open Source under the GNU AFFERO GENERAL PUBLIC LICENSE. If you would like to contribute to the software, read the Developer Certificate of Origin Version 1.1 (https://developercertificate.org/). Afterwards, navigate to the contributing guide to get started.