Skip to content

Untrusted code

Try code you haven't read, nowhere near your laptop.

Cloning a repo and running its install runs the author's scripts with your user's permissions. pyrovue runs it in a disposable cloud box instead: it can install, start and serve, but it can't see your files, your keys or your network.

The problem

What `npm install` can reach on a laptop.

Install hooks are ordinary programs. An npm postinstall script, a Python setup.py, a Makefile target or a line in a README you paste into a terminal all run as you, with whatever you can read: ~/.ssh, cloud credentials in ~/.aws and ~/.config, tokens in your shell's environment, browser profiles, and every machine on your home or office network.

Most repos are fine. The trouble is that you can't tell which ones aren't without reading them first, and reading a dependency tree of a few hundred packages isn't something anyone does before trying a project.

What a box keeps out

A container with nothing of yours in it.

Your files and keysnothing mounted
A box holds the repository and the tools to run it. None of your files, keys or tokens are in it unless you type them in.
Your networkprivate ranges blocked
Boxes can reach the internet to install packages, but traffic to private address ranges and to the cloud metadata endpoint is rejected.
Resources2 vCPU · 4 GB · 2,048 processes
CPU, memory and process limits per box, so a runaway install or a fork bomb hits its own ceiling.
Privilegesno-new-privileges
Processes can't gain privileges through setuid binaries, several kernel capabilities are dropped, and the Docker socket is never mounted.
Lifetimedisposable
A box sleeps when nobody is watching and is deleted after a day on the free plan. Rebuild it to start from a clean checkout.
Watchedevery 2 minutes
A watchdog stops boxes that run cryptocurrency miners, talk to mining pools or write past their disk limit.

The limits

What a box doesn't protect you from.

Boxes are containers on the standard runtime, which shares the host's kernel. That's a strong boundary for everyday code and a weaker one than a virtual machine; moving boxes to gVisor, a user-space kernel, is planned. The security page lists this and everything else that isn't done yet.

A box can reach the internet, because installs need it. Code in the box can send anything it can read to anywhere, so don't paste real credentials into a box running code you don't trust. And a box is a place to try code, not a malware lab: if you think a repo is malicious, report it to GitHub instead.

Questions

Asked often.

It's far safer than running it on your laptop, because the code never touches your files, keys or network. It isn't a guarantee: read the limits above, and keep real secrets out of boxes you don't trust.

No. Boxes sit on their own network, traffic between them is turned off, and each one is served from its own address.

You can add keys to a box's .env from the browser. They travel to the box without passing through a command line or a log, and viewers of a shared box never see them. Use a key you can revoke.

Only when Claude sets up a repo the detector can't, and then the file list, key files and command output go to Anthropic's API. Detector setups and saved recipes send nothing to a model provider.

Run the repo you bookmarked and never tried.

Hobby is free and needs no card. Paste a link and your first box is up in about a minute.

See plans