Execution infrastructure
2026
Rookhold
Run code. Set limits. Keep the evidence.
About the project
I built Rookhold to run short scripts with resource limits, live output, and a verifiable record of the result.
Put a boundary around each job
A short script can still consume too much memory, read files, or keep running indefinitely. I built Rookhold around that problem: give generated code, user-defined transforms, and evaluators a separate execution path, with the server setting limits on time, memory, processes, files, and output.
Keep the job history together
I use one Rust service for scoped authentication, a bounded queue, fair scheduling, execution, and durable results. Python, Node, and Bash jobs share an API for live output and cancellation across the CLI, SDKs, MCP adapter, and dashboard. SQLite keeps the job state and ordered events, so a disconnected client can catch up without losing its place.
Make the result checkable
A completed job records the controls the executor actually observed. Its receipt can be bound to a signed DSSE/in-toto statement using Ed25519. I included an offline verifier to check the exact bytes. Saving the result and signing it are separate steps, with a durable outbox letting a restarted service finish pending attestation work.
Keep execution narrowly scoped
I kept the released system focused on short, stateless jobs on one node. That leaves persistent workspaces, interactive terminals, and multi-node scheduling outside its scope. Guarded execution requires Linux x86_64, gVisor, and the documented host setup. The local development mode has no isolation boundary.
Next project
