interactive field guide
Learn the boundary, then trust the signal.
Sixteen compact trainers turn coderunner's security model and product shape into decisions you can make. Change configurations, trace requests, design integrations, compare Docker's agent products, and test deployment gates without running untrusted code. The final three go deeper on the shared API broker, its shipped metadata-only advisor, and the capacity endpoint that makes backpressure recover early.
Learn the system
Plain English
Brand new? Decode every scary word (WASM, container, gVisor, VM, RPC) and learn the one idea behind all of them: how many walls stand between untrusted code and your stuff.
Concepts
Choose providers, compare isolation tiers, distinguish guest failures from infrastructure errors, and tune admission capacity.
Architecture
Walk a request from caller to provider, see where authority is resolved, and separate static description from live readiness.
Providers
Choose WASM, Docker/runc, Docker/runsc, or E2B from the boundary and operation you actually require.
Capabilities
Follow named profiles, route allowlists, per-run tokens, caller ACLs, and the shared broker behind Docker and WASM JavaScript grants.
Operations
Configure resource envelopes, size admission, interpret probes, and assemble launch evidence.
Dependencies
Map the small Go dependency graph, provider-specific runtimes, baked toolchains, and the checks required before an upgrade lands.
Build with it
Integrations
Embed a local provider or use the official remote client without losing validation, capability, or isolation semantics.
Agent products
Design a bounded run_code surface with tenant identity, strict envelopes, quotas, and useful failure UX.
Discoverable tools
Stop clients guessing: give every tool an outputSchema and honest annotations, type the injected sandbox globals, serve the contract at runtime, and gate it with a drift test.
Customer examples
Apply concrete recipes for SaaS code mode, analytics, approved automation, project evaluation, and private deployment.
Docker + agents
Compare Docker Offload, Sandboxes, and MCP Gateway with coderunner and Gatescribe—and decide what “human authorized” should mean at 2 AM.
Buying & pricing
Choose a proposed plan, estimate a workload, and see the commercial gates required before these prices become real.
Broker deep dives
The API Broker
How agent code reaches your API without ever holding the key, how Docker and WASM use one shared guard through different transports, and why E2B remains the hard case.
Efficiency Advisor
See how the shipped advisor analyzes bounded broker metadata after a run, routes a fix to the agent or operator, and never changes execution.
The capacity endpoint
See how a cheap readiness or capacity read lets the broker shed calls under upstream overload, detect recovery early, and wire the probe from OpenAPI.
How to use these: open any page directly or serve this directory as static files. Progress stays in your browser. The lessons have no build step, analytics, or third-party JavaScript. Only the pricing trainer contains optional links to cited market sources.