self-managed evaluation · 10 minutes

Start with a smoke.
Then choose your wall.

This path runs a local process-tier smoke against the checked-in WASM provider. It proves the request and result shape, not hostile-production isolation. For customer-authored code in production, use verified Docker/runsc kernel evidence or the E2B VM provider.

1. Build and start the local smoke

From the repository root, build the module and start the daemon in explicitly acknowledged development mode. The default provider is disabled; nothing executes until you opt in.

go build ./...

SANDBOX_PROVIDER=wasm \
CODERUNNER_INSECURE=1 \
go run ./cmd/coderunnerd

2. Run one bounded snippet

In a second terminal, send a versioned request. The response includes the exit status, output, duration, provider, and actual isolation tier.

curl -sS \
  http://127.0.0.1:8746/coderunner.v1.SandboxService/RunJavaScriptV2 \
  -H 'Content-Type: application/json' \
  --data-binary '{"code":"console.log(6 * 7)","timeoutMs":1000,"minimumIsolation":"process"}'

3. Read the receipt

Expect a successful guest result with stdout containing 42 and an isolation value of process. A non-zero guest exit code is a normal run result; a typed RPC error means the request was rejected or infrastructure failed.

This smoke uses WASM in the coderunnerd process. It is useful for learning the API, but it is not an operating-system or VM boundary.