laverdet/isolated-vm
Isolated Vm
Isolated-vm is a library for creating secure, memory-isolated JavaScript execution environments within Node.js. It functions as a manager for the underlying engine, allowing developers to instantiate multiple independent execution contexts that share no memory or global state. This architecture is designed to support the execution of untrusted third-party code while preventing interference with the main application process.
The project distinguishes itself by enforcing strict resource constraints, including memory limits and CPU execution timeouts, to ensure host system stability. It provides a secure interface for integrating compiled native modules and enables controlled communication between isolated environments through structured data cloning and pointer-based references. These mechanisms allow for the development of multi-tenant systems and extensible plugin architectures where code must operate within defined boundaries.
Beyond core isolation, the library includes tools for monitoring the health and efficiency of sandboxed scripts. It provides capabilities for tracking heap statistics to prevent memory leaks and includes CPU profiling utilities to identify performance bottlenecks within specific execution contexts. The project is distributed as a Node.js module, providing a programmatic interface for managing the full lifecycle of isolated environments.
Features
- V8 Engine Integrations - Embeds the V8 engine to create multiple independent, memory-isolated execution contexts.
- Resource-Constrained Runtimes - Optimizes JavaScript execution contexts for minimal memory footprints and deterministic resource usage.
- Code Execution Sandboxes - Executes untrusted third-party scripts in secure, isolated sandboxes to prevent unauthorized system access.
- JavaScript Sandboxed Runtimes - Provides a library for creating secure, memory-isolated JavaScript execution environments within Node.js.
- Memory-Isolated Runtimes - Executes scripts in isolated memory spaces to prevent interference with the main application process.
- V8 Resource Caps - Wraps the V8 engine to manage separate execution contexts with strict memory and CPU limits.
- Execution Resource Constraints - Enforces strict memory and CPU limits on execution instances to ensure host system stability.
- Native Module Definitions - Integrates compiled native modules into isolated environments while maintaining context-awareness and thread safety.
- JavaScript Bytecode Pre-compilation - Provides pre-compilation of JavaScript into bytecode to enhance execution speed within isolated environments.
- Plugin Extension Architectures - Builds extensible plugin systems that maintain strict security boundaries between host and extensions.
- Native C-JavaScript Bridges - Exposes native C++ functions to isolated JavaScript environments through a secure, thread-safe interface.
- Sandbox Lifecycle Controls - Manages the full lifecycle of sandboxed execution contexts from instantiation to disposal.
- Multi-Tenant Application Foundations - Provides architectural primitives for isolating users and plugins within separate memory spaces.
- Secure Isolation Layers - Enables controlled communication between isolated environments through secure data transfer and references.
- Heap Memory Monitoring - Tracks heap statistics and enforces memory limits to ensure stability in long-running execution processes.
Star history
How this analysis was created: This summary and feature list are AI-generated from collected project material and can contain mistakes. Stars, license and language are imported from GitHub. Inclusion does not mean that we have tested or audited this project. Check the source documentation for any feature you depend on. Learn more on our About page.
