Odinforge

Execution infrastructure · private beta

Ship what your agents write. Not the blast radius.

Odinforge runs untrusted, agent-generated code inside hardware-isolated microVMs — with per-call policy, egress allowlists, brokered secrets and replayable syscall traces. One call, isolated by default.

Request access See the runtime v0.4 control plane

The problem

Most new code in 2026 is written by an agent. Most of it is executed on the same host that holds the credentials. The gap between “it runs” and “it is safe to run” is now the release blocker.

  1. Route the execution

    A single HTTP or gRPC call hands us the program, inputs and a policy object. Cold start in under 120 ms; warm pools keep it at 9 ms.

  2. Isolate the unit

    Each run gets its own Firecracker microVM: own kernel, own network namespace, no shared filesystem, no ambient credentials. Nothing persists between runs unless you ask it to.

  3. Constrain and observe

    Syscalls, DNS and outbound traffic are filtered against the policy. Every file write, connect and exec is recorded as a replayable trace with a diff view.

Interface

No SDK lock-in. The runtime is a request — anything that can open a socket can use it.

# one call, one isolated unit
curl https://api.odinforge.tech/v1/run \
  -H "authorization: Bearer $ODINFORGE_KEY" \
  -d '{
    "image": "python:3.12-slim",
    "cmd":   ["python", "-c", "print(1+1)"],
    "policy": {
      "egress": ["pypi.org:443"],
      "cpu_ms": 2000,
      "mem_mb": 512,
      "trace":  "full"
    }
  }'

→ 200 { "exit": 0, "stdout": "2\n",
       "vm_id": "vm_8f31c2", "trace_id": "tr_91ba07" }

Specs

Isolation
Firecracker microVM, dedicated kernel per run
Cold start
≤ 120 ms; 9 ms from a warm pool
Egress
Default-deny, per-run allowlist with TLS inspection
Secrets
Brokered at the syscall boundary; never in the VM image
Traces
Syscall + network + fs, replayable, exportable as JSONL
Quotas
Per-tenant CPU, memory and wall-clock ceilings
Control plane
Rust, gRPC, region-pinned scheduling
Data
Ephemeral by default; zero retention on request