[!NOTE] This README was generated by SKILL, get the ZH version from here.

SECURE MULTI-LANGUAGE FAAS WITH SANDBOXED EXECUTION

A Go FaaS platform with Bubblewrap sandboxing, Redis script versioning, and SSE streaming

Table of Contents

• Features
• Architecture
• License
• Author

Features

go install github.com/pardnchiu/go-faas/cmd/api@latest · Documentation

• Bubblewrap Sandbox Isolation — User code runs under bwrap with namespaces, dropped capabilities, and no host or outbound network access.
• Multi-Language Versioned Scripts — Upload Python, JavaScript, or TypeScript to Redis with timestamp versions and run latest or a specific revision.
• Systemd Slice Resource Caps — Each sandbox is launched via systemd-run under a slice that enforces CPU quota and memory ceilings.
• SSE Streaming Execution — Stream intermediate logs and final results over Server-Sent Events for long-running or progressive scripts.
• Immediate Run-Now Mode — Execute ad-hoc code without storing it, for quick trials and one-shot jobs.

Architecture

Full Architecture

graph TB
    Client[HTTP Client] -->|POST /upload| Upload[Upload Handler]
    Client -->|POST /run/*path| Run[Run Handler]
    Client -->|POST /run-now| RunNow[RunNow Handler]
    Upload --> Redis[(Redis)]
    Run --> Redis
    Run --> Sandbox[Sandbox]
    RunNow --> Sandbox
    Sandbox --> Response[JSON / SSE]
    Response --> Client

License

This project is licensed under the GNU Affero General Public License v3.0.

Author

邱敬幃 Pardn Chiu

hi@pardn.io
https://www.linkedin.com/in/pardnchiu

©️ 2025 邱敬幃 Pardn Chiu