Pluggable, Secure Runtimes

To maintain system security, rescile requires execution isolation using specific runtimes. The engine parameter dictates the isolation boundary:

1. wasi (WebAssembly): Modules compile logic to .wasm. Executed using wasmtime with zero external dependencies, providing strong isolation and high performance.
2. nix (Nix Flakes): Spawns an execution boundary wrapped in a nix develop shell for highly reproducible environments without polluting the host OS or requiring pre-installed tooling.
3. nix-shell: Runs commands inside a nix-shell environment defined by a shell.nix file.
4. container (Docker/Podman): Spawns an ephemeral container, mounts required outputs, streams logs, and destroys the container when finished. Ideal for legacy tooling like Terraform or Ansible.
5. http: Securely triggers existing CI/CD pipelines using signed webhook payloads, or executes multi-step REST/GraphQL API chains directly from the core.
6. system (Operating System): Executes a command directly on the runner host with the privileges of the rescile-runner process. This engine relies on tools already installed on the runner (for example, ansible-playbook, ssh, or cloud CLIs) and does not provide isolation by itself.

Runner engine support: The rescile-ce runner natively supports system, nix, and nix-shell. Other engines, such as container or wasi, require a runner implementation that explicitly supports them.

Platform Constraints: Some runtimes depend on the underlying architecture and operating system. The runtime block evaluates declarative platform constraints against the host system, emitting a warning if the action cannot be executed locally.

Execution via rescile-runner

The rescile-runner component is responsible for securely executing the generated action bundles. It is compiled as a standalone binary designed to reduce the blast radius. Depending on your network and security requirements, actions support four distinct modes of execution:

1. Air-Gapped (Manual): You download the fully packaged artifact (bundle.tar.gz) directly from the Rescile UI. This bundle contains the executable, context data, injected secrets, and a manifest.json. You then manually transfer this bundle to an air-gapped machine and execute it locally using the runner (rescile-ce runner ./bundle.tar.gz).
2. Webhook (Fetch/Watch): External systems can pull the action payload and execute it independently by invoking the rescile-runner CLI with the Controller API URL. Optionally, the runner can act as a background daemon (rescile-ce runner --watch <URL>) that automatically re-executes when changes are detected via WebSocket subscription.
3. Agent (Push): Autonomous Agent runners connect outward to the Controller via a persistent gRPC multiplexed stream. When an action is placed in the queue, the Controller instantly pushes the payload to a matching agent, making it ideal for crossing NAT boundaries and executing workloads inside isolated VPCs.