Every app instance, handler, sandbox, and GitHub Actions runner runs in a hardware-isolated VM with its own Linux kernel. Container images package the workload; the VM is the isolation boundary. Workloads do not share the host kernel.

VM boundary

An instance's memory and writable root are private to its VM and disappear with the instance. Only explicit persistent state survives: /shared.db, /shared/, or a persistent volume.

Sandboxes and CI runners are destroyed after one run or job. App instances restore from immutable deploy snapshots and keep changes in private copy-on-write layers.

network boundary

Apps join an account-scoped private network. Other accounts cannot initiate connections to it. Compose ports publishes a service through Kedge's HTTPS edge; expose remains private.

Public endpoints terminate TLS automatically. Cross-region private traffic uses the encrypted fleet mesh. Sandboxes have outbound access by default; kedge eval -no-network and kedge sandbox -no-network leave only loopback. Anonymous sandboxes are always networkless.

See network & domains for ingress and private addressing.

access and secrets

SSH keys authenticate CLI and Git operations. GitHub authenticates the web console; named bearer tokens authenticate the REST API. App, repository, data, and runtime operations enforce the owning account.

An app authentication policy protects any static site, HTML app, handler, or service at ingress and passes verified identity to the workload.

Keep secrets out of source with kedge env or Compose secrets. Generated secrets are stored outside Git and mounted under /run/secrets; see secrets and configs.

Report security issues to support@kedge.dev.