Pluggable, Secure Runtimes

To maintain system security, rescile requires execution isolation using specific runtimes. The engine parameter dictates the isolation boundary:

1. wasi (WebAssembly): Modules compile logic to .wasm. Executed using wasmtime with zero external dependencies, providing strong isolation and high performance.
2. nix (Nix Flakes): Spawns an execution boundary wrapped in a nix develop shell for highly reproducible environments without polluting the host OS or requiring pre-installed tooling.
3. container (Docker/Podman): Spawns an ephemeral container, mounts required outputs, streams logs, and destroys the container when finished. Ideal for legacy tooling like Terraform or Ansible.
4. http: Securely triggers existing CI/CD pipelines using signed webhook payloads, or executes multi-step REST/GraphQL API chains directly from the core.
5. system (Operating System): Executes a command on the operating system with the user of the rescile-runner process.

Platform Constraints: Some runtimes depend on the underlying architecture and operating system. The runtime block evaluates declarative platform constraints against the host system, emitting a warning if the action cannot be executed locally.

Execution via rescile-runner

The rescile-runner component is responsible for securely executing the generated action bundles. It is compiled as a standalone binary designed to reduce the blast radius. Depending on your network and security requirements, actions support four distinct modes of execution:

1. Air-Gapped (Manual): You download the fully packaged artifact (bundle.tar.gz) directly from the Rescile UI. This bundle contains the executable, context data, injected secrets, and a manifest.json. You then manually transfer this bundle to an air-gapped machine and execute it locally using the runner (rescile-ce runner ./bundle.tar.gz).
2. Webhook (Fetch/Watch): External systems can pull the action payload and execute it independently by invoking the rescile-runner CLI with the Controller API URL. Optionally, the runner can act as a background daemon (rescile-ce runner --watch <URL>) that automatically re-executes when changes are detected via WebSocket subscription.
3. Agent (Push): Autonomous Agent runners connect outward to the Controller via a persistent gRPC multiplexed stream. When an action is placed in the queue, the Controller instantly pushes the payload to a matching agent, making it ideal for crossing NAT boundaries and executing workloads inside isolated VPCs.