Run untrusted code.
Govern every byte it sends.

zeroness is a capability and identity mesh for Cloudflare Sandboxes. Code starts with zero network and zero secrets. You allow exactly what it needs with createGovernedSandbox, identity is injected at egress, and every crossing is logged.

Get zeroness on GitHub Quickstart

secrets in the box

Credentials live in the Broker and are injected at egress. Dump the filesystem and you get nothing reusable.

1 line

to jail the network

createGovernedSandbox gives the container no direct internet and routes every request through the Broker.

100%

of egress audited

Every crossing is allowed, denied, or gated, and recorded with the identity that was used.

A control plane for code you did not write.

AI agents and user-submitted code need real compute. zeroness gives it to them without giving away your network or your keys.

Default-deny egress jail

The container has no direct internet. All outbound HTTPS is intercepted at the network layer, so even a raw curl is mediated. Allow only the hosts, methods, and paths you name.

No secrets in the box

Credentials live in the Broker. Short-lived, audience-bound identity is injected at the moment of egress. The sandbox never holds a reusable key.

Capability-scoped resources

R2, D1, KV, queue, and secrets are opaque cap: handles. Code reads and writes by handle and can never enumerate or forge a binding. Read-only means read-only: a D1 handle marked ro rejects writes, CTE-fed writes, and mutating PRAGMAs.

Human-in-the-loop

Mark a rule ask and the request pauses for approval before it proceeds. Grants are scoped to the request and expire.

Signed command channel

Every command to the in-sandbox agent is Ed25519-signed with body hash, freshness, and replay protection, then verified before it runs.

Audit that plugs into your stack

Every verdict, resource access, and command is recorded by the Broker and emitted to Cloudflare Workers Logs (7-day retention, queryable). One flag ships it via Logpush to R2, S3, Splunk, or Datadog.

Rate-limited by default

A per-session token bucket at the Broker caps how fast a sandbox can drive egress and capability ops, returning 429 on abuse. Tune the burst and rate, or disable it, per deployment.

What you build on top.

The same move every time: start the untrusted process with nothing, grant the minimum, keep the secret out of the box, log the boundary.

AI coding agents that ship PRs

The agent installs deps, runs tests, and opens a pull request. It reaches only the registry and one repo; the GitHub token never enters the box. A poisoned dependency learns nothing and pushes nowhere.

Code interpreters for data

Run user- or agent-submitted Python and JS against a dataset. Egress is denied except the one data API, so submitted code cannot read internal services, hit cloud metadata, or POST your data anywhere it names.

Multi-tenant bring-your-own-script

Each customer's transform runs in its own session with its own capability handles. Tenant A's code resolves only to tenant A's bucket and endpoints, and cannot enumerate bindings or reach tenant B.

Autonomous scraping, allowlisted

A collector gathers from approved domains and lands results in R2 by handle. Prompt injection in a scraped page telling it to exfiltrate elsewhere hits a 403, recorded with the session that tried.

Internal APIs with a human in the loop

Agents call first-party services with brokered, audience-bound identity injected at egress. Destructive calls are marked ask and pause for a scoped human approval. The agent never holds the credential.

The compute tier for Cloudflare OS

Cloudflare OS Gatekeepers govern the API tier; zeroness governs the container tier beneath them. A Gadget delegates 'run this code' to a governed Sandbox, sharing one capability language and one audit trail.

Explore all use cases How it fits Cloudflare OS

Three pieces. One boundary.

The sandbox runs the code. The Broker decides and holds every secret. The Egress Worker enforces. Nothing trusted sits next to the untrusted process.

Wrap the sandbox

createGovernedSandbox returns your container class with no direct internet and all HTTPS intercepted. One line, drop-in over @cloudflare/sandbox.

src/index.ts

import { getSandbox, Sandbox as Base } from "@cloudflare/sandbox";
import { createGovernedSandbox } from "@zeroness/core";
export { ContainerProxy } from "@cloudflare/containers";
 
// no direct internet, all outbound HTTPS intercepted
export const Sandbox = createGovernedSandbox(Base);

Declare the policy

Default-deny, then allow the hosts you trust. Secrets stay in the Broker and become identity injected at egress, never handed to the box.

src/index.ts

await registerGovernedSession(env.ZERONESS_BROKER, env.Sandbox, "user-1", {
  policy: { default: "deny", allow: [
    { host: "api.github.com", methods: ["GET"] },
    { host: "api.stripe.com", identity: "cap:stripe" },
  ] },
  resources: { stripe: { accessToken: env.STRIPE_RO } },
});

Run it, governed

Allowed hosts return 200 with brokered identity. Everything else is blocked by policy. Every crossing is audited.

inside the sandbox

$ curl https://api.github.com/repos/cloudflare/workers-sdk
200  allowed, identity injected at egress
 
$ curl https://api.stripe.com/v1/charges
403  zeroness: blocked by policy (default deny)
 
$ env | grep -i token
# nothing. the secret never enters the box.

Audit that plugs into your stack.

The Broker keeps a live, per-session trail you can query, and emits every event onto Cloudflare's own log pipeline. No logging code, no extra infrastructure.

Workers Logs captures each line automatically, 7-day retention, filter on zn = "audit".
Logpush ships the same events to R2, S3, Splunk, Datadog, or an HTTPS endpoint for durable, SIEM-ready retention.
One config flag turns it on. The Durable Object /audit API stays for interactive use.

Read the logging guide

audit -> Workers Logs -> Logpush

// one structured line per event, captured by Workers Logs
{"zn": "audit", "event": "egress:deny",
 "sid": "user-1", "detail": { "reason": "default deny" }}
 
// wrangler.jsonc: capture for 7 days, then push anywhere
"observability": { "enabled": true },
"logpush": true   // -> R2 / S3 / Splunk / Datadog

Up in three commands.

The starter scaffolds the governed sandbox, the Broker, and a default-deny policy. Point it at your Cloudflare account and ship.

Scaffold

npm create zeroness@latest my-app

Install

cd my-app && pnpm install

Deploy

pnpm deploy

Read the source Recipes @zeroness/core on npm

Run untrusted code.Govern every byte it sends.