Architecture

A short overview of the Agent OS Exec architecture.

Agent OS Exec runs untrusted guest code inside a fully virtualized VM whose kernel services every guest syscall. At a glance:

• Kernel-owned VM: A kernel owns the virtual filesystem, process table, and socket table, plus pipes, PTYs, permission policy, and DNS. There is no real host filesystem, host socket, or host process available to the guest.
• Guest runs in an executor: Guest JavaScript runs in a V8 isolate and other guest code runs in a WASM executor, holding no real host capabilities of their own.
• Sidecar mediates every syscall: A trusted sidecar is the enforcement point. Every guest syscall flows through kernel-owned paths it controls, where policy and limits are checked.
• Normal Linux semantics: The VM presents POSIX-like behavior to guest programs, so normal tools run unmodified while staying fully virtualized.

Full reference

Agent OS Exec is a public language layer of AgentOS, not a compatibility package. VMs use the process-wide shared sidecar pool by default; each VM keeps its own kernel-owned filesystem, process table, socket table, permissions, and resource accounting. Pass an explicit sidecar option when you need a caller-managed placement policy.