Functions on
your own metal.

Fifteen things.
One container.

Everything an operator needs to run untrusted code — observed, reversible, no external dependencies, no add-on services.

Multi-runtime

Node.js 24, Python 3.14, and TypeScript — two generic runtimes, latest-stable only.

nsjail isolation

Five overlapping Linux kernel boundaries per call — user NS, mount NS, cgroup v2, seccomp, network NS.

Warm pools

Idle workers stay resident between invocations. Pool size configurable per function; back-to-back calls skip spawn entirely.

KV store

Per-function SQLite-backed KV with optional TTL. kv.put / kv.get / kv.list — browsable from the dashboard.

Background jobs

jobs.enqueue(name, payload). Persisted queue with configurable retries and exponential backoff.

Cron schedules

Fire any function on a cron expression. Dashboard shows last run, next run, current status.

Function-to-function

invoke("name", payload) calls another function via the warm pool as a child span in the same trace.

Distributed tracing

HTTP, F2F calls, and background jobs share one trace_id. Waterfall view in dashboard; zero code changes.

Custom routes

Map a path like /webhooks/stripe to a function so callers use a clean URL instead of a UUID.

Secrets

Encrypted per-function secrets injected as env vars at sandbox spawn time. Never logged, never plaintext on disk.

Inbound webhooks

Signed external trigger endpoints — GitHub, Stripe, Slack, and generic HMAC — fanning into a function.

Rollback

Every deploy is content-hashed and archived. Roll back to any prior version in one click.

MCP server

72 tools at /mcp. Claude Code, Cursor, and any OAuth MCP client can deploy and manage functions from chat.

Built-in AI assistant

In-product agentic chat that operates the instance end-to-end through the same tools — bring your own provider key, approve writes inline.

21 templates

Stripe webhooks, GitHub events, JWT auth, OAuth, CSV→JSON, URL shortener — pickable in the editor.

Five overlapping
kernel boundaries.

Each layer is enforced by the kernel, not by Orva. Orva configures the boundaries; the kernel holds them.

1. 01

   User namespace

   UID 0 inside the sandbox maps to UID 65534 (nobody) on the host. All 64 Linux capability bits cleared — verified via /proc/self/status. The function cannot escalate to host root.

2. 02

   Mount namespace + chroot

   /code is a read-only bind mount of the function's versioned directory. /tmp is a private tmpfs wiped after each worker exits. No host filesystem visible.

3. 03

   cgroup v2

   Hard limits per function: memory.max, cpu.max, pids.max. The host refuses new spawns past 80% total memory reservation.

4. 04

   Seccomp (Kafel policy)

   ~150 syscalls blocked: mount, unshare, bpf, kexec_load, init_module, ptrace, and more. Blocked attempts log and kill the process — never silently fail.

5. 05

   Network namespace

   Default network_mode: none — loopback only, no inbound possible. Functions opt in to network_mode: egress for outbound HTTPS via an nftables allowlist.

Full threat model and self-verification recipe:  docs/SECURITY.md . Verified end-to-end under Kata Containers 3.30 (QEMU + Cloud Hypervisor); the nsjail boundary holds unchanged with a real Linux kernel underneath.

Everything the operator needs.
Nothing they don't.

Click any screenshot for full size.

Four ways in.
Pick the one you trust.

docker run -d \
  --name orva \
  -p 8443:8443 \
  --pid host --cgroupns host \
  --cap-add SYS_ADMIN --cap-add NET_ADMIN \
  --security-opt seccomp=unconfined \
  --security-opt apparmor=unconfined \
  --security-opt systempaths=unconfined \
  --device /dev/net/tun \
  -v orva-data:/var/lib/orva \
  -v /sys/fs/cgroup:/sys/fs/cgroup:rw \
  ghcr.io/harsh-2002/orva:latest

services:
  orva:
    image: ghcr.io/harsh-2002/orva:latest
    restart: unless-stopped
    ports:
      - "8443:8443"
    pid: host
    cgroup: host
    cap_add:
      - SYS_ADMIN
      - NET_ADMIN
    security_opt:
      - seccomp=unconfined
      - apparmor=unconfined
      - systempaths=unconfined
    devices:
      - /dev/net/tun:/dev/net/tun
    volumes:
      - orva-data:/var/lib/orva
      - /sys/fs/cgroup:/sys/fs/cgroup:rw

volumes:
  orva-data:

curl -fsSL https://github.com/Harsh-2002/Orva/releases/latest/download/install.sh | sh -s -- --bare-metal

curl -fsSL https://github.com/Harsh-2002/Orva/releases/latest/download/install-cli.sh | sh

Can't decide? Drop the --bare-metal flag and the installer auto-detects your host — Docker when it's present, bare-metal otherwise.

Write a function.
Get a URL.

Every handler is a default export. kv, invoke, and jobs are pre-installed — no npm install, no pip install.

export default async function (req, ctx) {
  const seen = (await ctx.kv.get('count')) ?? 0;
  await ctx.kv.put('count', seen + 1);
  return { ok: true, seen: seen + 1 };
}

async def handler(req, ctx):
    seen = await ctx.kv.get('count') or 0
    await ctx.kv.put('count', seen + 1)
    return {'ok': True, 'seen': seen + 1}

import type { OrvaHandler } from 'orva';

const handler: OrvaHandler = async (req, ctx) => {
  await ctx.jobs.enqueue('thumbnail', { url: req.body.url });
  return { queued: true };
};
export default handler;

Full SDK surface on ctx: kv, invoke, jobs, logger, trace, secrets. Reference docs ship in-product at /web/docs.