No root
The model works as an unprivileged user. Root does not exist inside the task.
LIBRE / WORK Product / Work APACHE 2.0
A workspace you can hand to a model.
Work gives a model a real place to build: files that persist, commands that run, a live preview of the result — inside a locked-down container on your own hardware.
01 The receipt
Every task runs under these flags.
This is not a summary — it is the hardening profile of every Work container. Policies can tune the budgets; they can never weaken these lines.
-
--user 1000:1000 -
--read-only -
--cap-drop ALL -
--security-opt no-new-privileges -
--pids-limit 256 -
--memory 2g --memory-swap 2g -
--cpus 2 -
--network none -
--mount …,dst=/workspace
Check it yourself: run docker inspect on any Work container.
No system writes
The filesystem is read-only. Only the task's own workspace accepts changes.
No escalation
Every Linux capability is dropped, and new privileges cannot be acquired.
No keys, no socket
No credentials, no API keys, and no container-engine socket exist inside the sandbox.
02 The loop
Everything a task needs. Nothing it shouldn't reach.
The model works through a fixed set of tools, and every call lands in the task's activity log, in order.
- write_file
Files & git — read, write, move, and search a workspace that survives between runs, with local status, diffs, branches, and commits.
- run_command
Commands & terminal — run anything with bounded time, output, memory, and processes; open a real terminal when you want to step in.
- start_preview
Live preview — the work-in-progress serves on a signed, proxied URL that never publishes to your network.
- web_search
Web search — through your own SearXNG instance, when an administrator turns it on.
03 Operator controls
Administrators decide who gets what.
-
Named policies set image and resource budgets per task — the hardening profile is not a policy field.
-
Work stays admins-only until you open it to your users; web search, model downloads, and agents have the same switch.
-
Idle tasks stop themselves and pick up where they left off — the workspace always persists.
-
Docker out of the box, or Kubernetes Pods with per-task disk quotas. Same flags either way.
Isolation you can inspect.
One container: Chat, Work, providers, and previews included.