Ghost

gghost AGENT EXECUTION RUNTIME
SESSION sess-a3f24c — READY

Give agents a computer.
Not the computer.

Ghost is a Rust-native shell and runtime that gives every agent an isolated execution environment — capable, familiar, and completely sealed off from the host.

ISOLATED RUST-NATIVE DENY-BY-DEFAULT MULTI-TENANT AUDITABLE
// core

Five priorities. One runtime.

Ghost is not a container wrapper or a thin front-end over /bin/bash. It is a purpose-built execution environment with its own shell, virtualized filesystem, process model, and permissions — where every capability an agent gets is explicit, inspectable, and enforceable.

01

Isolation

Every session has an empty environment by default: no host files, processes, sockets, credentials, or neighbors.

02

Performance

Ordinary commands run in-process in Rust — no container startup, no shell fork, no OS process per tool call.

03

Security

Deny-by-default capabilities. Dangerous functionality is removed, not just discouraged in a prompt.

04

Scalability

Thousands to millions of isolated execution contexts across a distributed deployment, per-session accounted.

05

Agent-Native

Every action produces structured execution metadata: inputs, outputs, files, network, resources, and result.

// the shell

A shell that feels like bash. Runs like a runtime.

Familiar pipes, redirects, jobs, and exit codes — but every operation is executed by the Ghost runtime, not blindly delegated to the host. Data moves between built-in tools in-process, without spawning OS processes or serializing across boundaries.

sess-a3f24c — ghost://runtime/v1.2
ghost://sess-a3f24c$ mount /workspace --readonly
ok  /workspace mounted readonly (2 paths, 148 files)

ghost://sess-a3f24c$ jq '.users[] | .email' data.json | sort -u
alice@example.com
ben@example.com
carla@example.com

ghost://sess-a3f24c$ http get https://api.internal/status
deny  destination not in network allowlist (policy: net.default)

ghost://sess-a3f24c$ snapshot --tag pre-migration
ok  snap_9e3f  fs+runtime  38 ms

ghost://sess-a3f24c$ 
// security model

Enforced by the runtime. Not by the prompt.

Ghost assumes agent-generated code and commands are untrusted. Capabilities are granted explicitly and checked at every boundary — potentially dangerous functionality can be removed from an environment, not merely discouraged.

deny

No implicit host filesystem access

deny

No implicit host process execution

deny

No inherited user credentials

grant

Explicit network allowlists

grant

Per-session resource quotas

grant

Execution deadlines

grant

Bounded output and storage

grant

Immutable or read-only mounts

grant

Secret injection without filesystem exposure

grant

Auditable capability grants

grant

Runtime-level command interception

deny

Everything else, by default

// lifecycle

Snapshot. Fork. Suspend. Destroy.

A Ghost session can live for one tool call, one task, or one multi-day workflow. Filesystem and runtime state snapshot independently from compute — environments suspend when idle and resume without keeping a process alive.

EPHEMERAL — PERSISTENT

One session per anything.

A single tool call, an entire agent task, a multi-day workflow, or a long-running autonomous worker. Same interface, same guarantees.

SNAPSHOTS

Reproducible. Forkable.

  • Reproducible agent runs
  • Fast cloning of environments
  • Rollback after failed actions
  • Debugging and forensic inspection
  • Cached development environments
  • Branching agent workspaces
MULTI-TENANCY

Isolation at the session, not the machine.

Resource accounting, scheduling, and quotas are built into the execution model. Tens of thousands of agents run concurrently, distributed across workers, with one logical interface.

~mssession start
0 KBambient authority
10k+concurrent sessions / host
1xexecution model
// why ghost

A computer they can't misuse.

Traditional shells assume a trusted human user. Containers still expose an operating-system surface. Ghost starts from a different assumption: the code is untrusted, the executor may be autonomous, and every capability must be intentional.

“Ghost gives agents a computer without giving them the computer.”
ghost://ready$