edge166/3va repository overview

⁠3va

3va is a JavaScript and TypeScript runtime written in Rust with deny-by-default security. It bundles a package manager, process manager, test runner, bundler, and dev server.

• 📖 Docs: https://3va-docs-n48j.vercel.app⁠
• 💻 Source: https://github.com/OdinoCano/3va⁠
• 🔒 Security policy: https://github.com/OdinoCano/3va/blob/main/SECURITY.md⁠
• 🏅 OpenSSF Best Practices⁠

⁠Tags

Platforms: linux/amd64, linux/arm64. Base: debian:trixie-slim.

⁠Usage

The image contains only the 3va binary. Mount your code into /app:

docker run --rm -v "$PWD":/app edge166/3va run app.ts

⁠Granting permissions

Filesystem, network, environment variables, child processes, and native addons are all blocked by default. Grant each one explicitly:

docker run --rm -v "$PWD":/app edge166/3va run app.ts \
  --allow-net=api.example.com \
  --allow-read=/app/data \
  --allow-env=DATABASE_URL

A container has no TTY by default, so any capability you don't grant is denied silently. There is no interactive prompt.

⁠Running a server

docker run --rm -p 3000:3000 -v "$PWD":/app edge166/3va run server.ts --allow-net

⁠Installing packages

docker run --rm -v "$PWD":/app edge166/3va install express --allow-net=registry.npmjs.org

Install scripts (preinstall, postinstall, …) are never executed.

⁠As a base image

FROM edge166/3va:v2.9.0
COPY --chown=3va:3va . /app
CMD ["run", "app.ts", "--allow-net=api.example.com"]

⁠Image details

• Runs as the non-root user 3va (UID/GID 10001). If you mount a host directory and need to write to it, add --user "$(id -u):$(id -g)".
• Working directory: /app
• Entrypoint: 3va (the default command is --help)
• Includes ca-certificates for TLS

⁠Verifying the binary

Release binaries are signed with Sigstore cosign and ship with SLSA provenance. See SECURITY.md⁠ for verification steps.

⁠License

MIT