// pages/blog.jsx const POST = { slug: 'introducing-vela', title: 'Introducing Vela: Secure Code Execution for AI Agents', description: 'We built the execution layer AI agents deserve. Here\'s why, how, and what\'s next.', date: '2026-05-31', author: 'Praveen Karnati', authorRole: 'Founder', category: 'Product', readTime: '8 min', content: [ { type: 'p', text: 'For the past year I\'ve been building AI agents that write and run code. And for the past year, I\'ve been terrified about what would happen if one of those agents got jailbroken.', }, { type: 'p', text: 'The threat model is real: an attacker crafts a prompt that convinces your AI agent to run malicious code. If that code runs in a subprocess on your server — as most implementations do — you\'ve just handed over the keys to your infrastructure.', }, { type: 'h2', text: 'The problem with existing approaches', }, { type: 'p', text: 'The obvious solution is containerization. But Docker containers were designed for long-running services, not ephemeral per-request sandboxes. Cold start overhead of 1–3 seconds per execution adds up fast. And containers still share the host kernel — a kernel exploit in the container is an exploit on your server.', }, { type: 'p', text: 'Hosted sandboxes like e2b or Modal solve some of this, but you lose observability. The audit log — who ran what, when, with what result — is owned by the vendor. For security-conscious teams, that\'s a dealbreaker.', }, { type: 'h2', text: 'Enter Firecracker', }, { type: 'p', text: 'Firecracker is AWS\'s open-source micro-VM monitor, built for Lambda and Fargate. It provides genuine hardware-level isolation via KVM, with ~150ms cold starts and sub-millisecond overhead for pre-warmed pools. It\'s the right primitive for per-request code execution.', }, { type: 'p', text: 'Vela wraps Firecracker with a Rust daemon, capability token system, policy engine, and full telemetry stack. The result: sandboxed code execution with a p50 latency that\'s production-viable, an audit trail that\'s yours, and a security model you can actually reason about.', }, { type: 'h2', text: 'Capability tokens', }, { type: 'p', text: 'One of the design decisions I\'m most proud of is the capability token system. Rather than a single API key that grants unlimited access, each caller gets an HMAC-SHA256 signed token that declares exactly what it\'s allowed to do: which filesystem paths, whether network is permitted, memory limits, timeouts, expiry.', }, { type: 'p', text: 'The daemon verifies the signature cryptographically before executing anything. No valid token, no execution. This means you can give different tokens to different agents, revoke them independently, and have a cryptographic record of what each caller was authorized to do.', }, { type: 'h2', text: 'What\'s next', }, { type: 'p', text: 'Vela v0.1 ships today with LangChain, LlamaIndex, CrewAI, and OpenAI adapters. The cloud API is in private beta. Self-hosting is production-ready today — just cargo install vela-engine and pip install vela-agent.', }, { type: 'p', text: 'Coming next: a cloud-managed tier with multi-region support, a web UI for the audit log, and JavaScript/TypeScript SDK. We\'re also working on snapshot-based fast boot for cold start under 50ms.', }, ], }; function BlogCard({ post, onClick }) { return (
{ e.currentTarget.style.borderColor = 'rgba(99,102,241,0.35)'; e.currentTarget.style.transform = 'translateY(-2px)'; e.currentTarget.style.boxShadow = '0 8px 32px rgba(0,0,0,0.3)'; }} onMouseLeave={e => { e.currentTarget.style.borderColor = 'var(--color-border)'; e.currentTarget.style.transform = 'translateY(0)'; e.currentTarget.style.boxShadow = 'none'; }} >
{post.category} {post.readTime} read

{post.title}

{post.description}

PK
{post.author}
{post.date} · {post.authorRole}
); } function PostContent({ post }) { return (
{post.category} {post.readTime} read

{post.title}

{post.description}

PK
{post.author}
{post.date} · {post.authorRole}
{post.content.map((block, i) => { if (block.type === 'h2') return

{block.text}

; if (block.type === 'p') return

{block.text}

; return null; })}
); } const POSTS = [POST]; function BlogPage() { const route = usePathRoute(); const slug = route.startsWith('/blog/') ? route.slice(6) : null; const activePost = slug ? POSTS.find(p => p.slug === slug) : null; if (activePost) { useSEO(activePost.title + ' — Vela Blog', activePost.description); return (
); } useSEO("Blog — Vela Runtime", "Latest updates and engineering deep-dives from Vela."); return (

Vela Blog

Engineering insights, product updates, and security deep-dives.

{POSTS.map((post, i) => ( navigate('/blog/' + post.slug)} /> ))}
); } Object.assign(window, { BlogPage });