Uncontained puts a real Linux machine in your users’ tab, for coding agents, IDEs and tutorials. Zero cloud: it runs on their device, in Chrome, Firefox and Safari. Node, Bun and Wasm skip emulation.
npm i @uncontained/sdk yarn add @uncontained/sdk pnpm add @uncontained/sdk bun add @uncontained/sdk deno add npm:@uncontained/sdk import { Sandbox } from '@uncontained/sdk';const sb = await Sandbox.boot(); await sb.spawn('node', ['--version']) v26.13.0 Native JS await sb.spawn('bun', ['--version']) 1.4.4 Native JS await sb.spawn('claude', ['--version']) 2.1.322 (Claude Code) Native JS await sb.spawn('python3', ['--version']) Python 3.13.5 Emulated await sb.spawn('uname', ['-srm']) Linux 6.18.57-neutrium aarch64 Emulated // Claude Code's own TUI, in a PTY, in the tabconst cc = await sb.spawn('claude', [], { pty: true, cwd: '~/todo-api' });cc.output.pipeTo(term.writable);❯ what kernel and node version is this machine running?
Ran 1 shell command
⏺This machine is running:
- Kernel: Linux 6.18.57-neutrium on aarch64
- Node: v26.13.0
✻ Cogitated for 3s
❯ list the files in this folder
Listed 1 directory
⏺Three files: package.json, server.js and README.md. It is a small Node project called todo-api.
✻ Brewed for 3s
? for shortcuts
// wasmer run on Native Wasm: the browser's own Wasm engineawait sb.spawn('wasmer', ['run', 'syrusakbary/cowsay', 'hello']);dev@neutrium:~$ wasmer run syrusakbary/cowsay hello _______< hello > ------- \ ^__^ \ (oo)\_______ (__)\ )\/\ ||----w | || ||import { Terminal } from '@xterm/xterm'; const term = new Terminal();term.open(el);const sh = await sb.spawn('bash', [], { pty: true });sh.output.pipeTo(term.writable); // guest PTY → xterm.jsterm.onData((keys) => sh.write(keys));dev@neutrium:~$ fastfetchdev@neutrium------------OS Neutrium 0.1 "Photon" (Debian 13 base) aarch64CPU Neutrium vCPU × 2 (Arm Cortex-A55, emulated)Engine Neutrium Engine (wasm64 JIT)Kernel Linux 6.18.57-neutriumPackages 328 (dpkg)Memory 56.92 MiB / 3.47 GiB (2%)// every exec() the router decides, as it happenssb.on('exec', (d) => console.log(d));await sb.spawn('/opt/pxd4/bin/hello');await sb.spawn('/opt/pxd4/bin/fb');t=1792940052.065 pid=194 uid=0 engine=wasm reason=table path=/opt/pxd4/bin/hellot=1792940052.426 pid=210 uid=0 engine=wasm reason=table path=/opt/pxd4/bin/fbt=1792940052.442 pid=210 uid=0 engine=emulated reason=fallback:trap:pxid-2108191147 path=/opt/pxd4/bin/fbsandbox runningTypeScriptUTF-82 vCPUs
One npm package. Boot a machine, write files, spawn programs and open the ports they serve, from your own front end.
npm i @uncontained/sdk yarn add @uncontained/sdk pnpm add @uncontained/sdk bun add @uncontained/sdk deno add npm:@uncontained/sdk import { Sandbox } from '@uncontained/sdk'; const sb = await Sandbox.boot({ memoryMB: 3072, cores: 'auto', relay: myRelay, // no relay: no outside network persist: 'opfs', // 'opfs' | 'memory'}); await sb.fs.writeFile('/app/server.js', code);const p = await sb.spawn('node', ['server.js'], { cwd: '/app' });p.output.pipeTo(terminal.writable);sb.on('port', ({ port, url }) => (iframe.src = url));// Code written for WebContainers: change the import, keep the rest.import { WebContainer } from '@uncontained/webcontainer-compat'; const wc = await WebContainer.boot();await wc.mount(files);const install = await wc.spawn('npm', ['install']);await install.exit;await wc.spawn('npm', ['run', 'dev']);wc.on('server-ready', (port, url) => (iframe.src = url));# The page that embeds the machine is cross-origin isolated:# SharedArrayBuffer and every vCPU need it./* Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp # Third-party images, fonts or scripts without CORP headers?# credentialless loads them without cookies instead of blocking them.# Cross-Origin-Embedder-Policy: credentialless@uncontained/sdkTypeScriptUTF-8LF
Start the machine and type. Every exec() picks an engine, and the pick is written to a log you can read. How the router decides
Machine
Engine switches
Off: every exec() runs emulated. Every program still runs.
Recorded on a real machine, Chrome 156, 10 November 2026.
$ node --version
v26.13.0
$ neutrium-exec why node
program path=/usr/local/bin/node engine=js module= argv-policy=node decision engine=js reason=table policy value=wasm,js,cloud,bun program key=bcfe70988c110e9e70b3f8668f59e82df5185eb00cba98623815858a63364790
neutrium-exec why node
Native JSengine=js reason=table
tail -f /run/neutrium/exec/decisions.log (replay)
Emulated by default, native where it can.
Runs any arm64 program. A complete arm64 computer: our NWE engine, Linux 6.18 and unmodified Debian 13. Every native engine sits on top of it.
dev@neutrium:~$ uname -srmLinux 6.18.57-neutrium aarch64dev@neutrium:~$ python3 --versionPython 3.13.5dev@neutrium:~$ fastfetchOS Neutrium 0.1 "Photon" (Debian 13 base) aarch64CPU Neutrium vCPU × 2 (Arm Cortex-A55, emulated)Kernel Linux 6.18.57-neutriumMemory 56.92 MiB / 3.47 GiB (2%)dev@neutrium:~$ Runs Node and Bun on the browser’s JIT. Node’s own lib/, unmodified, on the browser’s JIT. A Claude Code turn takes 2.8 s instead of 6.7 s emulated.
One agent turn, same machine, same result.
Swaps in a byte-identical Wasm build. Go’s compiler and tsc run as WebAssembly, only when the file’s sha256 matches. tsc type-checks in 3.1 s instead of 6.6 s emulated.
3.1 s tsc --noEmit, Chrome
6.6 s emulated
Falls back with the same pid. A native engine never fails a program for something it lacks. It falls back to emulated with the same pid and files, and logs why.
476 ms
A saved machine is back in 476 ms in Chrome. It runs on the visitor’s own computer, so there is no sandbox server to keep running.
Idle restore, Chrome.
At every exec() it checks, cheapest first, and picks an engine. Pick a program to see each check and the answer the machine gave.
Programs
Claude Code 2.1.322 is a 342 MB single-file Bun executable. The router found its 3,150 JavaScript modules and ran it on native JS. Nobody listed it anywhere.
dev@neutrium:~$ neutrium-exec why claudeprogram bun path=/home/dev/.local/share/claude/versions/2.1.322 size=341501368 modules=3150decision engine=bun reason=bun-graphpolicy value=wasm,js,cloud,bun jit=onprogram key=ef49d8645119275c8de761002db2075a177ee04752afefd4d2bd00b25d7af8f3 dev@neutrium:~$ claude --version2.1.322 (Claude Code)node is in the routing table, and its sha256 matches the row. It runs on the browser’s JavaScript engine; its files, pids and sockets are the machine’s own.
dev@neutrium:~$ neutrium-exec why nodeprogram path=/usr/local/bin/node engine=js module= argv-policy=nodedecision engine=js reason=tablepolicy value=wasm,js,cloud,bunprogram key=bcfe70988c110e9e70b3f8668f59e82df5185eb00cba98623815858a63364790 dev@neutrium:~$ node --versionv26.13.0The Go compiler has a WebAssembly twin, named in the module field. Run by hand, without the environment go build gives it, the router cannot prove the result identical, so the arm64 compiler runs. Inside go build it runs as WebAssembly.
dev@neutrium:~$ neutrium-exec why /usr/local/go/pkg/tool/linux_arm64/compile -V=fullprogram path=/usr/local/go/pkg/tool/linux_arm64/compile engine=wasm module=/usr/lib/neutrium/wasm/go1.27.3/compile.wasm argv-policy=go-compiledecision engine=emulated reason=argv:env:no-GOOSpolicy value=wasm,js,cloud,bunprogram key=35ce75b8723ca02313089c8d307a11d2a3b07bfb0a64561bdabc67d6ed516246Python has no WebAssembly twin, and the router says so. It runs Debian’s own arm64 binary, emulated.
dev@neutrium:~$ neutrium-exec why python3decision engine=emulated reason=/usr/bin/python3.13 is not in the table: it always runs emulated dev@neutrium:~$ python3 --versionPython 3.13.5wasmer run runs on Native Wasm: the router reads the command line, checks the module and runs it on the browser’s Wasm engine with wasmer’s own WASI and WASIX. Only other subcommands and rare options, like --version, run the real wasmer 7.5.0, emulated.
dev@neutrium:~$ neutrium-exec why wasmer run app.wasmprogram path=/usr/local/bin/wasmer engine=wasm module= argv-policy=wasmerdecision engine=wasm reason=tablepolicy value=wasm,js,cloud,bun dev@neutrium:~$ neutrium-exec why wasmer run zstd.wasm --versiondecision engine=emulated reason=argv:wasmer:option:versionA program whose byte-identical WebAssembly build is in the table runs as WebAssembly on the browser’s Wasm engine. When it traps, it falls back to emulated with the same pid.
t=1792940052.065 pid=194 uid=0 engine=wasm reason=table path=/opt/pxd4/bin/hellot=1792940052.426 pid=210 uid=0 engine=wasm reason=table path=/opt/pxd4/bin/fbt=1792940052.442 pid=210 uid=0 engine=emulated reason=fallback:trap:pxid-2108191147 path=/opt/pxd4/bin/fbThe real runtimes, not look-alikes: Node’s own lib/ and the official Bun binary’s programs run on Native JS, with the machine’s files, pids and sockets.
Their own test suites, unmodified, in
Native JS, API surface 7,470 of 7,590 members (98.4%)
5,035 of 5,402 test files pass in Chrome, 93.2%
166 fell back to emulated, 176 failed, 25 timed out.
dev@neutrium:~$ node --versionv26.13.0Native JS, API surface 9,161 of 9,324 members (98.2%)
427 of 1,092 test files pass in Chrome, 39.1%
Of Bun’s own test files on Native JS; 190 not run.
dev@neutrium:~$ bun --version1.4.4Native JS, API surface 7,470 of 7,590 members (98.4%)
4,993 of 5,402 test files pass in Firefox, 92.4%
155 fell back to emulated, 186 failed, 68 timed out.
dev@neutrium:~$ node --versionv26.13.0Native JS, API surface 9,161 of 9,324 members (98.2%)
464 of 902 test files pass in Firefox, 51.4%
Of Bun’s own test files on Native JS.
dev@neutrium:~$ bun --version1.4.4QUIC test files: 268 of 268 pass Node itself passes 5,358 of 5,395 files on native arm64 Linux.
A .wasm file runs like any program, and wasmer run takes Native Wasm: modules, webc files and registry packages run on the browser’s Wasm engine. Each standard is checked against the reference runtime.
WASI 0.1
wasi_snapshot_preview1
117 of 117
calls give the same result as wasmer 7.5.0
WASI 0.2
components
14 of 14
wasi-testsuite C tests pass against wasmtime
WASI 0.3
async components
24 of 24
wasi-testsuite tests pass against wasmtime
WASIX
wasix_32v1, threads, sockets
1,208 of 1,209
battery tests equal to real wasmer, Chrome
# a Wasmer registry packagedev@neutrium:~$ wasmer run syrusakbary/cowsay hello# a webc, with socketsdev@neutrium:~$ wasmer run --net app.webc# a core module, run like any programdev@neutrium:~$ ./hello.wasm# a WASI 0.2 or 0.3 componentdev@neutrium:~$ ./app.wasmdev@neutrium:~$ NWE, the Neutrium Wasm Engine, runs unmodified ARM64 machine code with two tiers: an interpreter for cold code and a JIT that compiles hot regions to WebAssembly. The browser’s own JIT then turns that into machine code. Real Linux runs on top: its own memory, scheduler and drivers.
Most code runs once. NWE counts what comes back.
A hot region of ARM64 becomes one WebAssembly function, registers in locals, NEON in v128.
A hit costs one compare and one load.
Named by a 128-bit hash, shared by every vCPU, warm on the next visit.
The binary you curl. The package you apt install. The coding agent you npm i -g.
curl -fsSL https://claude.ai/install.sh | bash Native JSthe installer downloads a Bun executable apt install -y ffmpeg EmulatedDebian’s own arm64 package npm i -g opencode-ai Native JSnpm on the browser’s JIT Each tool with its version and the engine it runs on. Filter by engine.
| Tool | Version |
|---|---|
| DebianNo systemd: systemctl and journalctl are our init.Emulated | 13.7 trixie, glibc 2.41 |
| Node.jsA Node you replace yourself runs emulated.Native JSEmulated | 26.13.0 |
| npmCorepack provides pnpm and yarn.Native JS | 11.20.0 |
| Bunbun, bunx and Bun single-file executables run native JS.Native JSEmulated | 1.4.4 |
| TypeScript (tsc)The compiler is a Wasm build of typescript-go.Native JSNative Wasm | 7.0.2 |
| Gocompile, asm, link and vet run native Wasm.EmulatedNative Wasm | 1.27.3 |
| wasmerThe common wasmer run form runs native Wasm.EmulatedNative Wasm | 7.5.0 |
| Python, pip, venvEmulated | 3.13.5 |
| uvEmulated | 0.13.4 |
| gcc, g++Emulated | 14.2.0 |
| clang, lld, cmakeEmulated | 19.1.7 / 19.1.7 / 3.31.6 |
| Rust, cargoDebian packages, not rustup.Emulated | 1.85.1 |
| gitEmulated | 2.47.3 |
| ripgrepNative Wasm for the copy inside Claude Code.EmulatedNative Wasm | 14.1.1 |
| zstd, xzzstd compression on the host.EmulatedNative WasmHost acceleration | 1.5.7 / 5.8.1 |
| sha256sum, openssl dgstHashing on the host.Host accelerationEmulated | Debian |
| Docker client, ComposeClient only.Emulated | 26.1.5 / 2.26.1 |
| Claude CodeA Bun executable, recognised by its modules.Native JS | vendor installer |
| opencodenpm i -g opencode-ai.Native JS | 1.19.4 |
| Anything from apt, pip, cargo, npm or a URLEmulated | as published |
Not an emulator, and not a JavaScript-only runtime: both. Node and Bun skip the emulator, and a real Linux machine runs everything else. Rival facts are from their own documentation, read on 10 November 2026.
Node and Bun skip the emulator. Their JavaScript runs on the browser’s own JIT, the way a JavaScript-only runtime does.
apt, Python, Go and gcc run unmodified on arm64 Linux 6.18. The exec router picks the engine for each program.
Native JS 2.8 s
Emulated 6.7 s
| Capability | Uncontained Native engines + Linux | WebContainers JS runtime | BrowserPod Wasm kernel + JS | Nodebox JS runtime | WebVM x86 emulator | E2B Cloud VM |
|---|---|---|---|---|---|---|
| Node and Bun on the browser’s JIT, no CPU emulation | Yes | Node only | Node only | Node only | No, emulated x86 | on their servers |
| Runs in the user’s tab | Yes | Yes | Yes | Yes | Yes | No |
| Real Linux kernel | Yes | No | No | No | No | Yes |
| Runs unmodified arm64 binaries | Yes | No | No | No | No | n/s |
| Native Node addons (N-API) | Yes | No | Wasm replacements only | No | 32-bit x86 only | Yes |
| Bun | Yes | not documented | not documented | not documented | not documented | Yes |
| Single-file Bun executables on a native engine | Yes | No | No | No | No | n/s |
| Automatic fallback to a full machine | Yes | no machine | no machine | no machine | no native engine | n/s |
| Raw TCP, UDP and TLS sockets | Yes | No | HTTP and WebSocket only | No | through Tailscale | Yes |
Yes or no where the owner’s documentation, staff replies or public issues say so. “Not documented”: the vendor’s pages do not mention it. “n/s”: no primary source we read answers it. E2B runs in the cloud, not in the tab.
Anything not answered here, the playground above can answer on a running machine.