Securing the runtime
esrun app.js grants nothing. A service therefore does not run until its command line says what it may reach. This guide turns that deny-by-default model into a practical deployment workflow.
The security model explains why the boundary is shaped this way. The CLI reference is the complete flag list and grammar.
esdev --trace-permissions server.js runs the program with everything granted, watches every capability it reaches for, and prints the esrun line that grants those capabilities. You still need to narrow list-valued grants.
Read the guide in order
Granting capabilities step by step — start from nothing, grant only what breaks, and read denials.
Import policy and deployment commands — bound what may load and make the deployment command fail closed.
Hardening and pre-deploy checklist — refuse dangerous grants, protect secrets, and review the final command.
The esrun CLI, running a service you control.