Riza: a modern alternative to
isolated-vm & vm2

Looking for a secure way to execute untrusted JavaScript or TypeScript code?

Projects like isolated-vm and vm2 used to be viable options, but they're now deprecated or in maintenance mode—and vm2 has critical security vulnerabilities.

Riza fills the gaps left by isolated-vm and vm2 . Riza is a modern code interpreter that offers a simple yet powerful solution for isolated code execution.

Why Riza?

Older solutions like isolated-vm and vm2 required complex setup and maintenance. You needed to manage the isolation environment, handle resource limits, and deal with security configurations.

Riza simplifies this by providing a managed service with a straightforward HTTP API.

Technical Comparison

Code Example Comparison

import * as ivm from "isolated-vm";

const isolate = new ivm.Isolate({ memoryLimit: 128 });
const context = await isolate.createContext();
const jail = context.global;
await jail.set('global', jail.derefInto());
const script = await isolate.compileScript('console.log("Hello")');
await script.run(context);

import VM from "vm2";

const vm = new VM({
  timeout: 1000,
  sandbox: {}
});
vm.run('console.log("Hello")');

import Riza from "@riza-io/api";

const riza = new Riza();
const resp = await riza.command.exec({
  language: "javascript",
  code: 'console.log("Hello")'
});

How Riza Works

Using Riza is as simple as making an HTTP request:

1. Send your code to Riza's Function Execution endpoint
2. Riza executes it in a secure, isolated environment
3. Receive the execution results

Key Features

Custom Runtimes

Need specific npm packages? Riza's custom runtimes let you define an environment with any npm dependencies. Create a runtime once, and use it for any number of code executions on Riza.

Security Without Compromise

Unlike VM-based solutions, Riza provides true isolation by executing your untrusted code in our cloud infrastructure. Each code execution runs in a completely separate environment, ensuring maximum security.