Skip to main content
Sign In
Advanced

Customize the VM

Configure the agentOS VM that serves each app.

Call setDynamicAppsVmOptions during host startup to configure the agentOS VM that serves each app, including apps with Rivet Actors. Pass a function to give each app its own permissions and host functions:

import { setDynamicAppsVmOptions } from "@rivet-dev/dynamic-apps";
import { z } from "zod";

setDynamicAppsVmOptions(({ appId }) => ({
  // Block outbound network access from app code.
  permissions: { network: "deny" },
  // Host functions run in your server, so credentials never enter the VM.
  hostFunctions: {
    github: {
      createIssue: {
        inputSchema: z.object({ title: z.string() }),
        execute: ({ title }) => createIssueFor(appId, title),
      },
    },
  },
}));

VMs are cached per release, so call it before the first request. Changed options apply only to VMs created afterwards.

Apps with actors can still listen inside the VM and reach Rivet under a deny or rule-set network policy, unless your own rules explicitly deny that access. App code, including actor code, calls a host function as a global: await github.createIssue({ title }).

With Core, use the vm option instead:

const dynamicApps = createDynamicApps({
  // Release hooks omitted.
  vm: {
    software: [firstPackage, secondPackage],
    onLimitWarning: (warning) => logger.warn(warning),
  },
});

Dynamic Apps itself controls where the app’s code is placed in the VM and the V8 heap limit. vm options cannot override them. Use the separate logger option for application output and build events.

The VM itself is configured through agentOS:

Edit this page