OpenEng Labs

Executor · Downloads

One CLI, every platform.

The oee CLI and the binaries it builds target Linux, macOS, Windows, and OCI/Docker. The Executor is launching soon: request early access for the platforms you run.

Request early accessSee the benchmarks

Status, as of November 11, 2026

  • Launching soon

    Executor (OEE)

    Launching soon for Linux, macOS, Windows, and OCI/Docker; early access on request

oee build --target
$ oee build -f oee.yaml --target linux-x86_64 \
    --sign-key ./certs/oee.key -o ./dist/my-service
$ oee build -f oee.yaml --target windows-x86_64 \
    --sign-key ./certs/oee.key -o ./dist/my-service.exe
$ oee inspect ./dist/my-service --verify-key ./certs/oee.pub

Platform matrix

Six targets, one build tool.

oee build cross-compiles, so a single CI host can produce a binary for each target, for example a windows-x86_64 binary from Linux CI.

Download links, checksums, and signatures appear on this page when each artifact is published. Until then, early access is by email to hello@openeng.ai.

After install

From a project to a running, signed binary.

Install the oee CLI on your build machine or CI runner. The binaries it builds need nothing installed on the hosts they run on: the supervisor, the runtime, and the policy are all inside.

  1. 01

    Scaffold

    oee init detects pyproject.toml, requirements.txt, go.mod, pom.xml, or package.json and writes an annotated oee.yaml; --interactive asks for each setting instead.

    oee init --lang python --sandbox
  2. 02

    Validate

    Catch policy mistakes before building: sandbox paths, cron expressions, JSONPath queries, and environment references.

    oee validate -f oee.yaml --strict
  3. 03

    Sign

    Generate the Ed25519 keypair that signs the policy and verifies the binary.

    oee keygen --out-dir ./certs
  4. 04

    Build

    Package the workload, its runtime, and the signed policy into one executable for a target platform.

    oee build -f oee.yaml --target linux-x86_64 --sign-key ./certs/oee.key -o ./dist/my-service
  5. 05

    Verify

    Check the OEE! footer, the Merkle root, and the signature, and print the embedded policy and runtime versions.

    oee inspect ./dist/my-service --verify-key ./certs/oee.pub
  6. 06

    Run and operate

    Run the binary directly; query running instances and stop them with an authenticated local command.

    ./dist/my-service --log-level info
oee status --json
oee stop --all --mode graceful

In a container

Copy the built binary into a minimal image and make it the entrypoint. The Executor acts as PID 1: it forwards signals, reaps zombie processes, and layers the sandbox primitives the container permits.

Dockerfile
FROM gcr.io/distroless/static-debian12
COPY order-engine-oee /app/order-engine-oee
ENTRYPOINT ["/app/order-engine-oee"]

Without building first

oee run runs any local command under the sandbox and the exit event engine, for development.

oee run -f oee.yaml -- python -m uvicorn app.server:api

Runtime cache

oee runtime lists, pre-fetches, and checksum-verifies the portable CPython, jlink JDK, and Node.js distributions in the local build cache.

oee runtime list
oee runtime fetch
oee runtime verify

Host requirements

What the hosts need.

No runtime to install
Python, JVM, and Node.js runtimes travel inside the binary; native binaries need no runtime at all.
No root, no daemon
The sandbox uses unprivileged kernel primitives; no container daemon or hypervisor is required.
Linux strict caps
A writable delegated cgroups v2 subtree, a systemd user scope, or the container’s own cgroup. Otherwise a strict cap refuses to start with exit code 69 unless governor fallback is allowed.
Containers
Unprivileged Docker and Kubernetes work without --privileged or --cap-add=SYS_ADMIN; container_fallback decides between layering what is allowed and refusing to start.

Request early access.

Tell us your platforms, runtimes, and what the binary must enforce. Write to hello@openeng.ai or use the contact page.

Email for early accessContact Us