ThreeGate/tool-exec/era

ERA Integration (TOOL-EXEC Backend)

This directory defines how ThreeGate integrates ERA as the TOOL-EXEC backend.

ERA provides microVM-backed execution with a container-like interface and is intended to reduce blast radius compared to running code directly on the host.

This integration is intentionally conservative:

• TOOL-EXEC runs no-network by default
• TOOL-EXEC is ephemeral by default
• Inputs/outputs are mediated via schemas and validation

---

Scope

This integration is used only for human-approved Tool Requests placed into:

• /srv/threegate/tool-exec/requests_in/ (host path in the full deployment)
• mounted read-only into the TOOL-EXEC container/service

TOOL-EXEC produces Tool Results into:

• /srv/threegate/tool-exec/results_out/
• and validated outputs are moved to CORE inbound

---

Security Posture (Defaults)

• Network: disabled
• Persistence: disabled
• Guest volumes: disabled (AGENT_ENABLE_GUEST_VOLUMES=0)
• Output only to /out (as mediated by TOOL-EXEC runner)

If you must enable guest volumes:

• treat it as a security change
• use explicit allowlists of mounted paths
• prefer read-only mounts
• ensure deterministic hashes in request schema

---

Operational Requirements

ERA typically requires:

• the agent CLI available (ERA)
• a backend capable of microVM execution (krunvm)
• host support (often KVM via /dev/kvm)

Do not enable /dev/kvm passthrough to containers until you have reviewed:

• host kernel patching state
• Docker daemon security posture
• whether TOOL-EXEC should run directly on the host instead of inside a container

This repo provides wrapper scripts that can be used either:

• within a TOOL-EXEC container (with careful device exposure), or
• as host-level tooling invoked by a systemd service (often simpler/safer)

---

Reference

ERA upstream:

• https://github.com/BinSquare/ERA

This repository does not vendor ERA.