feat: replace Docker widget sandboxing with Secure Exec (V8 isolates)

.github/workflows/ci.yml

@@ -13,7 +13,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 22
           cache: npm
       - run: npm install
       - run: npx eslint --quiet src/
@@ -26,7 +26,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 22
           cache: npm
       - run: npm install
       - run: npx tsc --noEmit
@@ -39,7 +39,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 22
           cache: npm
       - run: npm install
       - run: npx vitest run

.github/workflows/deploy.yml

@@ -48,14 +48,9 @@ jobs:
     runs-on: ubuntu-latest
     needs: [typecheck, test]
     steps:
-      - name: Deploy to Droplet
-        uses: appleboy/ssh-action@v1
+      - uses: actions/checkout@v4
+      - name: Deploy to Railway
+        uses: bervProject/railway-deploy@main
         with:
-          host: ${{ secrets.DROPLET_IP }}
-          username: root
-          key: ${{ secrets.DROPLET_SSH_KEY }}
-          script: |
-            cd /opt/infinite-monitor
-            git pull origin main
-            docker compose up -d --build
-            docker image prune -f
+          railway_token: ${{ secrets.RAILWAY_TOKEN }}
+          service: ${{ secrets.RAILWAY_SERVICE_ID }}

AGENTS.md

@@ -4,20 +4,18 @@
 
 ### Overview
 
-Infinite Monitor is a single Next.js 16 application (not a monorepo) that builds AI-powered dashboard widgets. Users describe widgets in natural language; an AI agent writes React code, builds it inside a Docker container via Vite, and serves the result in an iframe on an infinite canvas. SQLite (via `better-sqlite3` + Drizzle ORM) handles persistence; no external database service is needed.
+Infinite Monitor is a single Next.js 16 application (not a monorepo) that builds AI-powered dashboard widgets. Users describe widgets in natural language; an AI agent writes React code, which is built and served inside a [Secure Exec](https://secureexec.dev/) sandbox (V8 isolate-based secure Node.js execution) via Vite. The result is displayed in an iframe on an infinite canvas. SQLite (via `better-sqlite3` + Drizzle ORM) handles persistence; no external database service is needed.
 
 ### Prerequisites
 
 - **Node.js 20+** with **npm** (lockfile: `package-lock.json`)
-- **Docker** must be running — the app uses `dockerode` to spawn widget build containers at runtime
-- The **`widget-base:latest`** Docker image must be built before widgets can be created: `docker build -t widget-base:latest docker/widget-base`
+- No Docker required — widget sandboxing is handled by `secure-exec` (V8 isolates)
 
 ### Key commands
 
 | Action | Command |
 |--------|---------|
 | Install deps | `npm install` |
-| Build widget-base image | `docker build -t widget-base:latest docker/widget-base` |
 | Dev server | `npm run dev` (port 3000) |
 | Lint | `npm run lint` |
 | Tests | `npm test` (vitest) |
@@ -27,8 +25,7 @@ See `Makefile` for shorthand targets (`make setup`, `make dev`, `make lint`, `ma
 
 ### Non-obvious notes
 
-- **Docker is required at runtime**, not just for deployment. The Next.js API routes use `dockerode` to create/manage widget containers. If Docker is not running, widget creation will fail.
+- **Secure Exec sandboxes** are used at runtime to build and serve widgets. Each widget gets its own `NodeRuntime` instance (V8 isolate) with filesystem, networking, and child process capabilities. No Docker daemon is needed.
 - **AI provider API keys** are entered via the UI (BYOK) or set in `.env.local`. The app works without any server-side keys — users paste keys in the chat sidebar. See `.env.example` for the full list of supported providers. If you add/change `.env.local` while the dev server is running, you must restart the dev server for the new keys to take effect.
 - **SQLite database** is auto-created at `./data/widgets.db` (or `DATABASE_PATH` env var). No migrations command is needed; the schema is applied automatically.
 - **Husky pre-commit hook** runs `lint-staged` which executes ESLint and TypeScript type-checking on staged `src/**/*.{ts,tsx}` files.
-- The Docker daemon in the Cloud Agent VM requires `sudo dockerd` to start and `sudo chmod 666 /var/run/docker.sock` for non-root access. The storage driver must be `fuse-overlayfs` and iptables must use legacy mode (see Docker-in-Docker setup for Firecracker VMs).

Makefile

@@ -1,17 +1,11 @@
-.PHONY: setup dev build docker clean test lint help
-
-DOCKER_IMAGE := widget-base:latest
-DOCKER_DIR   := docker/widget-base
+.PHONY: setup dev build start test lint clean help
 
 help: ## Show this help
 	@grep -E '^[a-zA-Z_-]+:.*?## .*$$' $(MAKEFILE_LIST) | awk 'BEGIN {FS = ":.*?## "}; {printf "  \033[36m%-12s\033[0m %s\n", $$1, $$2}'
 
-setup: docker ## Install deps + build Docker image (first-time setup)
+setup: ## Install deps (first-time setup)
 	npm install
 
-docker: ## Build the widget runtime Docker image
-	docker build -t $(DOCKER_IMAGE) $(DOCKER_DIR)
-
 dev: ## Start the Next.js dev server
 	npm run dev
 
@@ -27,9 +21,7 @@ test: ## Run tests
 lint: ## Run linter
 	npm run lint
 
-clean: ## Remove build artifacts, Docker container, and volume
+clean: ## Remove build artifacts
 	rm -rf .next node_modules data/widgets.db
-	-docker rm -f widget-runtime 2>/dev/null
-	-docker volume rm widget-runtime-dist 2>/dev/null
 
-all: setup dev ## Full bootstrap: install, build Docker, start dev server
+all: setup dev ## Full bootstrap: install + start dev server

README.md

@@ -15,7 +15,7 @@ Each widget is a full React app — with its own dependencies, API calls, charts
 ## How it works
 
 1. Click **Add Widget** and describe what you want
-2. An AI agent writes the React code, installs dependencies, and builds it inside a Docker container
+2. An AI agent writes the React code, installs dependencies, and builds it in a secure sandbox
 3. The widget renders live in an iframe on your dashboard
 4. Iterate by chatting — the agent rewrites and rebuilds in seconds
 
@@ -24,9 +24,7 @@ Each widget is a full React app — with its own dependencies, API calls, charts
 ### Prerequisites
 
 - [Node.js](https://nodejs.org/) 20+
-- [Docker](https://www.docker.com/) running locally
 - An API key from any [supported provider](#supported-providers) (Anthropic, OpenAI, Google, xAI, Mistral, and more)
-- [Make](https://www.gnu.org/software/make/) (pre-installed on macOS/Linux)
 
 ### Setup
 
@@ -46,20 +44,14 @@ ANTHROPIC_API_KEY=sk-ant-...
 
 See [`.env.example`](.env.example) for the full list of supported environment variables.
 
-Bootstrap everything (install deps + build Docker image + start dev server):
+Install and start:
 
 ```bash
-make all
+npm install
+npm run dev
 ```
 
-Or step by step:
-
-```bash
-make setup   # npm install + build widget-base Docker image
-make dev     # start Next.js dev server
-```
-
-Open [http://localhost:3000](http://localhost:3000). Run `make help` to see all available targets.
+Open [http://localhost:3000](http://localhost:3000).
 
 ## Architecture
 
@@ -81,9 +73,9 @@ Open [http://localhost:3000](http://localhost:3000). Run `make help` to see all
      │             │                 │
      ▼             ▼                 ▼
 ┌─────────┐  ┌──────────┐  ┌─────────────────┐
-│ SQLite  │  │ Docker   │  │ AI Providers    │
-│ (state) │  │ (builds) │  │ (BYOK)          │
-│         │  │          │  │                 │
+│ SQLite  │  │ Secure   │  │ AI Providers    │
+│ (state) │  │ Exec     │  │ (BYOK)          │
+│         │  │ (V8)     │  │                 │
 │ widgets │  │ vite     │  │ Anthropic       │
 │ layouts │  │ serve    │  │ OpenAI / Google  │
 │ files   │  │ dist/    │  │ xAI / Mistral…  │
@@ -94,7 +86,7 @@ Open [http://localhost:3000](http://localhost:3000). Run `make help` to see all
 
 **Server** — Next.js API routes. AI chat uses Vercel AI SDK with any supported provider. Widget files stored in SQLite via Drizzle ORM. CORS proxy for widget API calls.
 
-**Widget Runtime** — A single Docker container running `serve`. The agent writes files, Vite builds them, and the built output is served as static HTML. A Docker volume persists builds across container restarts.
+**Widget Runtime** — Each widget runs in a [Secure Exec](https://secureexec.dev/) sandbox (V8 isolate). The agent writes files, Vite builds them, and the built output is served as static HTML. No Docker required.
 
 **Widget Template** — Each widget gets React 18, Tailwind CSS, Recharts, MapLibre GL, Framer Motion, date-fns, Lucide icons, and all shadcn/ui components out of the box.