How do you safely let other developers deploy code on your infrastructure?
I'm currently building the deployment pipeline for HiveShard, an open-source runtime for deterministic distributed simulations.
Eventually, HiveShard simulations should be be able to target multiple hosting environments:
- InMemory
- Self-hosted Kubernetes
- The managed HiveShard Platform
That immediately raised a question:
"How do you prevent users from executing unsafe APIs?"
- ❌ System.IO
- ❌ System.Net
- ❌ Activator
- ❌ Reflection
- ❌ Other unrestricted runtime APIs
Compile-time guarantees
Runtime sandboxing is important.
But I don't want security to begin after deployment.
I want compile-time guarantees.
Because the safest code is the code that never compiles.
So I didn´t just publish a NuGet package with interfaces.
I built a custom .NET Project SDK.
<Project Sdk="HiveShard.Service.Sdk">
The SDK automatically:
- ✅ References only approved abstractions.
- ✅ Enables custom Roslyn analyzers.
- ✅ Prevents access to restricted platform APIs.
- ✅ Rejects forbidden code during compilation.
If a component violates the execution model, deployment never starts.
Trusted build artifacts
A HiveShard simulation is uploaded as a collection of NuGet packages.
The builder then becomes the trusted gatekeeper.
- Downloads every package.
- Resolves the dependency graph.
- Verifies SDK compliance.
- Wraps the simulation into the HiveShard runtime.
- Builds and containerizes the deployment.
If verification fails, deployment never starts.
But trust goes both ways.
Developers need to trust the platform too.
That's one of the reasons HiveShard deployments are uploaded as NuGet packages instead of source code.
The platform never needs your source code. It only needs a verifiable build artifact.
So deployments can even be obfuscated before they're uploaded.
Long-term vision
This is just the foundation for something much bigger.
HiveShard developers should be able to:
- ✅ Deploy from a GUI.
- ✅ Deploy directly from CI through an API.
- ✅ Orchestrate distributed simulations.
- ✅ Monitor running deployments.
- ✅ Debug distributed systems.
- ✅ Manage environments and versions.
HiveShard deployments should feel as simple as web deployments.
That's the long-term vision behind the HiveShard Platform.