Skip to content
Formless Host

Storage, secrets and resources

Plugin-private storage is Host-owned and isolated by plugin identity. Uninstall retains it; purge is a separate destructive command. The database reference plugin uses a private WAL-mode SQLite database and exposes named reports, never arbitrary SQL or Host paths.

Secrets

Section titled “Secrets”

Secrets are OS-keystore records released only as exact-digest, generation-scoped leases and revoked when the generation scope closes. Prefer short-lived service tokens. Use a service-specific Host capability when credentials must never enter plugin memory.

Never place secrets in manifests, image layers, argv, ordinary environment variables, traces, or support bundles.

Resource admission

Section titled “Resource admission”
  • FORMLESS_PLUGIN_MAX_ACTIVE defaults to 32 live generations.
  • FORMLESS_PLUGIN_MAX_MEMORY_MIB defaults to 8192 MiB across admitted plugins.
  • Manifest pids becomes the workload’s RLIMIT_NPROC and must be at least 32.
  • The outer cgroup reserves 128 tasks for gVisor sentry/gofer processes.
  • Idle generations remain for FORMLESS_PLUGIN_IDLE_GRACE_SECONDS before teardown.
  • Unreferenced OCI cache content is bounded by FORMLESS_PLUGIN_IMAGE_CACHE_MIB.

Hundreds of installed plugins are reasonable because only demanded, admitted generations run. Use on-demand mode by default; pin only services requiring continuous availability.