Documentation / Advanced
Pin a runtime and resource pool
Polyglot handlers share one JSON boundary. Resource-group admission and process isolation are separate from application code.
Select an installed runtime group
The pinned python-standard profile uses Python 3.13. Standard profiles span *-light (512 MiB worker, 240–288 MiB slice, 30s timeout), *-standard (1–2 GiB worker, 608–1,280 MiB slice, 120s), and *-heavy (4 GiB worker, ~3 GiB slice, 300s). CPU is proportional to worker memory (1,769 MiB = 1 vCPU; slices share container vCPUs without cgroup throttling). Workloads exceeding 3,072 MiB can use mode: sync_lambda (up to 10 GiB, 15m) or asynchronous external callbacks. Published workflows pin group configuration; per-phase memory overrides are rejected. Internal contract ↗
{
"runtime": "python",
"runtimeVersion": "3.13",
"group": "python-standard"
}Complete example · JSON / YAML
JSON
{
"name": "advanced-runtime-groups",
"version": "1.0.0",
"lanes": {
"inline": {
"mode": "sync_lambda",
"target": "lambda://local-inline"
}
},
"phases": {
"work": {
"service": "hello",
"lane": "inline",
"scope": "root",
"terminal": true,
"runtime": "python",
"runtimeVersion": "3.13",
"group": "python-standard"
}
}
}YAML
name: advanced-runtime-groups
version: 1.0.0
lanes:
inline:
mode: sync_lambda
target: lambda://local-inline
phases:
work:
service: hello
lane: inline
scope: root
terminal: true
runtime: python
runtimeVersion: "3.13"
group: python-standardrippflow controls validate advanced-resources.workflow.yaml --jsonExpected: ok: true. This checks the contract; deployment/enforcement is separate.
Verify handler artifacts
Bind the artifact URI, entrypoint and SHA-256 to approved deployment metadata. The sample checksum is a placeholder, not a usable release artifact.
{
"handlerUri": "s3://example-artifacts/processor.py",
"handlerSha256": "0000000000000000000000000000000000000000000000000000000000000000",
"entrypoint": "processor.py"
}Complete example · JSON / YAML
JSON
{
"name": "advanced-artifacts",
"version": "1.0.0",
"lanes": {
"inline": {
"mode": "sync_lambda",
"target": "lambda://local-inline"
}
},
"phases": {
"work": {
"service": "hello",
"lane": "inline",
"scope": "root",
"terminal": true,
"runtime": "python",
"runtimeVersion": "3.12",
"handlerUri": "s3://example-artifacts/processor.py",
"handlerSha256": "0000000000000000000000000000000000000000000000000000000000000000",
"entrypoint": "processor.py"
}
}
}YAML
name: advanced-artifacts
version: 1.0.0
lanes:
inline:
mode: sync_lambda
target: lambda://local-inline
phases:
work:
service: hello
lane: inline
scope: root
terminal: true
runtime: python
runtimeVersion: "3.12"
handlerUri: s3://example-artifacts/processor.py
handlerSha256: "0000000000000000000000000000000000000000000000000000000000000000"
entrypoint: processor.pyrippflow controls validate advanced-artifacts.workflow.yaml --jsonExpected: ok: true. This checks the contract; deployment/enforcement is separate.
Measure local handlers
Use profiling before choosing a resource group. Docker is a development wrapper, not a tenant security boundary. The polyglot recipe exercises all four runtimes.
The handler contract uses argument-array manifests and one JSON context/outcome on stdin/stdout.
Download the local workflow, manifest and handler together.
rippflow dev hello.workflow.json --handlers handlers.json --profile --report profile.jsonAudit gap: managed workspaces
The older managed-workspace guide names runner/src/workspace.rs, but that module and its documented phase API are absent from pinned main. Do not rely on workspace.enabled or a managed cleanup/quota guarantee. Existing artifact caches and temporary-directory use do not establish that API.
Verified sources
Checked 2026-11-05.
- runtime_catalog.rs 04cb082 · main
- handler_loader.rs 6495ab9 · main
- runtime_groups.rs 04cb082 · main
- memory_isolation.rs 6495ab9 · main
- profiler.rs 7f5ea32 · main
- docker.rs 7f5ea32 · main
- handler-temporary-workspaces.md 3a3be99 · main
- handlers.schema.json 7f5ea32 · main