Who This Article Is For Primary Audience: DevOps Engineers, System Administrators, SRE Teams, Backend Developers managing Linux infrastructure Primary Audience: Prerequisites: Prerequisites: Basic Linux command-line experience
Understanding of SSH and remote server management
Familiarity with systemd services
Basic knowledge of TLS/SSL certificates (helpful but not required) Basic Linux command-line experience Understanding of SSH and remote server management Familiarity with systemd services systemd Basic knowledge of TLS/SSL certificates (helpful but not required) What is Joblet? Joblet is a lightweight process isolation platform that lets you run commands and scripts in secure, resource-controlled environments. Think of it as a simpler alternative to Docker for process execution - no containers needed, just a single binary that provides: Secure isolation using Linux namespaces
Resource limits for CPU, memory, and I/O
Real-time Process monitoring and log streaming
gRPC API with authentication
Simple CLI for easy interaction Secure isolation using Linux namespaces Secure isolation Resource limits for CPU, memory, and I/O Resource limits Real-time Process monitoring and log streaming Real-time Process monitoring gRPC API with authentication gRPC API Simple CLI for easy interaction Simple CLI Whether you're building a CI/CD system, running user code safely, or need isolated task execution, Joblet provides a clean, production-ready solution. Why Use Joblet? Before vs After Scenarios Let's see how Joblet transforms common development and operations challenges with real examples: 🔍 System Call Isolation in Action 🔍 System Call Isolation in Action ❌ Without Joblet: Direct Host Execution (Dangerous) # Running ps aux directly on the host shows ALL system processes

$ ps aux
USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root           1  0.0  0.3 167744 13132 ?        Ss   Jun26   0:11 /sbin/init
root           2  0.0  0.0      0     0 ?        S    Jun26   0:00 [kthreadd]
systemd+     564  0.0  0.2  90096  5392 ?        Ss   Jun26   0:00 /lib/systemd/systemd-resolved
messagebus   565  0.0  0.1   8808  3840 ?        Ss   Jun26   0:02 /usr/bin/dbus-daemon --system
joblet      1234  0.1  0.5 123456 10240 ?        Sl   Jun26   1:23 /opt/joblet/joblet
postgres    2345  0.0  1.2 456789 25600 ?        S    Jun26   0:45 postgres: main process
mysql       3456  0.2  2.1 789012 43520 ?        Sl   Jun26   2:10 mysqld --datadir=/var/lib/mysql
apache2     4567  0.0  0.8 234567 16384 ?        S    Jun26   0:30 /usr/sbin/apache2 -DFOREGROUND
...
user        9999  0.0  0.0  10072  1608 pts/2    R+   17:37   0:00 ps aux # Running ps aux directly on the host shows ALL system processes

$ ps aux
USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root           1  0.0  0.3 167744 13132 ?        Ss   Jun26   0:11 /sbin/init
root           2  0.0  0.0      0     0 ?        S    Jun26   0:00 [kthreadd]
systemd+     564  0.0  0.2  90096  5392 ?        Ss   Jun26   0:00 /lib/systemd/systemd-resolved
messagebus   565  0.0  0.1   8808  3840 ?        Ss   Jun26   0:02 /usr/bin/dbus-daemon --system
joblet      1234  0.1  0.5 123456 10240 ?        Sl   Jun26   1:23 /opt/joblet/joblet
postgres    2345  0.0  1.2 456789 25600 ?        S    Jun26   0:45 postgres: main process
mysql       3456  0.2  2.1 789012 43520 ?        Sl   Jun26   2:10 mysqld --datadir=/var/lib/mysql
apache2     4567  0.0  0.8 234567 16384 ?        S    Jun26   0:30 /usr/sbin/apache2 -DFOREGROUND
...
user        9999  0.0  0.0  10072  1608 pts/2    R+   17:37   0:00 ps aux Security Issues: Security Issues: Process can see ALL system processes (including sensitive services)
Has access to process details, PIDs, and resource usage
Can potentially interact with or signal other processes
No isolation from host system resources Process can see ALL system processes (including sensitive services) Has access to process details, PIDs, and resource usage Can potentially interact with or signal other processes No isolation from host system resources ✅ With Joblet ✅ With Joblet # Running the same command through Joblet shows ONLY the job's process
$ rnx run ps aux
Job started:
ID: 120
Command: ps aux
Status: RUNNING
StartTime: 2025-01-15T17:34:33Z

$ rnx log 120   
USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
0              1  0.0  0.0  10044  1580 ?        R    17:34   0:00 ps aux # Running the same command through Joblet shows ONLY the job's process
$ rnx run ps aux
Job started:
ID: 120
Command: ps aux
Status: RUNNING
StartTime: 2025-01-15T17:34:33Z

$ rnx log 120   
USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
0              1  0.0  0.0  10044  1580 ?        R    17:34   0:00 ps aux Security Benefits: Security Benefits: Job sees ONLY its own process (PID 1 in isolated namespace)
Cannot discover or interact with host processes
Complete process isolation from host system
Protected from interference by other jobs Job sees ONLY its own process (PID 1 in isolated namespace) Cannot discover or interact with host processes Complete process isolation from host system Protected from interference by other jobs Quick Start: Your First Job (Process) Installation # Download the latest release
wget $(curl -s https://api.github.com/repos/ehsaniara/joblet/releases/latest | grep "browser_download_url.*_amd64\.deb" | cut -d '"' -f 4)

# Interactive installation (recommended - prompts for server IP)
sudo dpkg -i joblet_*_amd64.deb

# Start the service
sudo systemctl start joblet
sudo systemctl enable joblet

# test locally
rnx --config=/opt/joblet/config/rnx-config.yml list # Download the latest release
wget $(curl -s https://api.github.com/repos/ehsaniara/joblet/releases/latest | grep "browser_download_url.*_amd64\.deb" | cut -d '"' -f 4)

# Interactive installation (recommended - prompts for server IP)
sudo dpkg -i joblet_*_amd64.deb

# Start the service
sudo systemctl start joblet
sudo systemctl enable joblet

# test locally
rnx --config=/opt/joblet/config/rnx-config.yml list That's it! Joblet is now running as a system service with auto-generated SSL certificates. Your First Process # Run a simple command
rnx run echo "Hello from Joblet!"

# Output:
# Job started:
# ID: 1
# Command: echo Hello from Joblet!
# Status: RUNNING
# StartTime: 2024-01-15T10:30:45Z
# Network: host (shared with system) # Run a simple command
rnx run echo "Hello from Joblet!"

# Output:
# Job started:
# ID: 1
# Command: echo Hello from Joblet!
# Status: RUNNING
# StartTime: 2024-01-15T10:30:45Z
# Network: host (shared with system) Congratulations! You just ran your first isolated job. Essential Commands Running Jobs The rnx run command is your main interface for job execution: rnx run # Basic command
rnx run ls -la

# Python script
rnx run python3 -c "print('Hello from Python!')"

# With resource limits
rnx run --max-cpu=50 --max-memory=256 stress-ng --cpu 1 --timeout 30s

# Complex shell commands
rnx run bash -c "for i in {1..5}; do echo 'Iteration $i'; sleep 1; done" # Basic command
rnx run ls -la

# Python script
rnx run python3 -c "print('Hello from Python!')"

# With resource limits
rnx run --max-cpu=50 --max-memory=256 stress-ng --cpu 1 --timeout 30s

# Complex shell commands
rnx run bash -c "for i in {1..5}; do echo 'Iteration $i'; sleep 1; done" Resource Limits Explained: Resource Limits Explained: --max-cpu=N - CPU percentage (50 = 50% of one core)
--max-memory=N - Memory limit in MB
--max-iobps=N - I/O operations per second limit --max-cpu=N - CPU percentage (50 = 50% of one core) --max-cpu=N --max-memory=N - Memory limit in MB --max-memory=N --max-iobps=N - I/O operations per second limit --max-iobps=N Monitoring Jobs # List all jobs
rnx list

# Output:
# 1 COMPLETED StartTime: 2024-01-15T10:30:45Z Command: echo Hello from Joblet!
# 2 RUNNING StartTime: 2024-01-15T10:31:20Z Command: sleep 60
# 3 FAILED StartTime: 2024-01-15T10:32:10Z Command: invalid-command

# Get detailed job status
rnx status 2

# Output:
# Id: 2
# Command: sleep 60
# ExitCode: 0
# Started At: 2024-01-15T10:31:20Z
# Ended At: 
# Status: RUNNING
# MaxCPU: 100
# MaxMemory: 512
# MaxIOBPS: 0 # List all jobs
rnx list

# Output:
# 1 COMPLETED StartTime: 2024-01-15T10:30:45Z Command: echo Hello from Joblet!
# 2 RUNNING StartTime: 2024-01-15T10:31:20Z Command: sleep 60
# 3 FAILED StartTime: 2024-01-15T10:32:10Z Command: invalid-command

# Get detailed job status
rnx status 2

# Output:
# Id: 2
# Command: sleep 60
# ExitCode: 0
# Started At: 2024-01-15T10:31:20Z
# Ended At: 
# Status: RUNNING
# MaxCPU: 100
# MaxMemory: 512
# MaxIOBPS: 0 Real-time Log Streaming One of Joblet's killer features is real-time log streaming: # Stream logs from a running job
rnx log 2

# Output streams in real-time:
# Logs for job 2 (Press Ctrl+C to exit if streaming):
# Starting process...
# Processing data...
# Step 1 complete
# Step 2 complete
# ... # Stream logs from a running job
rnx log 2

# Output streams in real-time:
# Logs for job 2 (Press Ctrl+C to exit if streaming):
# Starting process...
# Processing data...
# Step 1 complete
# Step 2 complete
# ... The log command automatically follows the output until the job completes or you press Ctrl+C. Configuration and Customization Server Configuration Joblet's behavior can be customized via configuration file at /opt/joblet/config/joblet-config.yml: /opt/joblet/config/joblet-config.yml server:
  address: "0.0.0.0"
  port: 50051

joblet:
  defaultCpuLimit: 100        # Default CPU limit (100%)
  defaultMemoryLimit: 512     # Default memory limit (512MB)
  defaultIoLimit: 0           # No I/O limit by default
  maxConcurrentJobs: 50       # Max simultaneous jobs
  jobTimeout: "1h"            # Job timeout
  validateCommands: true      # Enable command validation

security:
  # Certificates embedded here automatically
  serverCert: |
    -----BEGIN CERTIFICATE-----
    ...
  serverKey: |
    -----BEGIN PRIVATE KEY-----
    ...
  caCert: |
    -----BEGIN CERTIFICATE-----
    ...

logging:
  level: "INFO"               # DEBUG, INFO, WARN, ERROR
  format: "text"              # text or json
  output: "stdout"            # stdout or file path server:
  address: "0.0.0.0"
  port: 50051

joblet:
  defaultCpuLimit: 100        # Default CPU limit (100%)
  defaultMemoryLimit: 512     # Default memory limit (512MB)
  defaultIoLimit: 0           # No I/O limit by default
  maxConcurrentJobs: 50       # Max simultaneous jobs
  jobTimeout: "1h"            # Job timeout
  validateCommands: true      # Enable command validation

security:
  # Certificates embedded here automatically
  serverCert: |
    -----BEGIN CERTIFICATE-----
    ...
  serverKey: |
    -----BEGIN PRIVATE KEY-----
    ...
  caCert: |
    -----BEGIN CERTIFICATE-----
    ...

logging:
  level: "INFO"               # DEBUG, INFO, WARN, ERROR
  format: "text"              # text or json
  output: "stdout"            # stdout or file path After changing configuration: sudo systemctl restart joblet sudo systemctl restart joblet Client Configuration Point the CLI to a different server: # Connect to remote Joblet instance
rnx --server 192.168.1.100:50051 run echo "Hello from remote!"

# Or set it as default
export JOBLET_SERVER=192.168.1.100:50051
rnx run echo "Using environment variable" # Connect to remote Joblet instance
rnx --server 192.168.1.100:50051 run echo "Hello from remote!"

# Or set it as default
export JOBLET_SERVER=192.168.1.100:50051
rnx run echo "Using environment variable" Security and Authentication Certificate Management Joblet uses mTLS for security. Certificates are auto-generated during installation, but you can regenerate them: # Regenerate all certificates
sudo /usr/local/bin/certs_gen.sh

# This creates:
# - CA certificate
# - Server certificate 
# - Admin client certificate (full access)
# - Viewer client certificate (read-only access) # Regenerate all certificates
sudo /usr/local/bin/certs_gen.sh

# This creates:
# - CA certificate
# - Server certificate 
# - Admin client certificate (full access)
# - Viewer client certificate (read-only access) Role-Based Access Joblet supports two roles via certificate organizational units: Admin Role (full access): Admin Role Run jobs
Stop jobs
View job status and logs
List all jobs Run jobs Stop jobs View job status and logs List all jobs Viewer Role (read-only): Viewer Role View job status and logs
List all jobs
Cannot run or stop jobs View job status and logs List all jobs Cannot run or stop jobs The role is determined by the OU field in the client certificate. OU Monitoring and Troubleshooting Service Status # Check Joblet service status
sudo systemctl status joblet

# View service logs
sudo journalctl -u joblet -f

# Check resource usage
sudo systemctl show joblet --property=CPUUsageNSec,MemoryCurrent # Check Joblet service status
sudo systemctl status joblet

# View service logs
sudo journalctl -u joblet -f

# Check resource usage
sudo systemctl show joblet --property=CPUUsageNSec,MemoryCurrent Job Debugging # Check job output for failed jobs
rnx status <job-id>
rnx log <job-id>

# List recent jobs with status
rnx list | head -10

# Monitor active jobs
watch -n 2 'rnx list | grep RUNNING' # Check job output for failed jobs
rnx status <job-id>
rnx log <job-id>

# List recent jobs with status
rnx list | head -10

# Monitor active jobs
watch -n 2 'rnx list | grep RUNNING' Performance Tips Resource Limits: Always set appropriate limits to prevent runaway jobs
Concurrent Jobs: Monitor system resources when running many parallel jobs
Log Management: Long-running jobs can generate large logs - consider log rotation
Cleanup: Joblet automatically cleans up completed jobs, but monitor disk space Resource Limits: Always set appropriate limits to prevent runaway jobs Resource Limits Concurrent Jobs: Monitor system resources when running many parallel jobs Concurrent Jobs Log Management: Long-running jobs can generate large logs - consider log rotation Log Management Cleanup: Joblet automatically cleans up completed jobs, but monitor disk space Cleanup Comparison with Alternatives Feature

Joblet

Docker

Systemd



Setup Complexity

Simple

Moderate

Complex



Resource Isolation

✅

✅

Limited



Network Isolation

Optional

✅

❌



Filesystem Isolation

✅

✅

❌



Real-time Logs

✅

Manual

Manual



Job API

✅

Manual

❌



Single Binary

✅

❌

❌ Feature

Joblet

Docker

Systemd



Setup Complexity

Simple

Moderate

Complex



Resource Isolation

✅

✅

Limited



Network Isolation

Optional

✅

❌



Filesystem Isolation

✅

✅

❌



Real-time Logs

✅

Manual

Manual



Job API

✅

Manual

❌



Single Binary

✅

❌

❌ Feature

Joblet

Docker

Systemd Feature Feature Joblet Joblet Docker Docker Systemd Systemd Setup Complexity

Simple

Moderate

Complex Setup Complexity Setup Complexity Simple Simple Moderate Moderate Complex Complex Resource Isolation

✅

✅

Limited Resource Isolation Resource Isolation ✅ ✅ ✅ ✅ Limited Limited Network Isolation

Optional

✅

❌ Network Isolation Network Isolation Optional Optional ✅ ✅ ❌ ❌ Filesystem Isolation

✅

✅

❌ Filesystem Isolation Filesystem Isolation ✅ ✅ ✅ ✅ ❌ ❌ Real-time Logs

✅

Manual

Manual Real-time Logs Real-time Logs ✅ ✅ Manual Manual Manual Manual Job API

✅

Manual

❌ Job API Job API ✅ ✅ Manual Manual ❌ ❌ Single Binary

✅

❌

❌ Single Binary Single Binary ✅ ✅ ❌ ❌ ❌ ❌ Getting Help Documentation: Check the GitHub repository
Issues: Report bugs and feature requests on GitHub
Logs: Always check sudo journalctl -u joblet for service issues
Community: Join discussions in the project's GitHub issues Documentation: Check the GitHub repository Documentation GitHub repository Issues: Report bugs and feature requests on GitHub Issues Logs: Always check sudo journalctl -u joblet for service issues Logs sudo journalctl -u joblet Community: Join discussions in the project's GitHub issues Community Conclusion Joblet provides a clean, simple way to run isolated jobs without the complexity of container orchestration. Whether you're processing data, running tests, or executing user code, Joblet's combination of security, simplicity, and real-time monitoring makes it an excellent choice for job execution. Key takeaways: Installation is simple: One package, automatic configuration
Usage is intuitive: Familiar command-line interface
Security is built-in: Namespace isolation and mTLS authentication
Monitoring is real-time: Stream logs and monitor resource usage
Integration is straightforward: gRPC API for programmatic access Installation is simple: One package, automatic configuration Installation is simple Usage is intuitive: Familiar command-line interface Usage is intuitive Security is built-in: Namespace isolation and mTLS authentication Security is built-in Monitoring is real-time: Stream logs and monitor resource usage Monitoring is real-time Integration is straightforward: gRPC API for programmatic access Integration is straightforward Start with simple commands, experiment with resource limits, and gradually integrate Joblet into your workflows. The platform is designed to grow with your needs while maintaining simplicity and security. GitHub https://github.com/ehsaniara/joblet?embedable=true https://github.com/ehsaniara/joblet?embedable=true

How to Use Joblet: Secure Linux Process Execution Made Simple

About Author

Comments

TOPICS

THIS ARTICLE WAS FEATURED IN

Related Stories

Evaluating Amazon S3 as a Vector Store for RAG Systems: Constraints and Performance Boundaries

16 Commands For Every Use Case to Set Up React Apps in Seconds ⚡🚀

31 Stories To Learn About Command Line

42 Stories To Learn About Terminal

53 Stories To Learn About Cli

9 Useful Interactive CLI Tools for Linux

Evaluating Amazon S3 as a Vector Store for RAG Systems: Constraints and Performance Boundaries

16 Commands For Every Use Case to Set Up React Apps in Seconds ⚡🚀

31 Stories To Learn About Command Line

42 Stories To Learn About Terminal

53 Stories To Learn About Cli

9 Useful Interactive CLI Tools for Linux

Light-Mode

Classic

Newspaper

Minty

Dark-Mode

Neon Noir

Minty

HN StartUps