> ## Documentation Index
> Fetch the complete documentation index at: https://docs.zap.wzrd.tech/llms.txt
> Use this file to discover all available pages before exploring further.

# Namespace

> Linux container instances and native macOS Apple-silicon instances behind a two-token bridge.

<img src="https://mintcdn.com/gratitude5dee-zap-56/Y4G9H4edehsua_Ul/images/logos/namespace.svg?fit=max&auto=format&n=Y4G9H4edehsua_Ul&q=85&s=cf23f95bc5cbd354314d8081bfd7fcb9" alt="Namespace" style={{ height: "32px", width: "auto" }} noZoom width="160" height="160" data-path="images/logos/namespace.svg" />

Namespace runs Zap runtimes as Linux container instances (the `zap-heavy` image) or native macOS Apple-silicon instances (the `env-macos` environment).

## Endpoints

* Compute: `https://compute.namespaceapis.com` (instance lifecycle).
* IAM: `https://iam.namespaceapis.com` — `IssueIngressAccessToken` mints the ingress token; the adapter caches it for 5 minutes.

## Auth model

Bridge requests carry **both** headers, so neither token alone reaches the instance:

* `x-nsc-ingress-auth: <ingress token>` — checked by the Namespace ingress.
* `X-Zap-Bridge-Token: <RUNTIME_TOKEN>` — checked by `zap-agentd` (Linux) or the control bridge (native macOS).

## Per-instance env

Every instance is created with `TENANT_ID`, `RUNTIME_ID`, and `RUNTIME_TOKEN`; missing values fail before any request.

## Unverified RPCs

RPC shapes not yet confirmed live stay behind the `allowUnverifiedRpcs` flag and are reported by `doctor()` as `unverified` — never silently assumed.

## Capabilities

| capability          | value                                         |
| ------------------- | --------------------------------------------- |
| isolation           | `vm`                                          |
| stop/resume         | yes                                           |
| ports               | yes (ingress-authenticated; no private ports) |
| kvm / docker        | yes                                           |
| snapshot / fork     | no                                            |
| max command seconds | 3600                                          |