Salambo deployments use managed images. This gives the platform authority over runtime compatibility, security updates, isolation, and immutable base-image provenance.

​
Configuration

Declare managed mode in salambo.yaml: 
image:
  mode: managed
A local project Dockerfile is not used by the hosted build.

​
What builders control

NeedSupported surface
Agent behavioragent/
New-run workspace seedsandbox/workspace/
Supported runtime packagessandbox/packages.mjs
Region, networking and stateruntimeConfig
Environment and secretsenv and secrets
Salambo combines those inputs with an approved immutable runtime base and records the resulting deployment provenance.

​
Runtime updates

When the run Details view shows Runtime update recommended, deploy the agent again so it receives the current managed runtime. Treat that warning as upgrade work; do not depend on an older runtime image as a permanent execution environment. Continue with environment variables and secrets or networking and regions.