Dynamic Loading / Spawning More Workers

[lstanden]

I’m trying to understand if it’s possible to dynamically define new functions/workers with different access than the “main” function? Like a main function that’s allowed full access, but spawning workers on demand that have basically zero access, including network.
The use case I’m exploring is an internal facing platform which provides baked in tooling to support many internal use cases, like our bespoke authentication and service to service request signing.

[kentonv]

In the workerd config file, you can declare multiple services, each running different code. You can fully control whether a service has access to the outside world. In particular, you can disable access to the internet by overriding globalOutbound to point at another service; calls to fetch will then all be redirected to that other service, which can filter them or even just reject them all.

So you can have one service that acts as a "supervisor" and has access to the internet, but forwards requests to some other service that doesn't.

[lstanden]

That doesn't quite answer it... I'm looking at how I can spin up brand new services that didn't exist when the process started up... dynamic configuration of services if you will.