UDFs are run as containerized. A containerized UDF runs in an Open Container Initiative (OCI) container that strictly controls access to machine resources such as disk, network, and memory. UDFs running in this environment have access only to resources that are specifically granted to the UDF through the container.

For development purposes, a non-containerized UDF mode still exists, but lacks the access controls of the container to machine resources and allows UDF code to access server resources. Security concerns apply specifically to Python UDFs as Actian Ingres does not impose any limits on the execution by Python code users. This runtime mode is deprecated and will not be supported going forward.