--- title: From microservice to subprocess | daily.dev description: Instead of spinning up a separate microservice for resource-intensive or security-sensitive tasks like image processing, you can build a standalone CLI tool... canonical: https://daily.dev/posts/from-microservice-to-subprocess-bkglycvnz twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: From microservice to subprocess | daily.dev og:description: Instead of spinning up a separate microservice for resource-intensive or security-sensitive tasks like image processing, you can build a standalone CLI tool... og:url: https://daily.dev/posts/from-microservice-to-subprocess-bkglycvnz og:image: https://api.daily.dev/og/posts/bKgLyCVnz.png og:image:alt: From microservice to subprocess og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # From microservice to subprocess **[Sylvain Kerkour](https://daily.dev/sources/kerkour)** · 2 min read · 0 upvotes · 0 comments ## Summary Instead of spinning up a separate microservice for resource-intensive or security-sensitive tasks like image processing, you can build a standalone CLI tool (e.g., in Rust) and spawn it as a subprocess from your monolith. The tool reads input via STDIN, accepts JSON parameters as arguments, writes output to STDOUT, and uses landlock for sandboxing. The binary is bundled into the same Docker image, eliminating the need for RPC, service discovery, or Kubernetes. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How can I run image processing in a sandboxed subprocess from my monolith instead of creating a separate microservice? Build a standalone CLI tool (e.g., in Rust) that reads image data from STDIN, accepts operation parameters as a JSON argument, and writes the result to STDOUT. Use landlock for sandboxing. Bundle the binary into your monolith's Docker image and spawn it with exec(), passing the image buffer to its STDIN and reading the result from STDOUT. No RPC, service mesh, or Kubernetes required. _Developers keeping their monolith intact while isolating risky workloads share patterns like this on daily.dev._ ### What is landlock and how is it used for sandboxing a Rust subprocess? Landlock is a Linux security module that restricts what resources a process can access, usable from Rust via the rust-landlock crate (github.com/landlock-lsm/rust-landlock). It lets you confine a subprocess — such as an image-processing CLI tool — so that even if it is exploited, it cannot access the broader filesystem or network, providing strong isolation without a separate container or VM. _Teams hardening their Rust tooling against remote exploits track crate-level security patterns on daily.dev._ ## Similar posts on daily.dev - [Small and secure Docker images for Rust: scratch vs alpine vs debian](https://daily.dev/posts/small-and-secure-docker-images-for-rust-scratch-vs-alpine-vs-debian-31lvdlshh) · Sylvain Kerkour · 0 upvotes · 0 comments - [We rebuilt the Linux microVM stack on Apple Silicon](https://daily.dev/posts/we-rebuilt-the-linux-microvm-stack-on-apple-silicon-2hmxgetth) · Encore · 21 upvotes · 2 comments --- Tags: [#rust](https://daily.dev/tags/rust), [#microservices](https://daily.dev/tags/microservices), [#image-processing](https://daily.dev/tags/image-processing), [#monolith](https://daily.dev/tags/monolith) [View this post on daily.dev](https://daily.dev/posts/from-microservice-to-subprocess-bkglycvnz) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"From microservice to subprocess","url":"https://daily.dev/posts/from-microservice-to-subprocess-bkglycvnz","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/from-microservice-to-subprocess-bkglycvnz"},"datePublished":"2026-08-11T08:56:21.913Z","dateModified":"2026-08-11T09:37:54.324Z","description":"Instead of spinning up a separate microservice for resource-intensive or security-sensitive tasks like image processing, you can build a standalone CLI tool...","image":"https://media.daily.dev/image/upload/s--OHB84bZF--/f_auto/v1722860399/public/Placeholder%2010","thumbnailUrl":"https://media.daily.dev/image/upload/s--OHB84bZF--/f_auto/v1722860399/public/Placeholder%2010","isAccessibleForFree":true,"articleSection":"Sylvain Kerkour","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Sylvain Kerkour","logo":"https://media.daily.dev/image/upload/s--3ngWt4Yp--/f_auto,q_auto/v1786438308/logos/kerkour?_a=BAMAMicg0","url":"https://daily.dev/sources/kerkour"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/from-microservice-to-subprocess-bkglycvnz","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"rust,microservices,image-processing,monolith","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Sylvain Kerkour","item":"https://daily.dev/sources/kerkour"},{"@type":"ListItem","position":3,"name":"From microservice to subprocess"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/from-microservice-to-subprocess-bkglycvnz#faq","mainEntity":[{"@type":"Question","name":"How can I run image processing in a sandboxed subprocess from my monolith instead of creating a separate microservice?","acceptedAnswer":{"@type":"Answer","text":"Build a standalone CLI tool (e.g., in Rust) that reads image data from STDIN, accepts operation parameters as a JSON argument, and writes the result to STDOUT. Use landlock for sandboxing. Bundle the binary into your monolith's Docker image and spawn it with exec(), passing the image buffer to its STDIN and reading the result from STDOUT. No RPC, service mesh, or Kubernetes required. Developers keeping their monolith intact while isolating risky workloads share patterns like this on daily.dev."}},{"@type":"Question","name":"What is landlock and how is it used for sandboxing a Rust subprocess?","acceptedAnswer":{"@type":"Answer","text":"Landlock is a Linux security module that restricts what resources a process can access, usable from Rust via the rust-landlock crate (github.com/landlock-lsm/rust-landlock). It lets you confine a subprocess — such as an image-processing CLI tool — so that even if it is exploited, it cannot access the broader filesystem or network, providing strong isolation without a separate container or VM. Teams hardening their Rust tooling against remote exploits track crate-level security patterns on daily.dev."}}]} ```