Definition
A short-lived execution environment created for a task or run and destroyed when that work ends. It may be a container, virtual machine, sandbox, worktree, or hosted workspace with a fresh filesystem and a bounded set of credentials, tools, dependencies, and network routes.
Ephemerality reduces persistent residue and makes runs easier to reproduce from declared inputs. It can limit contamination between tasks, simplify cleanup, and make rollback as simple as discarding the environment. A well-designed run preserves only the artifacts, logs, evidence, and approved state transitions that need to outlive it.
What destruction does not solve
A temporary environment can still exfiltrate data, damage an external service, poison shared caches, leak credentials, or publish a malicious artifact before deletion. It may also rebuild the same compromise on every run if its base image, dependency source, or bootstrap instructions are unsafe. Isolation, least privilege, egress control, provenance, and trusted reconstruction remain separate controls.
Distinguish it from nearby terms
A sandbox restricts what code can access. Ephemerality limits how long the environment persists. An isolated environment can be long-lived, and a short-lived environment can have broad network and credential access. A clean-room claim additionally depends on trusted images, dependencies, inputs, and bootstrap steps.
Check your understanding
Every run starts in a new container, but downloads the same compromised setup script and can write to the package registry. Is the system safe because the container disappears? No. Verify the base and bootstrap chain, restrict external authority, and preserve evidence of what the run published.