I investigated the execution environment of Lambda Web Functions

vCPU  7,200 vCPU-seconds × $0.0000322421 = $0.2321
Memory 3,600 GB-seconds × $0.0000042688 = $0.0154
Total (100% utilization) = $0.2475 / hour

Utilization at which cost equals EC2
($0.0910 − $0.0154) ÷ $0.2321 = 0.326 (32.6%)

3,538 MB ÷ 1,024 = 3.455 GB
3.455 GB × 3,600 seconds = 12,438 GB-seconds
12,438 GB-seconds × $0.0000133334 = $0.1658

import http from 'node:http';
import fs from 'node:fs';
import os from 'node:os';
import path from 'node:path';
import { spawnSync } from 'node:child_process';

// Diagnostic app for a Lambda Web Function. Read-only except for /tmp.
// - Only fixed paths and a fixed command allowlist are used. No request data reaches a path or a command.
// - Environment variables and /proc/self/environ are never read or returned.
const port = Number(process.env.LOCAL_PORT ?? 3000);
const HOSTNAME = os.hostname();
const SECRET_NAME = /serial|uuid/i; // values of these files are replaced by their length

type FileResult = { path: string; ok: boolean; bytes?: number; text?: string; truncated?: boolean; error?: string };

const readCapped = (p: string, cap = 16384): FileResult => {
  let fd: number | undefined;
  try {
    fd = fs.openSync(p, 'r');
    const buf = Buffer.alloc(cap + 1);
    const n = fs.readSync(fd, buf, 0, cap + 1, null);
    const truncated = n > cap;
    const text = buf.subarray(0, Math.min(n, cap)).toString('utf8');
    if (SECRET_NAME.test(path.basename(p))) return { path: p, ok: true, bytes: n, text: `<redacted by app: ${n} bytes>` };
    return { path: p, ok: true, bytes: n, text, truncated };
  } catch (e) {
    return { path: p, ok: false, error: (e as NodeJS.ErrnoException).code ?? String(e) };
  } finally {
    if (fd !== undefined) try { fs.closeSync(fd); } catch { /* ignore */ }
  }
};

// Read the regular files directly under `dir`; list (but do not read) sub-entries. Optionally recurse.
const dumpDir = (dir: string, depth: number, readLimit = 200): unknown => {
  let names: string[];
  try { names = fs.readdirSync(dir).sort(); } catch (e) { return { dir, ok: false, error: (e as NodeJS.ErrnoException).code ?? String(e) }; }
  const files: FileResult[] = [];
  const subdirs: string[] = [];
  const links: Record<string, string> = {};
  const children: unknown[] = [];
  for (const name of names) {
    const full = path.join(dir, name);
    let st: fs.Stats;
    try { st = fs.lstatSync(full); } catch (e) { files.push({ path: full, ok: false, error: (e as NodeJS.ErrnoException).code ?? String(e) }); continue; }
    if (st.isSymbolicLink()) { try { links[name] = fs.readlinkSync(full); } catch { links[name] = '?'; } continue; }
    if (st.isDirectory()) {
      subdirs.push(name);
      if (depth > 0) children.push(dumpDir(full, depth - 1, readLimit));
      continue;
    }
    if (files.length < readLimit) files.push(readCapped(full, 4096));
  }
  return { dir, ok: true, subdirs, links, files, children };
};

const statfs = (p: string) => {
  try {
    const s = fs.statfsSync(p, { bigint: true });
    const bs = s.bsize;
    return {
      path: p, type: `0x${s.type.toString(16)}`, bsize: Number(bs), blocks: Number(s.blocks), bfree: Number(s.bfree), bavail: Number(s.bavail),
      files: Number(s.files), ffree: Number(s.ffree),
      totalBytes: Number(s.blocks * bs), freeBytes: Number(s.bfree * bs), availBytes: Number(s.bavail * bs),
    };
  } catch (e) { return { path: p, error: (e as NodeJS.ErrnoException).code ?? String(e) }; }
};

const modeInfo = (p: string) => {
  try { const st = fs.lstatSync(p); return { path: p, mode: (st.mode & 0o7777).toString(8), uid: st.uid, gid: st.gid, size: st.size, symlink: st.isSymbolicLink() ? fs.readlinkSync(p) : undefined }; }
  catch (e) { return { path: p, error: (e as NodeJS.ErrnoException).code ?? String(e) }; }
};

// ---- A. files read directly by Node ----
const routeA = () => ({
  dmi: dumpDir('/sys/class/dmi/id', 0),
  hypervisor: dumpDir('/sys/hypervisor', 3),
  cpuinfo: readCapped('/proc/cpuinfo', 65536),
  cgroup: dumpDir('/sys/fs/cgroup', 0),
  cgroupSelf: readCapped('/proc/self/cgroup'),
  mountinfo: readCapped('/proc/self/mountinfo', 65536),
  status: readCapped('/proc/self/status'),
  extra: ['/proc/version', '/proc/meminfo', '/proc/self/limits', '/proc/self/uid_map', '/proc/self/gid_map', '/proc/sys/kernel/osrelease', '/etc/os-release', '/proc/cmdline', '/proc/sys/kernel/hostname']
    .map((p) => readCapped(p, 8192)),
});

// ---- C. what Node itself reports ----
const routeC = () => ({
  node: { version: process.version, arch: process.arch, platform: process.platform, versions: { v8: process.versions.v8, openssl: process.versions.openssl } },
  os: {
    arch: os.arch(), machine: os.machine(), platform: os.platform(), type: os.type(), release: os.release(), version: os.version(),
    totalmem: os.totalmem(), freemem: os.freemem(), uptimeSec: os.uptime(), loadavg: os.loadavg(),
    availableParallelism: os.availableParallelism(), cpuCount: os.cpus().length,
    cpus: os.cpus().map((c) => ({ model: c.model, speed: c.speed })),
    hostnameLength: HOSTNAME.length,
  },
  process: { pid: process.pid, uid: process.getuid?.(), gid: process.getgid?.(), groups: process.getgroups?.(), cwd: process.cwd(), dirname: __dirname, execPath: process.execPath, memoryUsage: process.memoryUsage() },
  statfs: ['/', '/tmp', '/var/tmp', '/dev/shm', __dirname].map(statfs),
  bundledModes: ['bin', 'lib'].flatMap((d) => { try { return fs.readdirSync(path.join(__dirname, d)).map((n) => modeInfo(path.join(__dirname, d, n))); } catch { return []; } }),
});

// ---- /tmp write test (only /tmp; file removed afterwards) ----
const routeTmpWrite = () => {
  const file = '/tmp/diag-fill.bin';
  const chunk = Buffer.alloc(64 * 1024 * 1024, 0x61);
  const capBytes = 2 * 1024 * 1024 * 1024;
  const before = statfs('/tmp');
  const started = Date.now();
  let written = 0;
  let stopped = 'cap';
  let error: string | undefined;
  try {
    const fd = fs.openSync(file, 'w');
    try {
      while (written < capBytes) {
        fs.writeSync(fd, chunk, 0, chunk.length);
        written += chunk.length;
      }
    } catch (e) { stopped = 'error'; error = (e as NodeJS.ErrnoException).code ?? String(e); }
    try { fs.fsyncSync(fd); } catch { /* ignore */ }
    fs.closeSync(fd);
  } catch (e) { stopped = 'open-error'; error = (e as NodeJS.ErrnoException).code ?? String(e); }
  let fileSize: number | undefined;
  try { fileSize = fs.statSync(file).size; } catch { /* ignore */ }
  const during = statfs('/tmp');
  try { fs.unlinkSync(file); } catch { /* ignore */ }
  return { capBytes, chunkBytes: chunk.length, chunksWritten: written / chunk.length, writtenBytes: written, fileSizeAfterBytes: fileSize, stopped, error, ms: Date.now() - started, statfsBefore: before, statfsDuringFileExists: during, statfsAfterDelete: statfs('/tmp') };
};

// ---- B. external commands (fixed allowlist) ----
const SPECS: Record<string, string[]> = {
  lscpu: [], lsblk: [], lsmem: [], findmnt: [], lsns: [], dmesg: [],
  free: ['-m'], ps: ['-eo', 'pid,ppid,user,comm'], df: ['-h'], uname: ['-a'],
};
const MULTICALL = new Set(['df', 'uname']); // coreutils-single: /usr/bin/coreutils --coreutils-prog=<name>
const SRC_BIN = path.join(__dirname, 'bin');
const SRC_LIB = path.join(__dirname, 'lib');
const DST = '/tmp/diag-bin';
const LOADER = 'ld-linux-aarch64.so.1';

const prepare = () => {
  const r: Record<string, unknown> = { dst: DST };
  try {
    fs.mkdirSync(path.join(DST, 'bin'), { recursive: true });
    fs.mkdirSync(path.join(DST, 'lib'), { recursive: true });
    for (const [src, sub] of [[SRC_BIN, 'bin'], [SRC_LIB, 'lib']] as const) {
      for (const n of fs.readdirSync(src)) {
        const to = path.join(DST, sub, n);
        fs.copyFileSync(path.join(src, n), to);
        fs.chmodSync(to, 0o755);
      }
    }
    r.ok = true;
  } catch (e) { r.ok = false; r.error = (e as NodeJS.ErrnoException).code ?? String(e); }
  return r;
};

const run = (variant: string, argv: string[]) => {
  const t = Date.now();
  const r = spawnSync(argv[0], argv.slice(1), { timeout: 30000, maxBuffer: 2 * 1024 * 1024, env: { PATH: '/usr/bin:/bin' }, encoding: 'utf8' });
  const cap = (s: string | null, n: number) => (s && s.length > n ? `${s.slice(0, n)}\n...[truncated ${s.length - n} chars]` : s ?? '');
  return {
    variant, argv: argv.map((a) => a.replace(DST, '<DST>').replace(__dirname, '<TASK>')),
    exitCode: r.status, signal: r.signal, spawnError: r.error ? `${(r.error as NodeJS.ErrnoException).code ?? ''} ${r.error.message}`.trim() : undefined,
    stdout: cap(r.stdout, 16384), stderr: cap(r.stderr, 4096), ms: Date.now() - t,
  };
};

// ---- openssl speed (fixed argument lists only; the number of processes is fixed per route) ----
const OSSL = path.join(DST, 'bin', 'openssl');
const osslArgv = (args: string[]) => [path.join(DST, 'lib', LOADER), '--library-path', path.join(DST, 'lib'), OSSL, ...args];
const cpuStat = () => (readCapped('/proc/stat', 4096).text ?? '').split('\n').filter((l) => /^cpu\d* /.test(l));
const BULK_ALGS = ['aes-128-gcm', 'aes-256-gcm', 'sha256', 'sha512', 'sha3-256', 'chacha20-poly1305'];
const BULK_SIZES = ['64', '16384'];

const osslSuite = (kind: 'bulk' | 'pk', multi: number) => {
  const prep = prepare();
  const multiArgs = multi > 1 ? ['-multi', String(multi)] : [];
  const argLists: string[][] = kind === 'bulk'
    ? BULK_ALGS.flatMap((a) => BULK_SIZES.map((b) => ['speed', '-seconds', '2', '-bytes', b, ...multiArgs, '-evp', a]))
    : ['rsa2048', 'ecdsap256', 'ecdhx25519'].map((a) => ['speed', '-seconds', '2', ...multiArgs, a]);
  const statBefore = cpuStat();
  const started = Date.now();
  const runs = argLists.map((args) => run(`openssl-${kind}-multi${multi}`, osslArgv(args)));
  return { prepare: prep, kind, multi, totalMs: Date.now() - started, cpuStatBefore: statBefore, cpuStatAfter: cpuStat(), runs };
};
const routeOsslInfo = () => {
  const prep = prepare();
  return { prepare: prep, version: run('openssl-version', osslArgv(['version', '-a'])), cpuStat: cpuStat() };
};

const routeWhich = () => {
  const names = [...Object.keys(SPECS), 'coreutils'];
  const dirs = ['/usr/bin', '/bin', '/usr/sbin', '/sbin', '/usr/local/bin'];
  const found: Record<string, unknown[]> = {};
  for (const n of names) found[n] = dirs.map((d) => path.join(d, n)).filter((p) => fs.existsSync(p)).map(modeInfo);
  let usrBinCount: number | undefined;
  try { usrBinCount = fs.readdirSync('/usr/bin').length; } catch { /* ignore */ }
  return { pathVar: process.env.PATH, dirs: dirs.map((d) => modeInfo(d)), usrBinCount, found, osRelease: readCapped('/etc/os-release', 4096) };
};

const routeCmds = () => {
  const prep = prepare();
  const results: unknown[] = [];
  for (const [name, args] of Object.entries(SPECS)) {
    const inner = MULTICALL.has(name)
      ? [path.join(DST, 'bin', 'coreutils'), `--coreutils-prog=${name}`, ...args]
      : [path.join(DST, 'bin', name), ...args];
    results.push(run('bundled', [path.join(DST, 'lib', LOADER), '--library-path', path.join(DST, 'lib'), ...inner]));
    for (const d of ['/usr/bin', '/bin', '/usr/sbin', '/sbin']) {
      const p = path.join(d, name);
      if (fs.existsSync(p)) { results.push(run(`builtin:${d}`, [p, ...args])); break; }
    }
  }
  // Does the executable bit survive the zip? Run one bundled command straight from the code directory.
  const inplace = run('bundled-inplace', [path.join(SRC_LIB, LOADER), '--library-path', SRC_LIB, path.join(SRC_BIN, 'lscpu')]);
  const inplaceDirect = run('bundled-inplace-direct', [path.join(SRC_BIN, 'lscpu')]);
  return { prepare: prep, results, inplace, inplaceDirect };
};

const ROUTES: Record<string, () => unknown> = { '/a': routeA, '/c': routeC, '/which': routeWhich, '/cmds': routeCmds, '/tmpwrite': routeTmpWrite,
  '/ossl-info': routeOsslInfo, '/ossl-bulk-1': () => osslSuite('bulk', 1), '/ossl-bulk-2': () => osslSuite('bulk', 2), '/ossl-pk-1': () => osslSuite('pk', 1), '/ossl-pk-2': () => osslSuite('pk', 2) };

const server = http.createServer((req, res) => {
  const p = (req.url ?? '/').split('?')[0];
  const started = Date.now();
  try {
    const handler = ROUTES[p];
    const body = handler ? handler() : { endpoints: Object.keys(ROUTES) };
    // Never print the host name (an identifier of the execution environment).
    const text = JSON.stringify({ path: p, elapsedMs: Date.now() - started, body }, null, 2).split(HOSTNAME.length >= 4 ? HOSTNAME : '\u0000').join('<HOSTNAME>');
    res.writeHead(200, { 'content-type': 'application/json' });
    res.end(text);
  } catch (e) {
    res.writeHead(500, { 'content-type': 'application/json' });
    res.end(JSON.stringify({ error: String((e as Error).name), message: String((e as Error).message) }));
  }
});

server.listen(port, () => console.log(`listening on port ${port}`));