I am trying to build a custom dynamic provider in order to reboot an instance. I am bumping into one issue regarding function serialization. i saw the example https://github.com/pulumi/examples/tree/master/aws-ts-ec2-provisioners and i am a bit confused how the serialization works there. since the provisioners pull in a lib ssh2 which in turn uses the crypto module and net module. these packages are native. are some native libraries whitelisted ?

The function serialization restrictions that you're referring to apply to things like inline lambda definitions. When you inline a function in a lambda like in this example: https://github.com/pulumi/examples/blob/master/aws-ts-s3-lambda-copyzip/index.ts#L12-L25 A "compiler" runs and produces a js closure that can run on lambda independently, capturing necessary dependencies, etc. If you're just writing a plain old pulumi program that runs on your laptop, there shouldn't be any function serialization going on.

According to https://www.pulumi.com/docs/intro/concepts/programming-model/#how-dynamic-providers-work

Because your implementation of the resource provider interface must be used by a different process, potentially at a different point in time, dynamic providers are built on top of the same function serialization that is used for turning callbacks into AWS Lambdas or Google Cloud Functions. Because of this serialization, there are some limits on what can be done inside the implementation of the resource provider interface, which you can read more about in the function serialization documentation.

The compiler is invoked in the second phase

Ah, I missed the part about it being a dynamic provider. Sorry for the confusion!