Run untrusted code safely on your machine
You can run AI agents or external scripts in an isolated space to prevent them from harming your system. By using microvirtual machines (microVMs), it creates a hardware-level isolated environment, allowing you to handle risky tasks with confidence. You can spin up a virtual machine directly in your code without installing servers or complex configurations, making it immediately applicable to development environments or automation tasks.
Fast isolation in beta
The tool is currently beta software, and it explicitly states that features may change or errors may occur. However, it shows an average boot time of under 100 milliseconds on M1 chip-based Macs and provides stronger hardware isolation than existing containers. It works on Linux, macOS, and Windows, and can use images from standard OCI registries like Docker Hub or GHCR as-is. This means users familiar with existing container workflows can adapt easily.
Live forking and snapshot features
The forking feature, which replicates a running sandbox in real time, is central. You can copy the running state as-is to conduct independent experiments, or save the state at a specific point in time to reload it later. Through a snapshot restoration option that shares memory, you can save storage space while enabling fast restoration. This feature is particularly useful for rehearsing database migrations or managing long-running sessions.
In-code sandbox creation
You can create a virtual machine directly within your application code without external daemons or servers. It supports SDKs for major languages such as TypeScript, Rust, Python, Go, and Ruby, and executes using the Sandbox.builder pattern to specify CPU and memory allocation. It downloads the image on the first run but reuses the cache thereafter to ensure fast startup. It limits network access to only specific hosts and ports and is designed so that secret keys do not enter the virtual machine, reducing security risks.
Integration with AI agents
It provides Agent Skills and an MCP server so that AI coding agents can create and manage sandboxes on their own. It is compatible with various agent frameworks such as Claude Code, Cursor, and GitHub Copilot. When an agent runs code or controls a browser in an isolated workspace, it operates in an environment completely separated from the host system. This plays an important role in minimizing the side effects of AI-generated code.
Things to check before use
Since the tool is still in the beta stage, you should thoroughly test its stability before applying it to production environments. macOS requires Apple Silicon, Linux requires KVM, and Windows requires WHP to be enabled. The license is Apache License 2.0, and it is based on the libkrun and smoltcp projects. It is suitable for running AI agents that require hardware isolation, isolating CI/CD pipelines, or converting untrusted documents, but you should carefully manage dependencies in preparation for potential API changes in the latest version.