microsandbox

Project Overview

Microsandbox is an easy-to-use, fast, local-first microVM runtime and library designed to run untrusted workloads — including AI agents, user code, plugins, CI jobs, dev environments, and automation — in hardware-isolated environments. It provides hardware-level isolation to ensure secure workload execution.

Key Features

• Hardware Isolation: Hardware-level isolation with microVM technology
• Cross Platform: Runs on Linux, macOS, and Windows
• OCI Compatible: Runs standard container images from Docker Hub, GHCR, or any OCI registry
• Docker-Like Workflows: Familiar image, command, shell, and volume workflows
• Instant Startup: Average boot times under 100 milliseconds
• Embeddable: Spawn VMs right within your code. No setup server or long-running daemon required
• Secrets That Can't Leak: Unexploitable secret keys that never enter the VM
• Long-Running: Sandboxes can run in detached mode, ideal for long-lived sessions
• Agent-Ready: Provides Agent Skills and MCP server support for AI agents

Target Audience

• Developers who need to run untrusted code securely
• Engineers building AI agent systems
• DevOps teams needing fast, lightweight isolated environments

Quick Start

1. Install the CLI: curl -fsSL https://install.microsandbox.dev | sh (macOS/Linux) or irm https://install.microsandbox.dev/windows | iex (Windows)
2. Run a microVM: msb run debian
3. Use the SDK: Install via npm (microsandbox), Cargo (microsandbox), uv (microsandbox), or Go

Core Advantages

• Blazing fast startup (<100ms) with low resource usage
• Hardware-level security isolation
• Supports standard OCI images, compatible with Docker workflows
• Cross-platform support for major operating systems

System Requirements

• macOS: Apple Silicon
• Linux: KVM enabled
• Windows: WHP enabled

Notes

• Microsandbox is still beta software. Expect breaking changes, missing features, and rough edges