What does hyperlight-dev/hyperlight do?

Hyperlight is an embedded virtual machine manager designed to execute guest binaries within hardware-isolated code sandboxes. It utilizes a KVM micro-VM manager to run untrusted third-party code, enforcing strict memory boundaries to prevent unauthorized host access.

What are the main features of hyperlight-dev/hyperlight?

The main features of hyperlight-dev/hyperlight are: MicroVM Sandboxes, Hardware-Level Isolation, State Snapshots, Resource-Constrained Runtimes, Host-Guest Communication Bridges, Guest Function Dispatch, QEMU KVM, Embedded Virtual Machines.

What are some open-source alternatives to hyperlight-dev/hyperlight?

Open-source alternatives to hyperlight-dev/hyperlight include: superradcompany/microsandbox — Microsandbox is a runtime for creating and managing lightweight, hardware-isolated virtual machines — called sandboxes… zerocore-ai/microsandbox — microsandbox is a platform that runs untrusted code inside hardware-isolated microVMs, each with its own kernel,… microsandbox/microsandbox — Microsandbox is a microVM sandbox runtime and hardware-isolated code executor designed for running untrusted code. It… patriksimek/vm2 — vm2 is a Node.js JavaScript sandbox and runtime virtualizer designed to execute untrusted code. It functions as a… rkt/rkt — rkt is a pod-native container engine and runtime for Linux that executes containerized applications as isolated pods.… rhaiscript/rhai — Rhai is an embedded scripting engine and dynamically typed language designed for integration into Rust applications.…

Hyperlight - تشغيل الأكواد غير الموثوقة في بي…

Hyperlight - تشغيل الأكواد غير الموثوقة في بي… | Awesome Repos

Features

MicroVM Sandboxes - Implements a KVM-based micro-VM manager to execute untrusted code within hardware-isolated sandboxes.
Hardware-Level Isolation - Uses KVM-based hardware acceleration to enforce strict memory boundaries and isolate untrusted guest code.
State Snapshots - Saves and restores the entire memory state of a sandbox to eliminate cold-start latency.
Resource-Constrained Runtimes - Implements a resource-constrained runtime by limiting heap and stack memory for isolated guest environments.
Host-Guest Communication Bridges - Implements a communication interface that bridges function calls between a host application and a running guest VM.
Guest Function Dispatch - Provides the ability to trigger specific named functions inside a running sandbox to execute code and receive output.
QEMU KVM - Manages lightweight virtual machines using KVM to execute guest binaries with controlled host resource access.
Embedded Virtual Machines - Designed as a lightweight virtual machine manager that can be embedded into host applications for secure execution.
Host Function Exposure - Allows registering host-side functions so that guest code can securely access external data and resources.
Hardware-Isolated Environments - Uses micro-VMs to create a security layer that enforces hardware-level memory boundaries.
Application Sandboxing - Embeds hardware-isolated sandboxes into applications to enforce memory boundaries and prevent unauthorized host access.
Isolated Code Execution - Provides a secure system for running arbitrary third-party code in isolated environments to prevent unauthorized host access.
Entry Point Resolution - Triggers specific logic inside the sandbox by resolving function names to entry points within the guest binary.
Sandbox Resource Caps - Allows defining fixed heap and stack memory limits at VM creation to prevent resource exhaustion.
Execution Resource Constraints - Enforces fixed heap and stack memory limits at instantiation to prevent guest code from exhausting system resources.
Native Binary Toolchains - Includes a toolchain that compiles source code into specialized binaries tailored for micro-VM execution.
Guest-Component Shared Memory - Implements a shared-memory bridge that maps specific functions to shared memory addresses for efficient host-guest communication.
Binary Cross-Compilation - Provides tools to cross-compile source code into binaries compatible with the micro-VM target.
VM Session State Restoration - Includes a tool to save and restore the full runtime memory state of a virtual machine.

بدائل مفتوحة المصدر لـ Hyperlight

مشاريع مفتوحة المصدر مشابهة، مرتبة حسب عدد الميزات المشتركة مع Hyperlight.

superradcompany/microsandbox
superradcompany/microsandbox
6,570عرض على GitHub
Microsandbox is a runtime for creating and managing lightweight, hardware-isolated virtual machines — called sandboxes — that boot directly from standard OCI container images. Each sandbox runs as its own host process with a separate kernel, filesystem, and network stack, providing process-per-sandbox isolation. The project includes a command-line tool and multi-language SDKs (Rust, TypeScript, Python, Go) for programmatic lifecycle control, and it communicates with sandbox agents over Unix sockets using a CBOR-encoded protocol. What distinguishes Microsandbox is its combination of host-manag
Rust
عرض على GitHub6,570
zerocore-ai/microsandbox
zerocore-ai/microsandbox
4,802عرض على GitHub
microsandbox is a platform that runs untrusted code inside hardware-isolated microVMs, each with its own kernel, filesystem, and network stack. It boots directly from standard OCI container images, supports copy-on-write filesystem layers, and integrates with AI agents to execute tool calls and generated code in isolated environments with secret protection. What sets microsandbox apart is its host-side network proxy that enforces firewall rules, intercepts DNS, inspects TLS traffic, and injects secrets at the network boundary without exposing them inside the VM. It provides SSH access to micr
Rustagentsaiai-generated
عرض على GitHub4,802
microsandbox/microsandbox
microsandbox/microsandbox
6,683عرض على GitHub
Microsandbox is a microVM sandbox runtime and hardware-isolated code executor designed for running untrusted code. It functions as an embedded virtual machine manager that allows applications to spawn and control lightweight virtual machines directly within code without the need for a background daemon. The system provides a secure execution environment for AI agents by exposing server controls that allow them to execute tools and manage files. It utilizes standard container image formats and volume workflows to initialize guest virtual machines and implements a secret management mechanism th
Rust
عرض على GitHub6,683
rkt/rkt
rkt/rkt
8,773عرض على GitHub
rkt is a pod-native container engine and runtime for Linux that executes containerized applications as isolated pods. It serves as an OCI container runtime and a Linux container manager, supporting the execution of images based on Open Container Initiative, appc, and Docker specifications. The project distinguishes itself by offering hardware-level container isolation, allowing pods to run within virtual machines using KVM or QEMU for a dedicated kernel. It further separates itself through secure container deployment practices, utilizing SELinux mandatory access control and TPM-backed integri
Gocontainersgooci
عرض على GitHub8,773

عرض جميع البدائل الـ 30 لـ Hyperlight

hyperlight-devhyperlight

Hyperlight

Features

بدائل مفتوحة المصدر لـ Hyperlight

superradcompany/microsandbox

zerocore-ai/microsandbox

microsandbox/microsandbox

rkt/rkt

Frequently asked questions

سجل النجوم

بدائل مفتوحة المصدر لـ Hyperlight

superradcompany/microsandbox

zerocore-ai/microsandbox

microsandbox/microsandbox

rkt/rkt

Frequently asked questions