What does hyperlight-dev/hyperlight do?

Hyperlight est un gestionnaire de machine virtuelle embarqué conçu pour exécuter des binaires invités au sein de bacs à sable (sandboxes) isolés matériellement. Il utilise un gestionnaire de micro-VM KVM pour exécuter du code tiers non fiable, imposant des limites de mémoire strictes pour empêcher tout accès non autorisé à l'hôte.

What are the main features of hyperlight-dev/hyperlight?

The main features of hyperlight-dev/hyperlight are: MicroVM Sandboxes, Hardware-Level Isolation, State Snapshots, Resource-Constrained Runtimes, Host-Guest Communication Bridges, Guest Function Dispatch, QEMU KVM, Embedded Virtual Machines.

What are some open-source alternatives to hyperlight-dev/hyperlight?

Open-source alternatives to hyperlight-dev/hyperlight include: superradcompany/microsandbox — Microsandbox is a runtime for creating and managing lightweight, hardware-isolated virtual machines — called sandboxes… zerocore-ai/microsandbox — microsandbox is a platform that runs untrusted code inside hardware-isolated microVMs, each with its own kernel,… microsandbox/microsandbox — Microsandbox is a microVM sandbox runtime and hardware-isolated code executor designed for running untrusted code. It… patriksimek/vm2 — vm2 is a Node.js JavaScript sandbox and runtime virtualizer designed to execute untrusted code. It functions as a… rkt/rkt — rkt is a pod-native container engine and runtime for Linux that executes containerized applications as isolated pods.… rhaiscript/rhai — Rhai is an embedded scripting engine and dynamically typed language designed for integration into Rust applications.…

Hyperlight - exécuter du code non fiable dans…

Hyperlight - exécuter du code non fiable dans… | Awesome Repos

Features

MicroVM Sandboxes - Implements a KVM-based micro-VM manager to execute untrusted code within hardware-isolated sandboxes.
Hardware-Level Isolation - Uses KVM-based hardware acceleration to enforce strict memory boundaries and isolate untrusted guest code.
State Snapshots - Saves and restores the entire memory state of a sandbox to eliminate cold-start latency.
Resource-Constrained Runtimes - Implements a resource-constrained runtime by limiting heap and stack memory for isolated guest environments.
Host-Guest Communication Bridges - Implements a communication interface that bridges function calls between a host application and a running guest VM.
Guest Function Dispatch - Provides the ability to trigger specific named functions inside a running sandbox to execute code and receive output.
QEMU KVM - Manages lightweight virtual machines using KVM to execute guest binaries with controlled host resource access.
Embedded Virtual Machines - Designed as a lightweight virtual machine manager that can be embedded into host applications for secure execution.
Host Function Exposure - Allows registering host-side functions so that guest code can securely access external data and resources.
Hardware-Isolated Environments - Uses micro-VMs to create a security layer that enforces hardware-level memory boundaries.
Application Sandboxing - Embeds hardware-isolated sandboxes into applications to enforce memory boundaries and prevent unauthorized host access.
Isolated Code Execution - Provides a secure system for running arbitrary third-party code in isolated environments to prevent unauthorized host access.
Entry Point Resolution - Triggers specific logic inside the sandbox by resolving function names to entry points within the guest binary.
Sandbox Resource Caps - Allows defining fixed heap and stack memory limits at VM creation to prevent resource exhaustion.
Execution Resource Constraints - Enforces fixed heap and stack memory limits at instantiation to prevent guest code from exhausting system resources.
Native Binary Toolchains - Includes a toolchain that compiles source code into specialized binaries tailored for micro-VM execution.
Guest-Component Shared Memory - Implements a shared-memory bridge that maps specific functions to shared memory addresses for efficient host-guest communication.
Binary Cross-Compilation - Provides tools to cross-compile source code into binaries compatible with the micro-VM target.
VM Session State Restoration - Includes a tool to save and restore the full runtime memory state of a virtual machine.

Alternatives open source à Hyperlight

Projets open source similaires, classés selon le nombre de fonctionnalités partagées avec Hyperlight.

superradcompany/microsandbox
superradcompany/microsandbox
6,570Voir sur GitHub
Microsandbox is a runtime for creating and managing lightweight, hardware-isolated virtual machines — called sandboxes — that boot directly from standard OCI container images. Each sandbox runs as its own host process with a separate kernel, filesystem, and network stack, providing process-per-sandbox isolation. The project includes a command-line tool and multi-language SDKs (Rust, TypeScript, Python, Go) for programmatic lifecycle control, and it communicates with sandbox agents over Unix sockets using a CBOR-encoded protocol. What distinguishes Microsandbox is its combination of host-manag
Rust
Voir sur GitHub6,570
zerocore-ai/microsandbox
zerocore-ai/microsandbox
4,802Voir sur GitHub
microsandbox is a platform that runs untrusted code inside hardware-isolated microVMs, each with its own kernel, filesystem, and network stack. It boots directly from standard OCI container images, supports copy-on-write filesystem layers, and integrates with AI agents to execute tool calls and generated code in isolated environments with secret protection. What sets microsandbox apart is its host-side network proxy that enforces firewall rules, intercepts DNS, inspects TLS traffic, and injects secrets at the network boundary without exposing them inside the VM. It provides SSH access to micr
Rustagentsaiai-generated
Voir sur GitHub4,802
microsandbox/microsandbox
microsandbox/microsandbox
6,683Voir sur GitHub
Microsandbox is a microVM sandbox runtime and hardware-isolated code executor designed for running untrusted code. It functions as an embedded virtual machine manager that allows applications to spawn and control lightweight virtual machines directly within code without the need for a background daemon. The system provides a secure execution environment for AI agents by exposing server controls that allow them to execute tools and manage files. It utilizes standard container image formats and volume workflows to initialize guest virtual machines and implements a secret management mechanism th
Rust
Voir sur GitHub6,683
rkt/rkt
rkt/rkt
8,773Voir sur GitHub
rkt is a pod-native container engine and runtime for Linux that executes containerized applications as isolated pods. It serves as an OCI container runtime and a Linux container manager, supporting the execution of images based on Open Container Initiative, appc, and Docker specifications. The project distinguishes itself by offering hardware-level container isolation, allowing pods to run within virtual machines using KVM or QEMU for a dedicated kernel. It further separates itself through secure container deployment practices, utilizing SELinux mandatory access control and TPM-backed integri
Gocontainersgooci
Voir sur GitHub8,773

Voir les 30 alternatives à Hyperlight

hyperlight-devhyperlight

Hyperlight

Features

Alternatives open source à Hyperlight

superradcompany/microsandbox

zerocore-ai/microsandbox

microsandbox/microsandbox

rkt/rkt

Frequently asked questions

Historique des stars

Alternatives open source à Hyperlight

superradcompany/microsandbox

zerocore-ai/microsandbox

microsandbox/microsandbox

rkt/rkt

Frequently asked questions