What are the main features of hyperlight-dev/hyperlight?

The main features of hyperlight-dev/hyperlight are: MicroVM Sandboxes, Hardware-Level Isolation, State Snapshots, Resource-Constrained Runtimes, Host-Guest Communication Bridges, Guest Function Dispatch, QEMU KVM, Embedded Virtual Machines.

Hyperlight - सुरक्षित सैंडबॉक्स में अनट्रस्टे…

Hyperlight एक एम्बेडेड वर्चुअल मशीन मैनेजर है जिसे हार्डवेयर-आइसोलेटेड कोड सैंडबॉक्स के भीतर गेस्ट बाइनरीज़ को निष्पादित करने के लिए डिज़ाइन किया गया है। यह अनट्रस्टेड थर्ड-पार्टी कोड को चलाने के लिए KVM माइक्रो-VM मैनेजर का उपयोग करता है, जो अनधिकृत होस्ट एक्सेस को रोकने के लिए सख्त मेमोरी सीमाएं लागू करता है।

इस प्रोजेक्ट में एक गेस्ट-होस्ट फंक्शन ब्रिज है जो द्विदिश संचार (bidirectional communication) की सुविधा देता है, और स्टार्टअप लेटेंसी को कम करने के लिए सैंडबॉक्स की मेमोरी स्टेट को सेव और रिस्टोर करने के लिए एक स्टेट स्नैपशॉट टूल शामिल है।

सिस्टम में गेस्ट बाइनरी क्रॉस-कंपाइलेशन के लिए एक टूलचेन और संसाधन बाधाओं को प्रबंधित करने के लिए तंत्र शामिल हैं, जैसे कि फिक्स्ड हीप और स्टैक मेमोरी एलोकेशन। यह गेस्ट के भीतर विशिष्ट फंक्शन्स को इनवोक करने और नियंत्रित संसाधन एक्सेस के लिए होस्ट फंक्शन्स को रजिस्टर करने के लिए प्रिमिटिव्स प्रदान करता है।

Features

MicroVM Sandboxes - Implements a KVM-based micro-VM manager to execute untrusted code within hardware-isolated sandboxes.
Hardware-Level Isolation - Uses KVM-based hardware acceleration to enforce strict memory boundaries and isolate untrusted guest code.
State Snapshots - Saves and restores the entire memory state of a sandbox to eliminate cold-start latency.
Resource-Constrained Runtimes - Implements a resource-constrained runtime by limiting heap and stack memory for isolated guest environments.
Host-Guest Communication Bridges - Implements a communication interface that bridges function calls between a host application and a running guest VM.
Guest Function Dispatch - Provides the ability to trigger specific named functions inside a running sandbox to execute code and receive output.
QEMU KVM - Manages lightweight virtual machines using KVM to execute guest binaries with controlled host resource access.
Embedded Virtual Machines - Designed as a lightweight virtual machine manager that can be embedded into host applications for secure execution.
Host Function Exposure - Allows registering host-side functions so that guest code can securely access external data and resources.
Hardware-Isolated Environments - Uses micro-VMs to create a security layer that enforces hardware-level memory boundaries.
Application Sandboxing - Embeds hardware-isolated sandboxes into applications to enforce memory boundaries and prevent unauthorized host access.
Isolated Code Execution - Provides a secure system for running arbitrary third-party code in isolated environments to prevent unauthorized host access.
Entry Point Resolution - Triggers specific logic inside the sandbox by resolving function names to entry points within the guest binary.
Sandbox Resource Caps - Allows defining fixed heap and stack memory limits at VM creation to prevent resource exhaustion.
Execution Resource Constraints - Enforces fixed heap and stack memory limits at instantiation to prevent guest code from exhausting system resources.
Native Binary Toolchains - Includes a toolchain that compiles source code into specialized binaries tailored for micro-VM execution.
Guest-Component Shared Memory - Implements a shared-memory bridge that maps specific functions to shared memory addresses for efficient host-guest communication.
Binary Cross-Compilation - Provides tools to cross-compile source code into binaries compatible with the micro-VM target.
VM Session State Restoration - Includes a tool to save and restore the full runtime memory state of a virtual machine.

superradcompany/microsandbox

6,570GitHub पर देखें

Microsandbox is a runtime for creating and managing lightweight, hardware-isolated virtual machines — called sandboxes — that boot directly from standard OCI container images. Each sandbox runs as its own host process with a separate kernel, filesystem, and network stack, providing process-per-sandbox isolation. The project includes a command-line tool and multi-language SDKs (Rust, TypeScript, Python, Go) for programmatic lifecycle control, and it communicates with sandbox agents over Unix sockets using a CBOR-encoded protocol. What distinguishes Microsandbox is its combination of host-manag

microsandbox/microsandbox

6,683GitHub पर देखें

Microsandbox is a microVM sandbox runtime and hardware-isolated code executor designed for running untrusted code. It functions as an embedded virtual machine manager that allows applications to spawn and control lightweight virtual machines directly within code without the need for a background daemon. The system provides a secure execution environment for AI agents by exposing server controls that allow them to execute tools and manage files. It utilizes standard container image formats and volume workflows to initialize guest virtual machines and implements a secret management mechanism th

zerocore-ai/microsandbox

4,802GitHub पर देखें

microsandbox is a platform that runs untrusted code inside hardware-isolated microVMs, each with its own kernel, filesystem, and network stack. It boots directly from standard OCI container images, supports copy-on-write filesystem layers, and integrates with AI agents to execute tool calls and generated code in isolated environments with secret protection. What sets microsandbox apart is its host-side network proxy that enforces firewall rules, intercepts DNS, inspects TLS traffic, and injects secrets at the network boundary without exposing them inside the VM. It provides SSH access to micr

patriksimek/vm2

4,083GitHub पर देखें

vm2 is a Node.js JavaScript sandbox and runtime virtualizer designed to execute untrusted code. It functions as a secure code evaluator and module isolator that protects the host process by creating an isolated execution environment with restricted access to the Node.js runtime. The system distinguishes itself through a security framework that utilizes object proxying and deep freezing to prevent sandboxed scripts from modifying the host global context or shared objects. It implements strict module access control using allow-lists and path restrictions to govern which built-in or external dep

स्टार हिस्ट्री

hyperlight-devhyperlight

Hyperlight

Features