What does hyperlight-dev/hyperlight do?

Hyperlight is an embedded virtual machine manager designed to execute guest binaries within hardware-isolated code sandboxes. It utilizes a KVM micro-VM manager to run untrusted third-party code, enforcing strict memory boundaries to prevent unauthorized host access.

What are the main features of hyperlight-dev/hyperlight?

The main features of hyperlight-dev/hyperlight are: MicroVM Sandboxes, Hardware-Level Isolation, State Snapshots, Resource-Constrained Runtimes, Host-Guest Communication Bridges, Guest Function Dispatch, QEMU KVM, Embedded Virtual Machines.

What are some open-source alternatives to hyperlight-dev/hyperlight?

Open-source alternatives to hyperlight-dev/hyperlight include: superradcompany/microsandbox — Microsandbox is a runtime for creating and managing lightweight, hardware-isolated virtual machines — called sandboxes… microsandbox/microsandbox — Microsandbox is a microVM sandbox runtime and hardware-isolated code executor designed for running untrusted code. It… zerocore-ai/microsandbox — microsandbox is a platform that runs untrusted code inside hardware-isolated microVMs, each with its own kernel,… rkt/rkt — rkt is a pod-native container engine and runtime for Linux that executes containerized applications as isolated pods.… patriksimek/vm2 — vm2 is a Node.js JavaScript sandbox and runtime virtualizer designed to execute untrusted code. It functions as a… rhaiscript/rhai — Rhai is an embedded scripting engine and dynamically typed language designed for integration into Rust applications.…

Hyperlight - run untrusted code in secure san…

Hyperlight - run untrusted code in secure san… | Awesome Repos

Features

MicroVM Sandboxes - Implements a KVM-based micro-VM manager to execute untrusted code within hardware-isolated sandboxes.
Hardware-Level Isolation - Uses KVM-based hardware acceleration to enforce strict memory boundaries and isolate untrusted guest code.
State Snapshots - Saves and restores the entire memory state of a sandbox to eliminate cold-start latency.
Resource-Constrained Runtimes - Implements a resource-constrained runtime by limiting heap and stack memory for isolated guest environments.
Host-Guest Communication Bridges - Implements a communication interface that bridges function calls between a host application and a running guest VM.
Guest Function Dispatch - Provides the ability to trigger specific named functions inside a running sandbox to execute code and receive output.
QEMU KVM - Manages lightweight virtual machines using KVM to execute guest binaries with controlled host resource access.
Embedded Virtual Machines - Designed as a lightweight virtual machine manager that can be embedded into host applications for secure execution.
Host Function Exposure - Allows registering host-side functions so that guest code can securely access external data and resources.
Hardware-Isolated Environments - Uses micro-VMs to create a security layer that enforces hardware-level memory boundaries.
Application Sandboxing - Embeds hardware-isolated sandboxes into applications to enforce memory boundaries and prevent unauthorized host access.
Isolated Code Execution - Provides a secure system for running arbitrary third-party code in isolated environments to prevent unauthorized host access.
Entry Point Resolution - Triggers specific logic inside the sandbox by resolving function names to entry points within the guest binary.
Sandbox Resource Caps - Allows defining fixed heap and stack memory limits at VM creation to prevent resource exhaustion.
Execution Resource Constraints - Enforces fixed heap and stack memory limits at instantiation to prevent guest code from exhausting system resources.
Native Binary Toolchains - Includes a toolchain that compiles source code into specialized binaries tailored for micro-VM execution.
Guest-Component Shared Memory - Implements a shared-memory bridge that maps specific functions to shared memory addresses for efficient host-guest communication.
Binary Cross-Compilation - Provides tools to cross-compile source code into binaries compatible with the micro-VM target.
VM Session State Restoration - Includes a tool to save and restore the full runtime memory state of a virtual machine.

Open-source alternatives to Hyperlight

Similar open-source projects, ranked by how many features they share with Hyperlight.

superradcompany/microsandbox
superradcompany/microsandbox
6,570View on GitHub
Microsandbox is a runtime for creating and managing lightweight, hardware-isolated virtual machines — called sandboxes — that boot directly from standard OCI container images. Each sandbox runs as its own host process with a separate kernel, filesystem, and network stack, providing process-per-sandbox isolation. The project includes a command-line tool and multi-language SDKs (Rust, TypeScript, Python, Go) for programmatic lifecycle control, and it communicates with sandbox agents over Unix sockets using a CBOR-encoded protocol. What distinguishes Microsandbox is its combination of host-manag
Rust
View on GitHub6,570
microsandbox/microsandbox
microsandbox/microsandbox
6,683View on GitHub
Microsandbox is a microVM sandbox runtime and hardware-isolated code executor designed for running untrusted code. It functions as an embedded virtual machine manager that allows applications to spawn and control lightweight virtual machines directly within code without the need for a background daemon. The system provides a secure execution environment for AI agents by exposing server controls that allow them to execute tools and manage files. It utilizes standard container image formats and volume workflows to initialize guest virtual machines and implements a secret management mechanism th
Rust
View on GitHub6,683
zerocore-ai/microsandbox
zerocore-ai/microsandbox
4,802View on GitHub
microsandbox is a platform that runs untrusted code inside hardware-isolated microVMs, each with its own kernel, filesystem, and network stack. It boots directly from standard OCI container images, supports copy-on-write filesystem layers, and integrates with AI agents to execute tool calls and generated code in isolated environments with secret protection. What sets microsandbox apart is its host-side network proxy that enforces firewall rules, intercepts DNS, inspects TLS traffic, and injects secrets at the network boundary without exposing them inside the VM. It provides SSH access to micr
Rustagentsaiai-generated
View on GitHub4,802
patriksimek/vm2
patriksimek/vm2
4,083View on GitHub
vm2 is a Node.js JavaScript sandbox and runtime virtualizer designed to execute untrusted code. It functions as a secure code evaluator and module isolator that protects the host process by creating an isolated execution environment with restricted access to the Node.js runtime. The system distinguishes itself through a security framework that utilizes object proxying and deep freezing to prevent sandboxed scripts from modifying the host global context or shared objects. It implements strict module access control using allow-lists and path restrictions to govern which built-in or external dep
JavaScript
View on GitHub4,083

See all 30 alternatives to Hyperlight

hyperlight-devhyperlight

Hyperlight

Features

Open-source alternatives to Hyperlight

superradcompany/microsandbox

microsandbox/microsandbox

zerocore-ai/microsandbox

patriksimek/vm2

Frequently asked questions

Star history

Open-source alternatives to Hyperlight

superradcompany/microsandbox

microsandbox/microsandbox

zerocore-ai/microsandbox

patriksimek/vm2

Frequently asked questions