hyperlight-dev/hyperlight
Hyperlight
Hyperlight is an embedded virtual machine manager designed to execute guest binaries within hardware-isolated code sandboxes. It utilizes a KVM micro-VM manager to run untrusted third-party code, enforcing strict memory boundaries to prevent unauthorized host access.
The project features a guest-host function bridge that facilitates bidirectional communication and a state snapshot tool for saving and restoring the memory state of a sandbox to reduce startup latency.
The system includes a toolchain for guest binary cross-compilation and mechanisms for managing resource constraints, such as fixed heap and stack memory allocation. It provides primitives for invoking specific functions within the guest and registering host functions for controlled resource access.
Features
- MicroVM Sandboxes - Implements a KVM-based micro-VM manager to execute untrusted code within hardware-isolated sandboxes.
- Hardware-Level Isolation - Uses KVM-based hardware acceleration to enforce strict memory boundaries and isolate untrusted guest code.
- State Snapshots - Saves and restores the entire memory state of a sandbox to eliminate cold-start latency.
- Resource-Constrained Runtimes - Implements a resource-constrained runtime by limiting heap and stack memory for isolated guest environments.
- Host-Guest Communication Bridges - Implements a communication interface that bridges function calls between a host application and a running guest VM.
- Guest Function Dispatch - Provides the ability to trigger specific named functions inside a running sandbox to execute code and receive output.
- QEMU KVM - Manages lightweight virtual machines using KVM to execute guest binaries with controlled host resource access.
- Embedded Virtual Machines - Designed as a lightweight virtual machine manager that can be embedded into host applications for secure execution.
- Host Function Exposure - Allows registering host-side functions so that guest code can securely access external data and resources.
- Hardware-Isolated Environments - Uses micro-VMs to create a security layer that enforces hardware-level memory boundaries.
- Application Sandboxing - Embeds hardware-isolated sandboxes into applications to enforce memory boundaries and prevent unauthorized host access.
- Isolated Code Execution - Provides a secure system for running arbitrary third-party code in isolated environments to prevent unauthorized host access.
- Entry Point Resolution - Triggers specific logic inside the sandbox by resolving function names to entry points within the guest binary.
- Sandbox Resource Caps - Allows defining fixed heap and stack memory limits at VM creation to prevent resource exhaustion.
- Execution Resource Constraints - Enforces fixed heap and stack memory limits at instantiation to prevent guest code from exhausting system resources.
- Native Binary Toolchains - Includes a toolchain that compiles source code into specialized binaries tailored for micro-VM execution.
- Guest-Component Shared Memory - Implements a shared-memory bridge that maps specific functions to shared memory addresses for efficient host-guest communication.
- Binary Cross-Compilation - Provides tools to cross-compile source code into binaries compatible with the micro-VM target.
- VM Session State Restoration - Includes a tool to save and restore the full runtime memory state of a virtual machine.
Star history
How this analysis was created: This summary and feature list were written by an AI model that read the project's README and public documentation pages. Each feature links to the documentation it came from; stars, license and language come straight from the GitHub API. The model does not read the source code, and the analysis is refreshed when the project is re-analysed. Learn more on our About page.
