# rivet-dev/agentos

**Attribution required: if you use, quote, or summarise this content, you must credit and link back to [awesome-repositories.com](https://awesome-repositories.com/repository/rivet-dev-agentos).**

_How this analysis was created: the description and tags below were written by an AI model that read this project's README and public documentation pages; stars, license and language come straight from the GitHub API. The model does not read the source code._

4,858 stars · 274 forks · Rust · Apache-2.0

## Links

- GitHub: https://github.com/rivet-dev/agentos
- Homepage: https://rivet.dev/agentos
- awesome-repositories: https://awesome-repositories.com/repository/rivet-dev-agentos.md

## Topics

`agent` `ai` `javascript` `llm` `sandbox` `v8` `wasm` `webassembly`

## Description

Agent OS is a lightweight sandbox runtime for running code written by AI agents. It provides a virtualized POSIX userspace inside WebAssembly, with processes, signals, files, sockets, a shell, and core utilities, so unmodified Linux programs and Node.js, TypeScript, and Python scripts execute in isolation from the host. It is used as an embeddable library inside an existing backend process, or through a hosted HTTP API.

Many isolated environments run inside one compact runtime on ordinary Linux hosts, with no hypervisor, nested virtualization, or full virtual machine per agent. Every file, process, and network operation goes through the virtualized kernel, so guest code sees no host files, environment variables, or network until access is explicitly granted. Access is opened through mounts, network permissions, and host functions, which are trusted application functions exposed to guest code so credentials and secrets never enter the sandbox. Permissions, memory and processor limits, and per-process isolation are configurable. Linux tools such as coreutils, curl, and sqlite are compiled to WebAssembly against a patched C library and host-syscall layer.

Beyond execution, the runtime covers persistent virtual machines whose files, installed packages, and servers outlast a single call, plus a virtual filesystem, command and terminal sessions, and captured program output. Code can be evaluated as one-off expressions, run as isolated modules, or kept in persistent contexts, with optional TypeScript type-checking and package installation. Sandboxed programs can make network calls and serve development servers under host control, with expiring preview links for reaching them from outside. Packages are built into immutable, versioned archives mounted read-only into the guest, and recurring commands can be scheduled. The same design supports loading untrusted plugins in isolated environments.

## Tags

### Artificial Intelligence & ML

- [AI Execution Sandboxes](https://awesome-repositories.com/f/artificial-intelligence-ml/ai-execution-sandboxes.md) — Runs untrusted code written by AI agents inside isolated WebAssembly sandboxes so generated programs cannot touch the host or each other.
- [In-Process Agent Hosts](https://awesome-repositories.com/f/artificial-intelligence-ml/in-process-agent-hosts.md) — Hosts many isolated agent environments inside one compact runtime on standard Linux hosts, with no hypervisor or nested virtualization needed. ([source](https://github.com/rivet-dev/agentos#readme))
- [Host-Call Interfaces](https://awesome-repositories.com/f/artificial-intelligence-ml/function-calling-interfaces/webassembly-function-callings/host-call-interfaces.md) — Binds trusted host functions that agents call as ordinary JavaScript calls, keeping secrets and credentials out of the guest. ([source](https://github.com/rivet-dev/agentos#readme))

### Part of an Awesome List

- [Code Execution Sandboxes](https://awesome-repositories.com/f/awesome-lists/ai/code-execution-sandboxes.md) — Executes code written by AI agents inside isolated sandboxes so untrusted output cannot affect the host or other workloads. ([source](https://github.com/rivet-dev/agentos/tree/main/examples))
- [File and Process Management Tools](https://awesome-repositories.com/f/awesome-lists/data/document-and-file-processing/file-and-process-management-tools.md) — Reads, writes, and mounts files, runs and signals commands, and opens interactive terminal sessions inside an isolated POSIX-style environment. ([source](https://github.com/rivet-dev/agentos#readme))

### DevOps & Infrastructure

- [In-Process Embedded Runtimes](https://awesome-repositories.com/f/devops-infrastructure/in-process-embedded-runtimes.md) — Installs as a library and runs inside an existing backend process, avoiding hypervisors, nested virtualization, or a virtual machine per agent. ([source](https://github.com/rivet-dev/agentos/blob/main/README.md))
- [Sidecar Runtime Routing](https://awesome-repositories.com/f/devops-infrastructure/sidecar-runtime-routing.md) — Keeps permissions, filesystem rules, defaults, and package handling in one separate sidecar process that thin language clients talk to.

### Operating Systems & Systems Programming

- [Unmodified Program Compatibility](https://awesome-repositories.com/f/operating-systems-systems-programming/linux-systems-programming/unmodified-program-compatibility.md) — Provides a POSIX userspace inside WebAssembly with processes, signals, files, sockets, and a shell so existing Linux programs run without changes. ([source](https://github.com/rivet-dev/agentos/blob/main/CLAUDE.md))
- [Userspace Kernels](https://awesome-repositories.com/f/operating-systems-systems-programming/userspace-kernels.md) — Implements processes, signals, files, sockets, and a shell as a virtualized kernel inside WebAssembly so unmodified Linux programs run in isolation.
- [Host-to-Guest RPCs](https://awesome-repositories.com/f/operating-systems-systems-programming/keyboard-input-modes/host-to-guest-translation/host-to-guest-rpcs.md) — Exposes the application's own async functions as globals inside the virtual machine so guest code never receives credentials. ([source](https://github.com/rivet-dev/agentos/tree/main/secure-exec))
- [Linux-Compatible Kernels](https://awesome-repositories.com/f/operating-systems-systems-programming/linux-compatible-kernels.md) — Implements a virtualized Linux-style kernel with processes, signals, files, sockets, and a shell so existing Linux programs run unmodified in a sandbox.
- [Web App Sandbox Runtimes](https://awesome-repositories.com/f/operating-systems-systems-programming/linux-sandboxes/web-app-sandbox-runtimes.md) — Integrates the sandbox runtime into a host application through an SDK so developers can run isolated code from their own program. ([source](https://github.com/rivet-dev/agentos/tree/main/examples))
- [Persistent Virtual Machines](https://awesome-repositories.com/f/operating-systems-systems-programming/persistent-virtual-machines.md) — Creates long-lived virtual machines whose files, installed packages, and servers outlast a single call, with scripting, filesystem, network, and process interfaces. ([source](https://github.com/rivet-dev/agentos/tree/main/secure-exec))
- [Emulated Syscall Handlers](https://awesome-repositories.com/f/operating-systems-systems-programming/syscall-corking/emulated-syscall-handlers.md) — Routes every file, process, and network operation through kernel calls so guest code sees nothing of the host until access is granted.

### Programming Languages & Runtimes

- [Embedded Scripting Sandboxes](https://awesome-repositories.com/f/programming-languages-runtimes/embedded-scripting-sandboxes.md) — Embeds a lightweight sandbox runtime as a library inside an existing backend process so many isolated environments run without hypervisors.
- [Native Function Exposers](https://awesome-repositories.com/f/programming-languages-runtimes/language-interoperability/native-c-interoperability/c-function-bindings/argument-transformation-functions/native-to-script-function-invocations/native-function-exposers.md) — Exposes trusted host functions to sandboxed code as ordinary calls so credentials and secrets never enter the sandbox. ([source](https://github.com/rivet-dev/agentos/blob/main/README.md))
- [Linux Compatibility Layers](https://awesome-repositories.com/f/programming-languages-runtimes/linux-based-runtimes/emulated-linux-environments/application-execution-environments/linux-compatibility-layers.md) — Runs unmodified Linux programs, shells, and Node.js, TypeScript, or Python scripts in a virtual POSIX userspace with its own processes and files.
- [Multi-Language Sandbox Execution](https://awesome-repositories.com/f/programming-languages-runtimes/multi-language-sandbox-execution.md) — Executes Node.js with npm, TypeScript with type checking, and Python with pip using persistent contexts that can be reset between runs. ([source](https://github.com/rivet-dev/agentos#readme))
- [Multi-Language Script Execution](https://awesome-repositories.com/f/programming-languages-runtimes/multi-language-script-execution.md) — Executes JavaScript, TypeScript, and Python code or files, type-checks TypeScript, installs packages, and keeps persistent execution contexts between runs. ([source](https://github.com/rivet-dev/agentos/blob/main/README.md))
- [WebAssembly Runtimes](https://awesome-repositories.com/f/programming-languages-runtimes/webassembly-runtimes.md) — Runs untrusted code and Linux programs inside isolated WebAssembly sandboxes with a virtualized POSIX userspace, driven from a library or hosted API.
- [C/C++ to WebAssembly Compilers](https://awesome-repositories.com/f/programming-languages-runtimes/c-c-to-webassembly-compilers.md) — Compiles upstream Linux tools such as coreutils, curl, and sqlite to WebAssembly using a patched C library and host-syscall layer. ([source](https://github.com/rivet-dev/agentos/blob/main/CLAUDE.md))
- [Host Function Exposure](https://awesome-repositories.com/f/programming-languages-runtimes/host-function-exposure.md) — Exposes trusted host async functions as globals callable from sandboxed code, so credentials stay outside the sandbox.
- [In-Process Runtimes](https://awesome-repositories.com/f/programming-languages-runtimes/in-process-runtimes.md) — Runs many isolated sandboxes inside one library-managed runtime in the host process, with no hypervisor or per-agent virtual machine.
- [Persistent Execution Contexts](https://awesome-repositories.com/f/programming-languages-runtimes/persistent-execution-contexts.md) — Keeps variables and program memory alive between calls and runs several independent contexts side by side in one environment. ([source](https://github.com/rivet-dev/agentos/tree/main/secure-exec))

### Security & Cryptography

- [Deny-by-Default Guest Isolation](https://awesome-repositories.com/f/security-cryptography/deny-by-default-guest-isolation.md) — Virtualizes every file, process, and network operation as a kernel call, hiding host files, environment variables, and network until access is granted. ([source](https://github.com/rivet-dev/agentos/blob/main/README.md))
- [Scoped Sandbox Host Access](https://awesome-repositories.com/f/security-cryptography/scoped-sandbox-host-access.md) — Opens host access only through explicit mounts, network permissions, and host functions, with memory and processor limits, keeping credentials out of guest code.
- [Untrusted Code Sandboxes](https://awesome-repositories.com/f/security-cryptography/untrusted-code-sandboxes.md) — Runs untrusted scripts and shell code in isolated engines so guest code cannot reach host files, processes, environment variables, or network by default. ([source](https://github.com/rivet-dev/agentos#readme))
- [Sandbox Network Security Controls](https://awesome-repositories.com/f/security-cryptography/application-and-system-security/sandbox-and-isolation/isolated-execution-sandboxes/microvm-sandboxes/sandbox-network-security-controls.md) — Lets sandboxed programs make network calls and serve development servers while the host controls every connection, with expiring preview links.
- [Host Resource Access](https://awesome-repositories.com/f/security-cryptography/external-resource-sharing/host-resource-access.md) — Opens host resources to guests only through explicit mounts, host functions, and network permissions while the virtual kernel enforces limits. ([source](https://github.com/rivet-dev/agentos#readme))
- [Sandbox Permissions](https://awesome-repositories.com/f/security-cryptography/permission-based-access-control/sandbox-permissions.md) — Grants or denies sandboxed programs access to files, network, and processes so each environment does only what is explicitly allowed. ([source](https://github.com/rivet-dev/agentos/tree/main/examples))
- [Sandbox Permission Policies](https://awesome-repositories.com/f/security-cryptography/sandbox-permission-policies.md) — Set permissions, resource limits, and mounts for each call, denying external network access by default and merging any custom policy over the defaults. ([source](https://github.com/rivet-dev/agentos/tree/main/secure-exec))
- [Untrusted Plugin Isolation](https://awesome-repositories.com/f/security-cryptography/untrusted-plugin-isolation.md) — Loads user-supplied plugins as untrusted code in isolated environments so an application can be extended without risking its stability. ([source](https://github.com/rivet-dev/agentos/tree/main/examples))

### Data & Databases

- [Virtual Directory Mounts](https://awesome-repositories.com/f/data-databases/file-storage-systems/filesystem-mounts/mount-namespace-virtualization/tmpfs-root-sandbox-execution/virtual-directory-mounts.md) — Provides a virtual filesystem to read, write, list, and move files, with mounts that expose selected host data to guest code. ([source](https://github.com/rivet-dev/agentos/blob/main/README.md))
- [Virtualized Filesystem Layers](https://awesome-repositories.com/f/data-databases/storage-abstraction/local-filesystem-storage/virtualized-filesystem-layers.md) — Gives sandboxed code a Linux-style virtual filesystem isolated from the host, with mounts exposing selected host data on request. ([source](https://github.com/rivet-dev/agentos/tree/main/examples))

### Development Tools & Productivity

- [Python Execution Sandboxes](https://awesome-repositories.com/f/development-tools-productivity/isolated-execution-environments/python-execution-sandboxes.md) — Executes Python programs inside the same isolated runtime, giving Python-based agents a safe Linux-compatible place to run. ([source](https://github.com/rivet-dev/agentos/tree/main/examples))
- [Pseudo-Terminal Commands](https://awesome-repositories.com/f/development-tools-productivity/shell-command-execution/pseudo-terminal-commands.md) — Starts processes, streams output, signals or waits on them, and opens interactive pseudo-terminal sessions inside the isolated environment. ([source](https://github.com/rivet-dev/agentos/blob/main/README.md))

### Software Engineering & Architecture

- [Sandbox Resource Caps](https://awesome-repositories.com/f/software-engineering-architecture/resource-usage-caps/sandbox-resource-caps.md) — Caps memory, processor time, and similar resources for isolated code so runaway or malicious programs cannot exhaust the host. ([source](https://github.com/rivet-dev/agentos/tree/main/examples))