superradcompany/microsandbox

Features

• Host-Side Network Proxies - Routes all sandbox traffic through a host-side proxy that enforces egress policies and substitutes secrets.
• MicroVM Sandboxes - Creates and manages hardware-isolated microVMs from OCI images for running untrusted workloads.
• Hardware-Level Isolation - Runs each sandbox as a full VM with hardware-backed security boundaries, not container namespaces.
• MicroVM Agent Sandboxes - Connects AI coding agents to microVMs through structured tool calls and natural language skills.
• Agent Communication Channels - Connects to running sandbox agents by name or socket path with a handshake protocol.
• DNS and TLS Interception Proxies - Captures DNS queries and TLS connections through a configurable proxy with certificate injection and rebind protection.
• Bypass Configurations - Excludes specific domains or wildcard patterns from TLS interception so certificate-pinned traffic flows through unchanged.
• Sandbox - Lists all running, stopped, and crashed sandbox environments for lifecycle management.
• Snapshot Archive Exports and Imports - Provides portable snapshot archiving for transferring sandbox state between machines.
• Sandbox Storage Managers - Creates, mounts, and shares persistent volumes, disk images, and snapshots across microVMs.
• Mount Permission Restriction - Restricts mount permissions with flags like noexec and nosuid for defense-in-depth inside sandboxes.
• Sandbox Volume Sharing - Mounts the same named volume into multiple sandboxes for shared filesystem access.
• In-Guest Restricted Security Profiles - Hardens guests with nonewprivs and dropped mount-admin capabilities for defense-in-depth.
• Sandbox Disk Snapshots - Captures microVM disk state as portable snapshots and manages persistent named volumes for data sharing.
• Admin Command Executions - Executes commands inside sandboxes with streaming stdout, stderr, and exit events for real-time processing.
• Multi-Language SDKs - Provides Rust, TypeScript, Python, and Go SDKs for programmatic sandbox lifecycle control.
• Sandbox Management CLIs - Creates, stops, and inspects microVMs and their images and volumes from the terminal without a separate daemon.
• Sandbox Configuration - Defines the full sandbox configuration including image, resources, volumes, networking, secrets, and environment before boot.
• Maximum Lifetime Configurations - Stops sandboxes automatically after a configured maximum runtime.
• Process Policy Configurations - Enforces automatic shutdown and resource cleanup via lifetime and idle timeout policies.
• Runtime Caps - Stops sandboxes automatically after a maximum runtime or inactivity period.
• Timeout Configurations - Stops sandboxes automatically after a maximum runtime or inactivity period.
• Sandboxed Shell Executions - Runs shell commands in sandboxed environments with output capture and exit code reporting.
• OCI Registry Image Pulls - Downloads OCI-compatible container images from any registry and caches them locally for reuse across sandboxes.
• CBOR-Framed Agent Protocols - Communicates with sandbox agents over Unix sockets using CBOR-encoded frames.
• MicroVM Docker Launches - Launches a microVM inside a Docker container with KVM access for hardware isolation.
• MicroVM Rootfs Boots - Boots microVMs from OCI image layers with copy-on-write and shared layer caching.
• Sandbox DNS Proxy Configurations - Configures an in-VM DNS proxy with upstream resolvers, query timeouts, and rebind protection for sandbox network isolation.
• Workload Isolation - Runs each untrusted workload in a separate VM to prevent host or cross-sandbox interference.
• Sandbox Idle Drains - Automatically drains sandboxes after a configurable period of inactivity.
• Sandbox Deletions - Deletes sandboxes and their persisted state, with optional force-stop before removal.
• Parallel Layer Cache Downloads - Downloads container image layers in parallel and stores them in a content-addressable, deduplicated cache for instant sandbox creation.
• Interactive Shell Access - Opens an interactive shell session inside a running sandbox, accepting commands directly from the terminal.
• Remote Command Execution - Executes single commands inside sandboxes and returns output without interactive sessions.
• Sandbox Lifecycle Management - Creates, manages, and destroys sandbox environments programmatically through SDK or CLI.
• Snapshot Capture and Restoration Managers - Saves and restores sandbox disk state as portable artifacts for reuse, transfer, and offline storage.
• Least-Privilege Directory Mounts - Provides host-enforced read-only directory mounts to prevent guest filesystem escapes.
• In-Guest Privilege Restrictions - Applies restricted security profiles inside guests, dropping mount-admin and forcing nosuid,nodev on mounts.
• Secure Host Directory Mounts - Shares host directories securely via virtio-fs with path containment and read-only enforcement.
• Selective Host Filesystem Mounts - Exposes only explicitly mounted host directories to guests, keeping the rest of the host filesystem private.
• Container Port Mapping - Maps a host port to a sandbox port for TCP or UDP traffic, enabling external services to reach workloads inside the microVM.
• Default Deny Egress Policies - Blocks all outbound traffic by default, requiring explicit allow rules to prevent unauthorized data exfiltration.
• Destination-Based Egress Rules - Blocks or permits outbound traffic based on IP, CIDR, domain, or address group for granular egress control.
• First-Match-Wins Egress Rules - Blocks or permits outbound traffic using a first-match-wins rule list with typed destinations, protocols, and port ranges.
• Guest-to-Host Communication Restrictions - Restricts guest-to-host communication to paravirtual devices, blocking PCI passthrough and host socket access.
• Host-Controlled Guest Communication - Drives sandboxes through a host-driven virtio-console channel where the guest only responds to requests.
• Host-Controlled Sandbox Channels - Manages sandboxes by sending framed commands over a virtio-console channel with host-initiated actions.
• Host-to-Instance Port Forwardings - Maps a guest-side port to a host-side port so external clients can reach a service running inside the sandbox.
• Agent Stream Communications - Establishes long-lived streams over agent connections for multi-frame communication.
• Virtio-FS Host Directory Sharing - Shares host directories via virtio-fs with path containment and identity virtualization for secure guest access.
• Root Filesystem Source Selectors - Specifies the root filesystem source for a sandbox using an OCI image, host directory bind, or disk image.
• OCI Image Root Filesystems - Pulls standard container images from any OCI-compatible registry, stacks layers as a copy-on-write filesystem, and caches shared layers across sandboxes.
• CBOR-Framed Relay Protocols - Sends and receives CBOR-encoded frames over relay sockets for sandbox agent communication.
• Copy-on-Write Root Layering - Combines read-only OCI image layers with per-sandbox writable layers for private filesystem modifications.
• Per-Sandbox Writable Layers - Provides each sandbox with a private writable layer isolated from the shared image cache and other sandboxes.
• MicroVM Boots - Boots microVMs from configured images in attached or detached modes.
• Sandbox Network Security Controls - Controls egress traffic, DNS, TLS, and secret injection for isolated microVMs.
• Sandbox-to-Sandbox Isolations - Runs each sandbox as its own VM process so they cannot interact unless explicitly connected.
• Sandbox Configurations - Sets CPU, memory, volumes, ports, network policy, environment variables, and security profiles at sandbox creation.
• Egress-Triggered Placeholder Swaps - Places a placeholder in the sandbox and swaps it for the real credential only on egress to an allowed host.
• DNS-and-TLS Identity Checks - Gates credential release on observed DNS and TLS identity, preventing secrets from reaching unauthorized hosts.
• Multi-Factor Destination Verifications - Verifies DNS pin and TLS identity before substituting secrets, blocking credential exfiltration to unauthorized endpoints.
• Multi-Layer Domain Blocking - Denies outbound traffic to specific domains at DNS, TLS, and TCP layers for comprehensive domain blocking.
• Non-Root Container Execution Environments - Executes commands inside the guest under a specified non-root user to reduce in-guest privilege.
• Host-Side Credential Bindings - Binds credentials to the host process so the guest only sees placeholders, preventing secret leakage from compromised workloads.
• Network Boundary Injections - Keeps real credentials on the host and injects a placeholder into the sandbox, swapping it for the real value only when the sandbox sends it to an allowed host.
• Network Access Control - Controls all sandbox traffic through a host-managed networking stack enforcing policy on every packet.
• Network Access Controls - Routes sandbox traffic through a host-controlled stack that checks every packet against configurable rules.
• Transparent HTTPS Inspections - Terminates TLS on the host side and re-encrypts to the upstream server, allowing policy rules and logging to see plaintext request data.
• Private Network Egress Blocking - Blocks outbound traffic to private and link-local addresses, preventing sandbox workloads from reaching internal resources.
• Private Network Egress Blocking - Denies outbound traffic to RFC 1918, loopback, link-local, and cloud metadata addresses for sandbox workloads.
• In-Guest - Runs workloads as non-root users inside guests with profiles that block privilege escalation.
• Snapshot-Based Boots - Starts fresh microVMs from previously captured filesystem snapshots, skipping original image setup.
• Log Secret Filters - Configures runtime actions when a secret placeholder is sent to a disallowed host, choosing between silent drop, logging, termination, or forwarding the placeholder.
• Egress Secret Leak Detections - Detects when a secret would be sent to a disallowed host and blocks, logs, or terminates the connection.
• Host-Restricted Secret Substitution - Substitutes a secret's real value only when outbound traffic reaches a permitted host, blocking leaks to unauthorized destinations.
• TLS-Identity-Gated Substitutions - Gates placeholder substitution on TLS SNI, DNS pin, and authority alignment, preventing credential exfiltration to unauthorized hosts.
• Wildcard Host Pattern Allow Lists - Controls secret release to destination hosts using exact names or wildcard patterns, blocking substitution for all other destinations.
• Secrets Management - Configures runtime actions when a secret placeholder is sent to a disallowed host, choosing between silent drop, logging, termination, or forwarding the placeholder.
• Targeted Deliveries - Delivers sensitive values only to the destinations that need them, keeping them out of environment variables and logs.
• Network-Boundary Placeholder Substitutions - Provides host-side secret injection that keeps credentials off the guest filesystem, substituting them only at the network boundary.
• Secret Access Policies - Configures runtime actions when a secret placeholder is sent to a disallowed host, choosing between silent drop, logging, termination, or forwarding the placeholder.
• Destination-Host Allow Lists - Restricts secret transmission to specific destination hosts, blocking credential leakage to unauthorized endpoints.
• Violation Response Configurations - Configures runtime actions when a secret placeholder is sent to a disallowed host, choosing between silent drop, logging, termination, or forwarding the placeholder.
• In-Memory Credential Isolations - Ensures credentials never touch guest filesystem or snapshots, keeping them only in host memory for the sandbox's lifetime.
• Authorized Key Injectors - Adds a public key to the sandbox's authorized keys file, supporting file, inline, or stdin input.
• Secret Substitution Enforcements - Requires a verified TLS identity before the network proxy substitutes the real secret value, preventing plaintext exposure.
• Per-Sandbox Filesystem Isolations - Isolates each sandbox's writable root filesystem from the shared image cache and host.
• Guest Injections - Copies the host's trusted root CAs into the guest's system bundle so corporate proxies and internal certificates are accepted.
• Untrusted Code Sandboxes - Runs user scripts, AI agent commands, or CI jobs in disposable microVMs.
• Sandbox - Captures the disk state of stopped or crashed sandboxes as named artifacts for later reuse.
• Sandbox - Sets CPU, memory, idle timeout, and maximum duration limits so abandoned sandboxes are automatically reclaimed.
• Host-Restricted Environment Injections - Provides sensitive values to sandboxes via environment variables with restricted destination hosts.
• MicroVM Spawners - Spawns hardware-isolated microVMs as child processes directly from application code without a daemon.
• Network Boundary Secret Injections - Swaps a placeholder credential for the real value at the network boundary when the guest sends a request to an allowed host.
• Sandbox Network Policy Engines - Routes all sandbox traffic through a host-side proxy enforcing egress policies, DNS interception, and TLS inspection.
• TLS Connection Injections - Injects real credential values into TLS connections to allowed hosts while the guest only ever sees a placeholder.
• Sandbox Resource Caps - Sets vCPU, memory, idle timeout, and maximum duration at VM creation, enforced by the VMM to prevent resource exhaustion.
• Command Output Streamers - Streams real-time command output from sandboxed microVMs for incremental processing of long-running processes.
• Sandbox Metric Exporters - Reads per-sandbox metrics from shared memory and forwards them as OpenTelemetry metrics to any OTLP-compatible backend.
• Network Port Cleaning - Exposes a TCP or UDP port from inside the sandbox to a port on the host, optionally on a specific bind address.
• Sandbox Control Skills - Ships natural language skill files that teach AI assistants to create and manage sandbox environments.
• MCP Protocol Integrations - Provides a Model Context Protocol server for managing sandboxes via structured tool calls.
• Multi-Language SDK Wrappers - Provides native SDKs wrapping the agent protocol into typed APIs for Rust, TypeScript, Python, and Go.
• File and Directory Operations - Lists, creates, removes directories and files, checks path existence, and retrieves file metadata within a sandbox.
• Directory Content Listings - Lists the files and directories at a given path inside a running sandbox, returning each entry's name and type.
• Label-Based Sandbox Filters - Filters sandbox listings by label key-value pairs for targeted lifecycle control.
• Resource Usage Monitoring - Retrieves point-in-time snapshots of CPU, memory, and filesystem usage for running sandboxes.
• Sandbox Metric Displays - Shows live CPU, memory, and network statistics for running sandboxes.
• Virtual Directory Mounts - Mounts a host directory directly into the sandbox as its root filesystem for development workflows.
• Multi-Backend Storage Mounts - Mounts host directories, files, named volumes, disk images, and tmpfs together in a single sandbox.
• Docker Volume Persistence - Mounts Docker volumes to retain sandbox state across container restarts.
• Instance Volume Mounts - Attaches host directories or other storage to a path inside the sandbox for data exchange.
• Local Persistent Volume Managers - Creates, lists, and removes persistent storage volumes attached to sandboxes for data durability.
• Named Volume Lifecycles - Creates named storage volumes that persist independently of any sandbox for reuse across multiple sandboxes.
• Integrity Verifications - Recomputes content hashes of snapshot layers and compares them against recorded manifests to detect corruption.
• Directory Creation - Creates a directory and any missing parent directories inside a sandbox.
• Per-Run Options - Configures per-run settings like arguments, resource limits, and TTY allocation through a builder.
• Real-Time Output Streaming - Emits stdout and stderr events in real time as commands produce them.
• Streaming Readers and Writers - Reads or writes file data in chunks using streaming readers and writers that support async iteration and disposal.
• Default Sandbox Configurations - Provides default resource limits and runtime options applied to every sandbox at creation time.
• Initial Sandbox Resource Configurations - Configures initial CPU, memory, hostname, user, and environment variables for each microVM sandbox.
• Shell Command Execution - Runs shell one-liners through /bin/sh -c inside sandboxes as a convenience wrapper.
• Ephemeral Sandbox Executions - Creates ephemeral sandboxes for single commands and removes them automatically.
• Sandbox Setup Scripts - Mounts executable scripts inside sandboxes for setup and entry-point commands.
• Builder-Based Overrides - Configures per-command settings like TTY allocation and stdin mode through a builder.
• Comprehensive Overrides - Overrides execution settings including resource limits and TTY allocation for single commands.
• Per-Command Configurations - Configures per-command options like working directory, timeout, and environment variables.
• OCI Registry Authenticators - Stores registry credentials per hostname using a keyring, environment variable, or inline value for pulling OCI images.
• Environment Variable Configuration - Attaches environment variables and key-value labels to sandboxes for configuration and filtering.
• Image Integrity Verification - Verifies each OCI image layer's SHA-256 digest against the manifest on pull or load.
• OCI Artifact Layer Caches - Stores pulled image layers in a content-addressable cache so shared layers are saved only once across different images.
• Docker-in-VM Launchers - Boots a Docker daemon inside an isolated microVM and opens an interactive shell for running containers.
• Stopped Sandbox Deletions - Deletes a stopped sandbox and all its persisted state from disk.
• Buffered Output Executions - Executes commands in sandboxes and returns buffered stdout, stderr, and exit status.
• Sandbox Disk Snapshots - Captures the disk state of a stopped sandbox and stores it as a named or path-based reusable artifact.
• Snapshot Creations - Captures the sandbox state as a named snapshot or writes it to a specified path.
• Host-Guest Mounts - Attaches host directories into sandboxes so changes in the guest are reflected on the host and vice versa.
• Sandbox Terminal Attachments - Bridges the host terminal to a sandbox process via pseudo-terminal with raw mode and window-size synchronization.
• Sandbox Connection Caps - Caps concurrent network connections per sandbox to prevent resource exhaustion from runaway workloads.
• Sandbox Connection Caps - Caps concurrent network connections per sandbox to prevent resource exhaustion from runaway workloads.
• Domain-Based DNS Query Blockings - Intercepts DNS queries and returns NXDOMAIN for denied domains to block resolution upstream.
• Upstream Resolver Pinning - Pins a fixed set of upstream DNS resolvers for sandbox queries, overriding host auto-discovery.
• Encrypted DNS Interception Proxies - Provides a host-side proxy that intercepts and filters encrypted DNS traffic from sandboxed workloads.
• Encrypted DNS Interception Proxies - Extends DNS interception to encrypted DoT queries, applying block-list and rebind protection to TLS-encrypted lookups.
• Domain-Based Connection Policy Enforcements - Maps DNS responses to IPs and applies domain-based allow/deny rules to TCP connections.
• Domain-Based Policy IP Resolutions - Maps DNS responses to IPs so policy rules can match connections by domain after resolution.
• Domain-to-IP Binding Enforcements - Matches connections against domain rules only when the destination IP matches DNS-observed answers.
• SNI Validation Against Domain Rules - Requires TLS SNI to match domain rules and destination IP to be bound in the DNS pin set.
• DNS-to-IP Binding Enforcements - Matches connections against DNS-observed IPs to prevent IP hard-coding from bypassing domain rules.
• Container-to-Host Service Access - Resolves a special hostname to the host machine so sandboxed workloads can reach local services.
• Sandbox SSH Servers - Exposes sandboxes as SSH servers over stdio or TCP for standard tools like ssh and sftp.
• SSH Client Connections - Opens an in-process SSH client to a running sandbox for command execution and file transfer.
• Embedded SSH Clients - Provides a built-in SSH client for sandbox access without requiring external SSH binaries or TCP listeners.
• SSH Command Executors - Executes commands inside sandboxes via an in-process SSH client, returning output and exit status.
• Sandbox Port Listeners - Opens listening sockets on the host for sandbox network ports with firewall prompts and loopback binding.
• Firewall Rule Configurations - Builds ordered rule sets controlling traffic by destination, protocol, port, and direction for sandbox networks.
• Directory File Removers - Recursively removes a directory and all its contents inside a sandbox.
• Individual Process Signalers - Sends Unix signals including SIGKILL to processes running inside sandboxes to control execution.
• Pre-Boot Filesystem Patchers - Applies file writes, directory creation, deletions, copies, and symlinks to the root filesystem before boot.
• Pre-Boot Root Filesystem Patchers - Patches the root filesystem before boot by writing files and directories into the writable layer.
• Process Signal Dispatchers - Sends Unix signals like SIGTERM and SIGKILL to running commands inside sandboxes for lifecycle control.
• Console Attachments - Connects to a running sandbox's console, forwarding input, resize events, and restoring console state on exit.
• Virtual Disk Image Booting - Boots sandboxes directly from raw or qcow2 disk images as the root filesystem.
• Sandbox Invocation Customizations - Customizes working directory, user, and resource limits for single sandbox command invocations.
• Connection Caps - Caps the number of concurrent network connections a sandbox can establish to protect host capacity.
• Egress Rule Sets - Applies ordered rule sets to outbound sandbox traffic, allowing or denying connections by target.
• Full Network Disabling - Disables all network interfaces inside a sandbox, making it fully offline while preserving host-guest channels.
• Database Sandbox Controllers - Lists and filters sandboxes by labels to obtain handles for lifecycle control.
• Domain Name Blocking - Refuses DNS resolution for exact domain names or suffixes to prevent reaching unwanted hosts.
• DNS Rebinding Prevention - Rewrites DNS responses that resolve to private addresses as NXDOMAIN to block rebinding attacks.
• Metadata Access Controls - Blocks the cloud metadata endpoint by default to prevent credential theft via SSRF.
• Custom Rule Set Definitions - Defines ordered allow/deny rule sets for sandbox network traffic by destination, protocol, and port.
• Preset Policy Modes - Defines egress and ingress policies with preset modes and custom domain, IP, and port rules.
• Sandbox State Logs - Reads captured sandbox output from disk via CLI or SDK, supporting filtering by source, tail count, and grep patterns.
• DNS Egress Policy Enforcements - Enforces egress policies by evaluating each DNS query against domain, protocol, and port rules.
• Sandbox Filesystem Access Handles - Provides filesystem handles for reading and writing files inside running sandboxes.
• Local and Remote Backend Switching - Selects a backend profile to route sandbox execution to local or remote runtime.
• Immutable Image Pinning - References images by immutable content digest instead of mutable tags for reproducible workloads.
• Custom Init Handlers - Hands off PID 1 inside the guest to a custom init binary like systemd after boot-time setup.
• Init Binary Selectors - Accepts any absolute path to an init binary or auto-detects one from the image.
• Systemd PID 1 Handoffs - Hands PID 1 to systemd inside the guest for service management and session bus support.
• Systemd Unit Control - Installs, enables, and starts systemd services inside the guest using standard systemctl commands.
• Configuration Inspections - Outputs the full configuration and current status of a microVM in human-readable or JSON format.
• Listings - Displays all sandboxes, running sandboxes only, or detailed information about a specific sandbox.
• Resource Usage Inspections - Reports live CPU, memory, and network statistics for running sandboxes to monitor resource usage.
• Output Field Filters - Filters sandbox log entries by source, tail count, or grep pattern to isolate relevant output.
• Metric Dimensional Attributes - Attaches configurable attributes like sandbox name, ID, and user-defined labels to every metric datapoint.
• Multi-Backend Metric Exporters - Streams per-sandbox resource metrics to OTLP-compatible backends for monitoring and alerting.
• Container Log Retrieval - Retrieves stored stdout, stderr, and system log entries from sandboxes, even after they stop.
• Metric Streaming - Streams per-sandbox CPU, memory, disk, and network metrics at configurable intervals for real-time monitoring.
• Live Log Streaming - Follows sandbox log output live as it runs, showing new entries immediately.
• Point-in-Time Metric Monitoring - Fetches point-in-time snapshots of CPU and memory usage for running sandboxes.
• Guest Resource Limit Configurations - Configures per-sandbox rlimit constraints like file descriptors and process counts for guest workloads.
• Sandbox Status Displays - Displays the running state and process details of one or more sandboxes.
• SDK Log Listeners - Retrieves sandbox log entries programmatically with filtering options from any supported language.
• Full File Readings - Reads an entire file as raw bytes or as UTF-8 text, or streams its content in chunks.
• DevOps & Infrastructure - MicroVM sandboxing library.
• Virtualization & Containers - MicroVM library for isolated code execution.

Star history