Katakate/k7

Your own self-hosted infra for lightweight VM sandboxes to safely execute untrusted code. CLI, API, Python SDK. ⭐ Star it if you like it! ⭐

k7 – Self‑hosted Secure VM Sandboxes for AI Compute

What ?

  • k7 is an open‑source platform that lets you run untrusted code inside lightweight virtual‑machine sandboxes that are managed by Kubernetes. It is aimed at AI agents and other workloads that need to execute arbitrary code safely and at scale.

How ?

  • Orchestration – Uses K3s (a production‑ready Kubernetes distribution) to schedule sandbox pods.
  • Isolation back‑ends – Four options:
    1. kfd – Kata + Firecracker with a devmapper thin‑pool (fast boot, minimal attack surface).
    2. kql – Kata + QEMU backed by Longhorn PVCs (persistent, snapshot‑able disks).
    3. k7d – Katakate’s own microVM daemon built on KVM, offering warm copy‑on‑write forks of both disk and memory in ~5 ms.
    4. k7d‑fc – k7d combined with the Firecracker jailer.
  • Features – Docker inside the VM, warm‑fork, pause/resume, snapshot/restore, multi‑node clusters, optional Cilium + Hubble networking policies, and a REST API.
  • Clients – A Debian/Ubuntu apt package provides a CLI (k7), an automatically deployed API service, and a Python SDK (k7-sdk).

Why ?

  • Security – Each sandbox runs in its own VM, eliminating Docker‑in‑Docker risks and providing strong isolation for untrusted code.
  • Scalability – Designed for high‑throughput AI‑agent workloads; warm forks let you clone a running sandbox in milliseconds, enabling massive parallelism.
  • Flexibility – Choose the backend that matches your hardware and persistence needs (ephemeral Firecracker, persistent Longhorn, or the custom k7d runtime).
  • Open source – Apache‑2.0 licence, with community support via GitHub, docs, and a mailing address.

Who ?

  • AI‑agent developers who need to run user‑generated code safely.
  • Serverless platform builders wanting a self‑hosted alternative to AWS Fargate.
  • CI/CD teams seeking hardened runners without Docker‑in‑Docker.
  • Blockchain / AI dApp teams needing an execution layer for on‑chain code.

Quick start snapshot

  1. Install the CLI on a Ubuntu node: sudo add-apt-repository ppa:katakate.org/k7 && sudo apt update && sudo apt install k7.
  2. Provision the cluster (choose back‑ends): k7 install --backend kfd,kql,k7d --api-mode development.
  3. Create a sandbox with a simple k7.yaml and run: k7 create.
  4. Interact via CLI (k7 exec, k7 fork, k7 snapshot) or the Python SDK.

Maturity & limits

  • Currently beta and under security review – not recommended for highly sensitive production data.
  • k7d backend works only on amd64/x86_64; other back‑ends support arm64.
  • Requires hardware virtualization (KVM) and, for the kfd backend, a spare raw disk.

All details are taken directly from the repository’s README.

Related

  • Project
    xiaods/k8e

    K8E is an open‑source sandbox platform that turns any Linux host into a secure, isolated execution matrix for AI agents. Delivered as a single <100 MB binary, it provides a gRPC/mTLS gateway compatible with the E2B API, pluggable isolation runtimes (gVisor, Kata, Firecracker), Cilium‑enforced network policies, a warm‑pool for sub‑500 ms start‑up, resource quotas, snapshotting, and a standalone `k8e‑sandbox‑cli` client that agents (Claude Code, Codex, Pi) use to run code, manage files, and create sessions. Installation is a one‑line script after installing a runtime, and the system is Apache‑2.0 licensed.

  • Project
    kubernetes-sigs/agent-sandbox

    Agent Sandbox adds a Kubernetes CRD for a single, stateful, isolated pod (a “sandbox”). It’s designed for AI‑related workloads that need secure, long‑running containers with stable identity, persistent storage, and fast warm‑pool provisioning. Install via a single manifest, then create `Sandbox` or `SandboxClaim` resources; the controller creates pods using runtimes like gVisor or Kata. Go/Python SDKs and an optional router make programmatic use easy.

  • Dispatch
    Docker Sandboxes for AI Agents

    Docker Sandboxes provide isolated microVM environments for AI coding agents to execute commands and install packages safely without risking the host system.

  • Project
    opensandbox-group/OpenSandbox

    OpenSandbox provides isolated, secure environments on your own infrastructure for AI agents to execute code, run commands, and operate browsers or desktops.

  • Project
    yc-software/qm

    QM is an open‑source, self‑hosted platform for multi‑user AI agents. It provides isolated per‑person workspaces and shared Slack/web channels, supports any LLM via plug‑ins, stores state in PostgreSQL, and offers fine‑grained security/posture controls. Deploy with the `qm` CLI, customize via a deployment repo, and extend with skills, sandboxed tools, and background jobs.