boxlite-ai/boxlite

The micro-VM for AI agents — light enough to embed on your laptop, elastic enough to power an agentic cloud.

What it solves

BoxLite provides a secure, isolated execution environment for AI agents to run code, install packages, and manage files. It solves the problem of "cold starts" by allowing agents to maintain persistent state across multiple turns of interaction, while ensuring that the code execution is hardware-isolated from the host system to prevent security risks.

How it works

BoxLite creates "Boxes," which are hardware-isolated micro-VMs that run any OCI (Docker) image. It uses a combination of hardware virtualization (KVM on Linux, Hypervisor.framework on macOS) and OS-level sandboxing (seccomp or sandbox-exec) to ensure strong isolation. Unlike traditional containers, it is daemonless and can be embedded as a library directly into an application, meaning it requires no root access or background services to operate.

Who it’s for

Developers building AI agents that need a safe, persistent sandbox for executing arbitrary code, as well as teams deploying agentic clouds that require multi-tenant, autoscaling execution substrates.

Highlights

  • OCI-native: Runs any standard Docker image without modification.
  • Persistent State: Boxes persist across stop and restart, allowing agents to resume work without starting from scratch.
  • Daemonless Embedding: Can be integrated as a library in Python, Node.js, Go, Rust, or C without needing a background daemon.
  • Granular Security: Includes egress allow-lists for networking and secret injection that keeps sensitive values out of the VM.
  • Multi-platform Support: Works across macOS (Apple Silicon), Linux, and Windows (via WSL2).

Related

  • Project
    Katakate/k7

    k7 is an open‑source platform that lets you run isolated VM sandboxes (via Kata, Firecracker, QEMU, or Katakate’s own k7d runtime) on Kubernetes. It targets AI agents needing to execute untrusted code at scale, offering fast warm‑forks, Docker‑in‑VM support, snapshotting, and optional Cilium network policies. Install via APT, manage sandboxes with the `k7` CLI or Python SDK, and control everything through an automatically deployed HTTPS API.

  • Project
    superradcompany/microsandbox

    A cross‑platform runtime that launches hardware‑isolated micro‑VMs (microVMs) from any OCI container image. Designed for untrusted workloads—AI agents, user scripts, CI jobs, browser automation—its microVMs boot in < 100 ms, can be controlled via a CLI (`msb`) or SDKs in TypeScript, Rust, Python, Ruby, and Go, and guarantee that secrets never leak into the VM. It’s aimed at giving AI agents a safe, fast sandbox for code execution.

  • Project
    jingkaihe/matchlock

    A CLI tool and SDK for running AI agents in isolated, ephemeral microVMs with network allowlisting and secure secret injection via MITM proxy.

  • Project
    tensorlakeai/tensorlake

    A compute infrastructure platform that provides secure, high-performance MicroVM sandboxes and serverless orchestration for running AI agents and LLM-generated code.

  • Dispatch
    Securing AI Agents with Isolated Docker Sandboxes

    An exploration of agent-sandbox, a tool designed to run AI coding agents within isolated Docker containers to prevent unauthorized system access and ensure execution safety.