Why this matters
Hardware-level isolation is a pragmatic way to run code you don't fully trust while minimizing blast radius. As agents, CI jobs, plugin systems, and other automation increasingly execute third-party code, a lightweight microVM runtime that boots quickly and can be embedded into apps lets you keep untrusted work visibly separate from host processes and credentials.
What Sets It Apart
- Hardware isolation, not just namespaces: uses microVMs with a guest kernel so the security boundary is virtualization hardware rather than process/container namespaces — this reduces many host-escape classes common in container-only sandboxes.
- Instant, local-first workflow: boots guests in tens of milliseconds (average guest boot under ~100 ms on measured hardware), supports standard OCI images, and exposes Docker-like commands and lifecycle operations so teams reuse existing image workflows.
- Embeddable SDK + CLI parity: SDKs for Rust, TypeScript, Python, and Go let applications spawn sandboxes as child processes (no long-running daemon). The msb CLI mirrors the same lifecycle, image, and volume commands for interactive and automated use.
- Agent and secret integration: provides Agent Skills and an MCP server so LLM/agent toolchains can create and control sandboxes; supports host-side secrets with policies that prevent secret material from entering the guest.
Who It's For & Trade-offs
Great fit if you need to run untrusted or third-party workloads with a stronger isolation boundary than containers — examples include AI coding agents, user-submitted code execution, CI job isolation, browser automation, and document processing. The SDK/CLI model makes it convenient to integrate directly into developer tooling or agent workflows.
Look elsewhere if you require a fully managed multi-tenant cloud service today (cloud offering is private beta), or if your target hosts cannot enable required virtualization primitives: macOS requires Apple Silicon, Linux requires KVM, and Windows requires WHP. Also note the project is labeled beta — expect API changes and rough edges while the project matures.
Where It Fits
Positioned between heavyweight VM infrastructure and lightweight containers: it aims to combine the usability and image compatibility of container workflows with the stronger security properties of a microVM. Useful as a drop-in isolation layer for agent-driven automation, CI runners, and developer sandboxes where credential and network egress control matter.
