Skip to content

Add kvm-jailbox to Sandboxing & Isolation #16

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ertug wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Add kvm-jailbox to Sandboxing & Isolation #16

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,6 +51,7 @@ Projects using **Linux** security primitives (and a few Mac exceptions) such as
| [goose + boxlite discussion](https://github.com/block/goose/issues/6040) | KVM, libkrun | GitHub issue discussing integration of boxlite KVM-based sandboxing into Block's goose agent framework. |
| [smolVM](https://github.com/smol-machines/smolvm) | KVM, libkrun, MicroVM | MicroVM sandbox using [libkrun](https://github.com/containers/libkrun) and KVM with <200ms boot, network off by default, and a `pack` command that builds portable single-binary VMs. |
| [Freestyle](https://www.freestyle.sh/) | KVM, MicroVM, nested-virt | Managed agent-scale sandbox infrastructure: full Linux KVM VMs (not containers) with nested virtualization, real root access, sealed multi-user isolation inside each VM, git repos per agent with bidirectional GitHub sync, scales to 10k+ concurrent agents. |
| [kvm-jailbox](https://github.com/ertug/kvm-jailbox) | QEMU, KVM, libvirt, private-network-isolation | Persistent per-project development VMs for coding agents on a plain libvirt/KVM stack: host nftables rules deny the guest every private address (host, LAN, other jailboxes, VPNs, cloud metadata) while internet access stays unrestricted, `clean-traffic` nwfilter drops IP/MAC spoofing at L2, and the device model is stripped (no graphics, USB, balloon, virtio channels, TPM, nested virt) to shrink VM-escape exposure. `kvm-jailbox check` verifies containment by port-scanning private addresses from inside the guest. See the [configuration guide](https://karamatli.com/posts/network-isolated-kvm-sandbox-ai-agents/). |
| [Confidential Agents](https://confidential.ai/docs/api/confidential-agents) | SEV-SNP, TEE, attestation | Managed Confidential VM service for AI agents: AMD SEV-SNP hardware TEE isolation (host cannot inspect memory), attestation chain verifying hardware + TPM + inference gateway. Open-source [verification CLI](https://github.com/confidential-dot-ai/confidential-cvm-cli). |
| [Sprites](https://sprites.dev/) | Firecracker, MicroVM, checkpoint-restore | Fly.io's managed Firecracker-based persistent Linux VMs for running coding agents or arbitrary code; checkpoint/restore in ~300ms, pre-installed with Claude Code and Codex CLI, API and CLI access. |
| [InstaVM](https://instavm.io/) | MicroVM, egress-filtering, secrets-injection | Managed microVM sandboxes for AI agents: dedicated kernel per sandbox, default-deny egress with domain/CIDR allowlists, proxy-based secret injection (agents never see API keys), full execution logs and network traces. |
Expand Down