superradcompany / microsandbox

——   easy, fast, programmable microVMs for untrusted workloads   —— 
**Microsandbox** runs **untrusted workloads** inside fast, local microVMs: AI agents, user code, plugins, CI jobs, dev environments, scrapers, and automation.
##
- **Hardware Isolation**: Hardware-level isolation with tiny virtual machines.
- **Fork & Snapshot**: Fork live sandboxes[^demo]. Save running sandbox state and restore later.
- **Cross Platform**: Runs on Linux, macOS, and Windows.
- **OCI Compatible**: Runs standard container images from Docker Hub, GHCR, or any OCI registry.
- **Docker-Like Workflows**: Familiar image, command, shell, and volume workflows.
- **Instant Startup**: Average boot times[^boot-time] under 100 milliseconds.
- **Embeddable**: Spawn VMs right within your code. No setup server. No long-running daemon.
- **Secrets That Can't Leak**: Unexploitable secret keys that never enter the VM.
- **Long-Running**: Sandboxes can run in detached mode. Great for long-lived sessions.
- **Agent-Ready**: Your agents can create their own sandboxes with our Agent Skills and MCP server.
##   Getting Started
####   Install the CLI
> [code] 
>
> [code] 
>
> 
>  We also support other package managers → 
>
> ##
>
> [code] 
>
> [code] 
>
> [code] 
>
> [code] 
>
> 
>
> ##
>
> Start creating sandboxes once installed:
>
> [code] 
####   Install the SDK
> [code] 
>
> [code] 
>
> [code] 
>
> [code] 
##
> **Requirements**:
>
> - **macOS**: Apple Silicon.
> - **Linux**: KVM enabled.
> - **Windows**: WHP enabled.
>
> **Warning**: Microsandbox is still **beta software**. Expect breaking changes, missing features, and rough edges.
##   CLI
The `msb` CLI provides a complete interface for managing sandboxes, snapshots, images, and volumes.
####   Run a Command
> [code] 
####   Named Sandboxes
> [code] 
>
> [code] 
>
> [code] 
>
> [code] 
>
> Forking duplicates live execution. Restoring starts from saved state; add `--cow-mem` to share unchanged memory from a full snapshot. Snapshot generations describe progression, while branches describe distinct paths through snapshot history. The old `--forked` restore flag remains a deprecated alias. See forking and snapshots.
>
> [code] 
####   Image Management
> [code] 
####   Configuration File
> [code] 
>
> [code] 
####   Status & Inspection
> [code] 
> [!TIP]
>
> Run: 
> · `msb --help` for quick help menu. 
> · `msb --tree` for complete command hierarchy and descriptions. 
> · `msb --tree` for a specific command tree.
##   SDK
The SDK lets you create and control sandboxes directly from your application. `Sandbox.builder("...").create()` boots a microVM as a child process. No infrastructure required.
####   Run Code in a Sandbox
> [code] 
>
> 
>  Rust Example → 
>
> [code] 
>
> 
> 
>  Python Example → 
>
> [code] 
>
> 
> 
>  Ruby Example → 
>
> [code] 
>
> See the Ruby SDK guide for installation, lifecycle,
> networking, and backend details.
>
> 
>
> 
>  Go Example → 
>
> [code] 
>
> 
> The first call to `create()` pulls the image if it isn'