BoxLite

The compute substrate for AI agents.
Discord:

[BoxLite @BoxLiteAI]

BoxLite is a masterpiece.

Most AI sandbox discussions focus on speed and pricing.

But there’s another question:

Where should your agents actually run?

With BoxLite, developers can embed hardware-isolated microVMs directly into their applications.

> Open source.
> Local-first runtime.
> Built for untrusted code execution.

Not every agent needs another cloud dependency.

[BoxLite @BoxLiteAI]

🕷️Your scraper is waiting on a website.
Why give it a whole CPU?
We’re exploring smaller BoxLite Cloud sizes:

Pico → 0.125 CPU
Nano → 0.25 CPU
Micro → 0.5 CPU

Tiny jobs deserve tiny machines🤏.
Would you run your crawler on 1/8 of a CPU?

[BoxLite @BoxLiteAI]

prompt: make a sick edit for the most badass sandbox
https://t.co/nekpqL6QAV

[BoxLite @BoxLiteAI]

Fable 5.2 is nuts! 🔥

[BoxLite @BoxLiteAI]

A VM's security boundary includes its network path.

The PwnEscape research points outside the hypervisor: the Linux host networking stack.

Why BoxLite's default gvproxy path is different, and why the kernel fix still matters:
https://t.co/fk4qycrmD4

[BoxLite @BoxLiteAI]

3/

One runtime, from laptop to cloud.
Embed it as a library: no daemon, no root. Or run it on BoxLite Cloud.

Python · Node.js · Go · Rust · C. Apache 2.0. https://t.co/fzJyVwFWjN

[BoxLite @BoxLiteAI]

Introducing BoxLite

A computer your agents can't break
▲ A micro-VM per Box, with its own kernel
▲ Boots in <50ms, runs any OCI image
▲ ComputerBox: real computer use
▲ Checkpoint, roll back, fork
▲ Stateful: install once, resume later

pip install boxlite

[BoxLite @BoxLiteAI]

2/

Why not containers?

Containers share the host kernel.
Every Box runs its own Linux kernel on KVM / Hypervisor.framework.

Hardware-level isolation for untrusted LLM-generated code.

[BoxLite @BoxLiteAI]

As agents do more, they need an environment of their own.

BoxLite embeds real microVMs in your app, giving agents their own kernel to run code, use tools, and keep state. Hardware isolation. No daemon.

Developers can already pick BoxLite as a sandbox backend in Databricks’ Omnigent, AgentScope Runtime, and ByteDance’s DeerFlow — with more community adapters and deployment options on the way.

Give agents more room to work—and clear boundaries to work within.

Open source · Apache 2.0
https://t.co/u7dML6td55

[BoxLite @BoxLiteAI]

BoxLite is now an execution environment in Pydantic AI

Your agent gets a microVM on your own machine:
• No network by default
• allowed_hosts to open only what it needs
• No daemon, no cloud account
Thanks @marcelotryle and the @pydantic team!

📖 https://t.co/GXOsoo4Pq1

[Marcelo Trylesinski @marcelotryle]

The coding agent needed pytest. So its sandbox can reach PyPI, and nothing else 🔒

- BoxLiteSandbox with allowed_hosts
- pip install pytest worked
- A request to https://t.co/hl3K4hysUv failed
- A microVM on my Mac, no cloud account

https://t.co/EpbaJZbk7I

[BoxLite @BoxLiteAI]

@mattgapp @orca_build @t3dotgg @moboudra @useOrchestrator @ParadevAI @emdashcom @RunMaestroAI Definitely time to be boxlite^_^

[BoxLite @BoxLiteAI]

Agent fleets shipping hundreds of PRs a day aren't winning on model strength alone.
They win because the agent never holds a credential.

Each agent runs in a microVM with its own kernel. Real secrets stay on the host — only a placeholder lives inside the box. Egress is allow-listed. The disk survives stop/start, so the agent doesn't rebuild its environment every session.

That host/guest boundary is what actually scales.

BoxLite gives you exactly this:
• Own kernel per box
• Secret(name, value, hosts=[...]) — the real value never enters the guest
• allow_net locks outbound
• https://t.co/w3A0DS6iiO(...) to drive the fleet
• stop()/start() keeps the disk (auto_remove=False)

Running coding agents at scale? This is the substrate that keeps your host out of the blast radius.
https://t.co/iNpUIfvFpf

What are you still hitting when agents touch real systems?

[Dorian Zheng | BoxLite @d0r1anX]

We're writing a VMM from scratch in Rust, on KVM and Hypervisor.framework, to replace libkrun under BoxLite. Each step gets a write-up once its code merges.

What booting Linux actually takes, from part #0.5:

• No BIOS and no bootloader. The VMM copies the kernel out of the bzImage to 1 MiB, fills the 4 KiB "zero page" (command line, initramfs, E820 map), builds a GDT and identity-mapped page tables, and starts the vCPU in 64-bit mode at RIP 0x100200, with RSI pointing at the zero page.
• A 240-byte MP table at 0x9FC00 tells Linux where the CPU and the IOAPIC are. With no MP table and no ACPI, Linux falls back to one CPU on the legacy PIC.
• The only device is a 16550 UART. Writes from user space leave from the 8250 driver's interrupt handler, so the VMM has to raise IRQ 4 whenever the transmitter empties. Each character costs at least three VM exits.
• reboot() ends with 0xFE written to port 0x64, the i8042 reset line. That write is how the VM exits.
• Of the 1.76 s it takes to reach /init, 0.73 s goes to probing an i8042 that isn't there.

All of that fits in 190 lines of C: vmmlite.

The Rust VMM's KVM tests now boot real Linux on 4 vCPUs. Bringing up the other three took an MP table that lists every vCPU, plus handling EAGAIN: KVM_RUN on a parked vCPU returns it after INIT or SIPI, and it means "run again", not "fail".

Why replace libkrun at all (part #0):
• It ends the process itself, so the caller gets no exit status, and every start failure is -EINVAL.
• Its kernel is a shared library loaded with dlopen, which breaks on some hosts.
• Every directory volume is its own device, and three of them exhaust the IRQs.
• Hot-plug mounts, live resizing, memory snapshots and GPUs need a VMM we control.

Next: first boot on Apple silicon, Linux x86_64 and Linux arm64, all in CI. Then virtio from scratch.

Links in the reply 👇

[BoxLite @BoxLiteAI]

Building agent infra? BoxLite is an open-source microVM runtime you embed in your app.

Inspect the code, try it locally, and see how releases are built. https://t.co/fzJyVwFWjN

[BoxLite @BoxLiteAI]

Agent infra needs sandboxes you can verify.

BoxLite just ranked #1 of 10 sandboxes on #HVTracker's trust score (85.6), with the one only A grade. Our npm & PyPI releases carry provenance linking packages to source commits + CI builds.

🔗Read more: https://t.co/8DP3K2RwKO
#AIAgents #AgentInfra #BoxLite

[BoxLite @BoxLiteAI]

“Embedded” means a runtime inside your application—not a platform deployed on one machine.

BoxLite is a true embeddable VM runtime for secure, isolated execution. No daemon. No Docker. No extra Linux host VM.

𝘱𝘪𝘱 𝘪𝘯𝘴𝘵𝘢𝘭𝘭 𝘣𝘰𝘹𝘭𝘪𝘵𝘦

👇https://t.co/jLNA0xahFZ

[BoxLite @BoxLiteAI]

Thanks for featuring BoxLite!
Persistent state means agents can keep their installed packages and files across runs. Would love to see any feedback and what the community would build with it 👀

[GitHub Projects Community @GithubProjects]

BoxLite runs apps in isolated micro-VMs that keep their state between runs.

- Runs any standard container image
- Keeps installed packages and files
- Works as an embeddable library

[BoxLite @BoxLiteAI]

Appreciate the shoutout. We’re exploring exactly this direction at BoxLite: what infrastructure should look like when it’s built for AI agents from the ground up.

[yan5xu @yan5xu]

@yifanxu_ephai 你可以看看 boxlite，老王投的
有一段时间，我记得哪个挺大的web3的交���所，也在做sandbox，名字给忘了
https://t.co/gs8MbhR46T