BoxLite: Micro-VM Engine for AI Agents
Hardware-isolated micro-VMs for AI agents — light enough to embed, elastic enough for cloud-scale.
- Source repo
- boxlite-ai/boxlite
- Stars
- ★ 2.6k
- Last updated
- today
- License
- Apache-2.0
- Primary language
- TypeScript
- FA score
- 57/100 · Major gaps
At a glance
- How it runs
- Works with
- Universal · cross-platform
- Cost
- Free, no paid service needed
- Setup effort
- Low · running in minutes
- You'll need
- Typical use
- AI agent developers: Embed BoxLite in local apps to give agents isolated, persistent code execution environments.
- Not a fit if
- Linux users without KVM or hardware virtualization
- Users on Intel-based Macs
- Teams unwilling to pay one VM per Box in resources
- Source review
- 57/100 · Major gaps
What does this agent do, and when should you use it?
BoxLite is a Rust-written micro-VM engine designed for AI agents. It can be embedded as a library in applications or deployed as a multi-tenant cloud service. Each 'Box' is a hardware-isolated VM that runs any OCI image and persists state across interactions, allowing agents to retain installed packages and files. BoxLite provides SDKs for Python, Node.js, Go, Rust, and C, along with a CLI and REST API. It emphasizes daemonless operation, embedding directly without requiring root privileges. Security is enforced through hardware virtualization (KVM/Hypervisor.framework) and OS-level sandboxing (seccomp/sandbox-exec). BoxLite supports macOS (Apple Silicon) and Linux (x86_64, ARM64), with plans for more platforms. It is already integrated with agent frameworks like Databricks Omnigent, Alibaba AgentScope Runtime, and ByteDance deer-flow.
BoxLite performs the following:
- Creates and manages hardware-isolated micro-VMs (Boxes) via libraries or CLI.
- Pulls and runs any OCI image (e.g., python:slim, alpine:latest).
- Executes commands inside VMs with streaming stdout/stderr, exit codes, interactive PTY, timeouts, and workdir settings.
- Supports persistent storage; Box state survives stop/restart.
- Controls network access via allow_net, plus port forwarding and tunneling.
- Injects secrets such that real credentials never enter the VM.
- Enforces CPU, memory, and resource limits, plus environment sanitization.
- Can run as a standalone server via CLI, exposing a REST API.
- AI agent developers: Embed BoxLite in local apps to give agents isolated, persistent code execution environments.
- Platform engineers: Use the BoxLite CLI to quickly create isolated micro-VMs for running OCI images in testing or data processing.
- Research teams: Integrate BoxLite into custom agent harnesses (like deer-flow) as a sandbox backend for computational isolation.
- Cloud providers: Use BoxLite's control plane to deploy multi-tenant agent clouds with autoscaling.
- Security-sensitive applications: Leverage hardware isolation and network allow-listing (allow_net) to protect sensitive data and prevent agent overreach.
How do you install or deploy this agent?
Install the Python SDK:
pip install boxliteInstall the CLI (optional):
curl -fsSL https://sh.boxlite.ai | shRequires macOS 12+ (Apple Silicon) or Linux with KVM enabled (/dev/kvm accessible). Windows users need WSL2 with KVM support.
How do you use this agent?
Using in Python:
import asyncio
import boxlite
async def main():
async with boxlite.SimpleBox(image="python:slim") as box:
result = await box.exec("python", "-c", "print('Hello from BoxLite!')")
print(result.stdout)
asyncio.run(main())Run an image with CLI:
boxlite run python:slim python -c "print('Hello from BoxLite!')"Start a REST server:
boxlite serve
curl -X POST http://localhost:8100/v1/boxes -H 'Content-Type: application/json' -d '{"image": "alpine:latest"}'What are this agent's strengths and limitations?
- Hardware isolation is stronger than containers yet lighter than full VMs.
- Multi-language SDKs (Python, Node.js, Go, Rust, C) plus REST API enable easy integration.
- Boxes persist, allowing agents to maintain state across interactions.
- Daemonless design allows embedding without root privileges.
- Requires hardware virtualization (KVM/Hypervisor.framework); may not work on Linux without KVM.
- macOS Intel support is not yet available.
- Running multiple Boxes as a library can be resource-intensive (one VM per box).
- Network restrictions (allow_net) require explicit configuration; default is open egress.
How does this agent compare with similar options?
Compared to Docker containers, BoxLite offers stronger isolation (hardware virtualization) at the cost of more overhead. Compared to other micro-VM solutions like Firecracker, BoxLite focuses on AI agent scenarios with a simpler API and persistence features.
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| BoxLite: Micro-VM Engine for AI Agents This agent | 57 · Major gaps | Library / SDKFree | ★ 2.6k | today | TypeScript | — |
| microsandbox | 61 · Some gaps | CLIFree | ★ 8.7k | today | Rust | Claude Code |
| The Astrid Runtime | 70 · Some gaps | CLIFree + model costs | ★ 10k | 4d ago | Rust | — |
| OpenFang | 56 · Major gaps | CLIFree + model costs | ★ 18k | 5mo ago | Rust | OpenAI API · Claude API |
How does FollowAgents rate this agent?
Why each dimension lost points
Evidence: README emphasizes hardware isolation, seccomp/sandbox-exec, resource limits, environment sanitization, and allow_net and secret injection (real values never enter VM), indicating partial least privilege. But no user confirmation mechanism documented. Data flow transparency limited; no detailed data flow or logging. Sensitive data handling has secret injection and env sanitization, but no storage encryption. Dependency security: Cargo.toml uses git dependency (youki) with pinned rev, but no audit or vulnerability scan evidence. External effects: network restrictions and port forwarding documented, but default network policy not specified. Rollback: snapshots and export/import exist, but rollback process not explicit. Source attribution: author listed in Cargo.toml, but publisher unverified. Deductions: missing user confirmation, limited data flow transparency, unclear rollback, unverified publisher.
Evidence: README and CI workflows consistent; version numbers in Cargo.toml and package.json inconsistent (0.9.7 vs 1.0.0). Dependency availability: CI build process exists, but no availability guarantee. Failure messages: tests for error handling, but no user-visible failure message examples. Deductions: version inconsistency, dependency availability not guaranteed.
Evidence: README describes multiple use cases (embed, CLI, server, cloud), multi-language SDKs, platform support list. Capability boundaries: allow_net, resource limits, but default limits not specified. Trigger precision: CLI and API documented, but trigger conditions not detailed. Environment fit: macOS, Linux, WSL2 supported, but no native Windows. Deductions: default capability boundaries unclear, trigger documentation not detailed.
Evidence: README structure clear, install notes (pip, npm, cargo, curl), naming stable (boxlite), examples and FAQ links, known limitations not explicitly listed, license Apache-2.0 (LICENSE file complete), version in Cargo.toml 0.9.7 but package.json 1.0.0, no CHANGELOG, maintenance responsibility mentioned (GitHub Issues, Discord). Deductions: version inconsistency, no CHANGELOG, known limitations not explicit.
Evidence: Output usability: SDKs provide stdout/stderr and exit codes, examples in docs. Marginal value: micro-VM isolation, unique value. Cost-benefit: open-source free, but no performance benchmarks. Deductions: no performance data, cost-benefit not quantified.
Evidence: README claims partially supported by docs (e.g., architecture diagram), but no test results or independent verification. Cross-source corroboration: CI workflows and test files exist, but no external validation. Fact-inference separation: not explicitly distinguished. Deductions: claims lack traceability, no independent verification, facts and inferences not separated.
- Version inconsistency: Cargo.toml 0.9.7 vs package.json 1.0.0, may cause confusion.
- Publisher unverified, identity unknown, evaluate cautiously.
- Dependencies use git pinned rev, but no dependency audit evidence.
- Lack of user confirmation mechanism, sensitive operations may proceed without prompt.
- Limited data flow transparency, logging and monitoring details insufficient.
Recent releases
Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.
-
Release notes excerpt
What's Changed * feat!: start a box from any public image by @silverzki in https://github.com/boxlite-ai/boxlite/pull/1547 * chore: update agent tooling to 0.1.27 by @DorianZheng in https://github.com/boxlite-ai/boxlite/pull/1941 * feat(infra): manage a dedicated OpenAPI log reader by @DefeatMan in https://github.com/boxlite-ai/boxlite/pull/1932 * fix(api): enforce box/proxy API-key permissions, authorize volume attach by @Monsteer714 in https://github.com/boxlite-ai/boxlite/pull/1911 …View on GitHub ↗ -
Release notes excerpt
What's Changed * chore: ignore local agent instruction files by @mamamiyear in https://github.com/boxlite-ai/boxlite/pull/1817 * feat(vmm): expose x86 entry register configuration by @DorianZheng in https://github.com/boxlite-ai/boxlite/pull/1710 * feat(vmm): expose host CPUID and checked MSR configuration by @DorianZheng in https://github.com/boxlite-ai/boxlite/pull/1711 * feat(copy): accept docker's SRC/. spelling for a directory's contents by @ltstriker in https://github.com/boxlite-ai/boxlite/pull/1826 …View on GitHub ↗ -
Release notes excerpt
What's Changed * chore: adopt agent-tooling 0.1.21 by @DorianZheng in https://github.com/boxlite-ai/boxlite/pull/1618 * docs(ssh): explain russh and guest SSH architecture by @DorianZheng in https://github.com/boxlite-ai/boxlite/pull/1649 * docs(infra): map cloud architecture and billing components by @DorianZheng in https://github.com/boxlite-ai/boxlite/pull/1650 * docs(infra): document configuration and image builds by @DorianZheng in https://github.com/boxlite-ai/boxlite/pull/1651 …View on GitHub ↗