Under Validation

Sandbox every local agent tool call in a throwaway MicroVM.

A Linux CLI that boots Firecracker or QEMU in under a second, runs untrusted agent commands with CPU/memory throttling, and destroys the guest when the tool returns. No cloud, no shared daemon.

Join the waitlist See how it works

Concept validation only. No payment, no commitment, no recurring newsletter.

Decision brief Validating

Why local agents need a stronger boundary than a shell

Local coding agents increasingly execute shell, package installs, and untrusted scripts on the host. Containers help, but many SOHO Linux setups want a harder isolation boundary without standing up a full Kubernetes stack. This concept is a thin CLI that provisions a transient MicroVM, pipes stdio, and auto-cleans — aimed at developers already running agents on KVM-capable Linux hosts.

Best fit: Linux developers running local agents (Claude Code, OpenCode, custom loops) on KVM hosts who want per-tool MicroVM isolation.
Not for: macOS/Windows-only workflows, teams that already standardize on gVisor/Kata at scale, or anyone needing a managed cloud sandbox.
Current status: Concept validation; no production build yet

Local-first directionPortable outputsBuilt around a specific workflowEarly access is free

Proposed workflow

What the waitlist is testing

Honest scope: Linux/KVM first. Boot-time and agent-framework adapters are still open questions.

Transient MicroVM lifecycle

Boot guest → run one tool command with limits → stream logs → destroy. No long-lived multi-tenant VM service.

Host stays the source of truth

Optional read-only bind of the workspace; writes stay in the guest unless you explicitly promote an artifact.

Local only

No telemetry backend. You keep the binary and the policy files on your machine.

The honest status

This is a product decision, not a finished product.

The concept is being validated before development time is committed. Joining tells us the problem is relevant to you and gives you first access if the evidence supports a build.

You will not be charged.
Your email is only used for this experiment.
You can leave the list at any time.

Before you decide

Questions, answered clearly.

The current scope, privacy model, and next step without launch-day promises.

Does this run on macOS?

Not in the first design. Firecracker needs KVM. macOS would need a different backend (e.g. lightweight VM) and is out of scope for the smoke test.

Is this a replacement for Docker?

No. It targets a harder isolation boundary for untrusted agent tool runs. If containers already meet your threat model, you may not need it.

Does this guarantee the intended outcome?

No. Isolation quality depends on host KVM, guest image, and policy. Human review of agent actions remains required.

What happens when I request access?

Your email is recorded for this experiment only. You receive one relevant update or beta invitation if the concept moves forward.

Early access

Want a local MicroVM boundary for agent tools?

Join the waitlist. No spam — one update if we ship a Linux beta.