Self-hosted microVM sandboxes and Rust harnesses that own the agent boundary

zerobootdev

Sub-millisecond KVM sandboxes for agents via copy-on-write Firecracker snapshot forking with tiny memory footprints.

Use caseUse it to spawn hundreds of hardware-isolated Python or shell sandboxes in under a millisecond for parallel agent tool calls.

aerol-ai

Single-binary self-hosted sandbox platform supporting containerd, gVisor, Firecracker, WASM and V8 isolates with Raft clustering.

Use caseUse it to stand up multi-runtime agent sandboxes on one Linux host or a HA cluster with E2B and Daytona API facades.

BitMiracle-AI

Self-hosted E2B-compatible sandbox platform where sandboxes are permanent, idle freezes cost almost nothing, and one key always returns the same box.

Use caseUse it to give every agent a durable, freezeable sandbox on hardware you already own instead of paying per-second cloud boxes.

smol-machines

Embeddable portable microVM that boots under 200 ms via Hypervisor.framework or KVM, packs into a single file, and supports OCI images.

Use caseUse it to run local agent code in hardware-isolated VMs with elastic memory and opt-in networking without a Docker daemon.

e2b-dev

Open-source Firecracker control plane, orchestrator and guest agent that powers E2B sandboxes, runnable on your own hardware.

Use caseUse it to self-host the exact microVM runtime behind E2B so agent code execution stays inside your boundary.

AML-memory

Open reproducible eval platform and challenge for long-term agent memory systems across textual and coding tracks.

Use caseUse it to benchmark your memory graph or store against standardized LongMemEval-style tasks before production.

François Zaninotto

Audit of 246 harness repos and 57 publications shows harness choice moves coding success rates by 20 points on fixed models and tools. Practical guidance covers minimal harnesses, scripted rules, eval loops and preventing harness rot.

Read

Visweshyc et al.

Canary takes changesets from coding agents, spins verification swarms in remote sandboxes, and returns evidence-backed failure scenarios for the agent to fix. It treats intended behaviour and must-never-allow rules as first-class inputs.

Read