zeroboot: Create Fast VM Sandboxes for AI Agents

Overview

Zeroboot is a Rust project for creating isolated virtual-machine sandboxes for code execution. It snapshots a prepared Firecracker VM, then forks new instances using copy-on-write memory mappings, avoiding a full boot for each execution.

It is intended for AI-agent and developer platforms that run untrusted or short-lived code and need stronger isolation than a process-based sandbox. Self-hosting requires a Linux machine with KVM; a managed API is also offered.

Key Features

• Forks VM instances from snapshots using copy-on-write memory.
• Uses KVM virtual machines for hardware-enforced memory isolation.
• Runs code through an HTTP API and provides Python and TypeScript SDKs.
• Supports self-hosting or use of the managed API.
• Uses serial I/O for communication with sandboxes.
• Includes a template-based workflow that preloads a runtime before taking a snapshot.

Use Cases

• AI-agent platform teams executing generated Python or JavaScript code in isolated VMs.
• Developer-tool builders who need to create many short-lived execution environments from a prepared template.
• Infrastructure teams evaluating low-latency sandboxing, when Linux hosts with KVM are available.
• Teams that want to experiment with a managed code-execution API before operating their own infrastructure.

Getting Started

Try the hosted API with the example request below, or see the README for SDK and self-hosting instructions:

curl -X POST https://api.zeroboot.dev/v1/exec \
  -H 'Content-Type: application/json' \
  -H 'Authorization: Bearer zb_demo_hn2026' \
  -d '{"code":"print(1 + 1)"}'

Alternatives

• CubeSandbox: CubeSandbox uses RustVMM and KVM for scalable agent sandboxes, while zeroboot creates copy-on-write forks of Firecracker snapshots.
• sandbox-sdk: sandbox-sdk runs isolated code environments on Cloudflare's edge, while zeroboot runs Firecracker-based VM sandboxes.
• ClawLess: ClawLess sandboxes Node.js agents in browser-based WebContainers, while zeroboot provides VM-level isolation using Firecracker.

Considerations

• The README describes the project as a working prototype, not production-hardened.
• Self-hosting requires Linux with KVM.
• Forks use a single vCPU and have no networking; communication is through serial I/O.
• Forked environments share snapshot CSPRNG state. Kernel entropy is reseeded, but userspace PRNGs such as NumPy and OpenSSL need explicit reseeding per fork.
• Updating a template requires a full re-snapshot, reported as taking about 15 seconds, with no incremental patching.