{"slug": "show-hn-sandkiln-fast-firecracker-microvm-sandboxes-for-ai-generated-code", "title": "Show HN: Sandkiln – Fast Firecracker MicroVM sandboxes for AI-generated code", "summary": "A developer released Sandkiln, an MIT-licensed, self-hosted sandbox that runs each piece of untrusted or AI-generated code in its own Firecracker microVM with a dedicated kernel, filesystem and network, rather than in a shared-kernel container. Sandkiln's published benchmarks put cold start at 10.5–10.9ms on a single dev box, against roughly 100ms to 1s or more for containers, and the project ships a Rust VMM, a static guest agent on vsock, an HTTP daemon, a Python SDK, a JS/TS SDK and a CLI. The project positions hardware virtualization via KVM as the isolation boundary for running code you didn't write, and lists pre-warmed pools, an egress firewall, seccomp filters and Jailer hardening as roadmap items not yet shipped.", "body_md": "# Run untrusted code onhardware you control.\n\nEvery execution gets its own Firecracker microVM. Its own kernel, its own filesystem, its own network. Not a container with extra steps.\n\nA Rust VMM, a static guest agent on vsock, an HTTP daemon driving both. Self-hosted, MIT licensed, benchmarked in the open.\n\n```\n[    0.000000] Linux version 5.10.223 (gcc 11.4.0) #1 SMP[    0.000000] Command line: console=ttyS0 reboot=k panic=1[    0.000000] Hypervisor detected: KVM[    0.005803] Booting paravirtualized kernel on KVM[    0.046087] smp: Brought up 1 node, 2 CPUs[    0.214030] virtio_blk virtio0: [vda] 300 MiB[    0.259624] VFS: Mounted root (ext4) on device 254:0[    0.279281] Run /sbin/init as init process[    0.302006] systemd[1]: systemd 249.11 running         Starting sandkiln-agent.service...[  OK  ] Started sandkiln-agent.service Ubuntu 22.04.5 LTS ubuntu-fc-uvm ttyS0ubuntu-fc-uvm login: root (automatic login)\n```\n\nEvery track is the same log axis, 100µs to 1s, one tick per decade — so the marks compare directly. One dev box, single node.\n\n[isolation](#isolation)\n\n## Containers share a kernel.Sandboxes can't afford to.\n\nAgent output, user uploads, third-party scripts. Running code you didn't write beside your own systems is a bad bet when the boundary is a namespace. A compromised container can still be a compromised kernel.\n\n| Property | A container | A sandkiln sandbox | \n|---|---|---|\n| Kernel | Shared with the host | Dedicated per sandbox | \n| Isolation boundary | Namespaces and cgroups | Hardware virtualization (KVM) | \n| Cold start | ~100ms–1s+ | 10.5–10.9ms, measured | \n| Escape surface | Shared syscall table | The microVM boundary | \n| Filesystem | Overlay on the host filesystem | Dedicated virtio-blk device | \n| Suited to | Packaging code you wrote | Running code you didn't | \n\n[surface](#surface)\n\n## Everything a sandbox needs,marked by what's actually true.\n\nThree marks, because two would lie. A capability that runs but isn't reachable from every client says so here rather than hiding behind a filled square.\n\n- Isolation\n- Networking\n- Auth\n- Tags\n- File operations\n- Interactive terminal\n- Guest-accessible metadata\n- Per-sandbox I/O rate limiting\n- Durable sandbox history\n- Snapshot lineage\n- Observability\n- Snapshots & persistence\n- Drives\n- Auto-suspend on idle\n- Multi-agent isolation\n- Python SDK\n- Benchmarking\n- Local tunnel\n\n- Pre-warmed pools\n- JS/TS SDK\n- CLI\n- Remote storage mounts\n- Time-travel restore\n- Egress firewall\n- Custom & managed images\n- Jailer hardening\n\n- Streamed output\n- Seccomp filters & disk quotas\n- System-privileged workloads\n\nEvery item above, with what it does and exactly where it stops, is on the [roadmap](https://sandkiln.vercel.app/roadmap/).\n\n[client](#sdk)\n\n## A thin, fully-typed client.Nothing more.\n\nThe daemon's HTTP API is the source of truth. Every SDK method is a thin wrapper over it, verified against a live daemon rather than designed in isolation — so the same four calls read the same way in all three.\n\n``` js\nimport { Sandbox } from \"sandkiln\";\n\n// Boots a real Firecracker microVM — own kernel, own filesystem, own network.\nconst sandbox = await Sandbox.create({\n  tags: { env: \"ci\", owner: \"pipeline\" },\n});\n\nconst result = await sandbox.runCommand(\"python3\", [\"analyze.py\"]);\nconsole.log(result.stdout, result.exitCode);\n\nawait sandbox.stop(); // preserved as a resumable snapshot by default\npython\nfrom sandkiln import Sandbox\n\n# Boots a real Firecracker microVM — own kernel, own filesystem, own network.\nsandbox = Sandbox.create(tags={\"env\": \"ci\", \"owner\": \"pipeline\"})\n\nresult = sandbox.run_command(\"python3\", [\"analyze.py\"])\nprint(result.stdout, result.exit_code)\n\nsandbox.stop()  # preserved as a resumable snapshot by default\nnpm install -g sandkiln-cli   # installs the `kiln` command\n\n# Boots a real Firecracker microVM — own kernel, own filesystem, own network.\nkiln sandbox create --tag env=ci --tag owner=pipeline\n\nkiln sandbox exec <id> python3 analyze.py\nkiln sandbox ls --tag env=ci\n\nkiln sandbox rm <id>           # preserves state as a snapshot by default\n```\n\nQuickstarts for [JS/TS](https://sandkiln.mintlify.site/getting-started/js), [Python](https://sandkiln.mintlify.site/getting-started/python) and [the CLI](https://sandkiln.mintlify.site/getting-started/cli), or the [daemon HTTP API](https://sandkiln.mintlify.site/reference/http-api) that every one of them wraps.\n\n[further](#more)", "url": "https://wpnews.pro/news/show-hn-sandkiln-fast-firecracker-microvm-sandboxes-for-ai-generated-code", "canonical_source": "https://sandkiln.vercel.app/", "published_at": "2026-10-20 09:09:46+00:00", "updated_at": "2026-10-20 09:16:58.464372+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "developer-tools", "ai-safety", "ai-infrastructure"], "entities": ["Sandkiln", "Firecracker", "KVM", "Rust", "Python", "JavaScript", "TypeScript"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/show-hn-sandkiln-fast-firecracker-microvm-sandboxes-for-ai-generated-code", "markdown": "https://wpnews.pro/news/show-hn-sandkiln-fast-firecracker-microvm-sandboxes-for-ai-generated-code.md", "text": "https://wpnews.pro/news/show-hn-sandkiln-fast-firecracker-microvm-sandboxes-for-ai-generated-code.txt", "jsonld": "https://wpnews.pro/news/show-hn-sandkiln-fast-firecracker-microvm-sandboxes-for-ai-generated-code.jsonld"}}