BoxLite
Embeddable, daemonless microVM library that runs OCI images in hardware-isolated boxes on a laptop or server, with an optional managed cloud. A practical choice when you want microVM isolation embedded in your own process rather than behind a service.
Overview
BoxLite is an Apache-2.0 runtime whose "Box" is a hardware-isolated microVM that runs any OCI image. It is a library first: Python, Node.js, Go, Rust and C bindings call a Rust core that boots a VM on KVM (Linux, including WSL2) or Hypervisor.framework (Apple Silicon macOS) with no daemon, and an optional boxlite serve mode exposes a REST API with WebSocket exec. The security docs describe two layers: the VM boundary with a separate guest kernel, and a jailer around the host-side shim (seccomp, namespaces and an unprivileged uid on Linux; Seatbelt on macOS), and they advise "For running untrusted code in production, prefer Linux".
Boxes keep a QCOW2 copy-on-write disk, persist across stop/restart, can be cloned and exported as archives, and support volume mounts, PTYs, per-command timeouts and an egress allow-list. BoxLite Cloud sells the same API as a managed service from $0.0666 per hour with $100 of starting credit. Neither the README nor the site uses an alpha/beta label; macOS on Intel is "Coming soon".
Notable
- Docs claim boxes "start in about a second"
- BoxLite Cloud pay-as-you-go from $0.0666 per hour; plans at $19, $149 and $499 per month
- Supports Linux x86_64/ARM64 (KVM), Apple Silicon macOS 12+ and Windows via WSL2; Intel macOS "Coming soon"
BoxLite specifications
| Attribute | Details |
|---|---|
| Isolation | Hardware-virtualised microVM with its own guest kernel (KVM on Linux, Hypervisor.framework on macOS), plus a jailer around the host-side shim: seccomp allowlist, mount/PID namespaces and privilege drop on Linux, Seatbelt on macOS |
| Deployment | Open-source project · Self-hostable |
| Open source | Yes (Apache-2.0) |
| SDKs and interfaces | Python, JavaScript/TypeScript, Go, Rust, C, CLI, REST API |
| Cold start (vendor claim) | Docs: boxes "start in about a second"; the README gives no boot-time figure and notes a second start is faster because of the image cache |
| Max session length | Not documented |
| Persistence | Boxes persist across stop/restart and "resume across turns"; per-box QCOW2 copy-on-write disk, volume mounts (ro/rw), clone, and export/import as .boxlite archives; detached boxes outlive the parent process |
| GPU | Not documented |
| Networking | Outbound internet with an egress allow-list (allow_net), local TCP port forwarding, local/remote tunnels; secrets are injected so real values never enter the VM; user-mode network stack with a fixed subnet |
| Pricing | Open-source runtime is free. BoxLite Cloud: pay-as-you-go from $0.0666 per hour for the smallest box; Starter $19/month, Pro $149/month, Max $499/month, Enterprise custom; boxes up to 4 vCPU and 32 GiB memory |
| Free tier | $100 free credits on BoxLite Cloud; free to self-host |
| Compliance | Not documented |
| Regions | Not documented |
Facts from BoxLite’s public documentation, verified November 9, 2026. Performance numbers are vendor claims.
Strengths and trade-offs
Strengths
- You want a microVM sandbox as an in-process library with bindings in five languages
- You need boxes that survive restarts and can be cloned or exported
- You run on Apple Silicon laptops as well as Linux servers
- You want a managed cloud with the same API as the local runtime
Trade-offs
- Requires hardware virtualisation; the docs say it is "Not available in most CI runners, nested VMs, or containers"
- macOS jailer has no privilege drop, cgroups or network namespace; the docs prefer Linux for untrusted code
- No GPU, compliance or region documentation; snapshots are not a documented feature (clone and export/import are)
Good fit for: Embedding a microVM sandbox directly in your own process on a laptop or server without running a daemon.
How BoxLite compares
| Sandbox | Isolation | Open source | Self-host / BYOC | Cold start (vendor) | Max session | Snapshots / pause | GPU | SDKs |
|---|---|---|---|---|---|---|---|---|
| BoxLite | microVM + jailer | Yes | Yes / No | ~1 s (claim) | Not documented | Not documented / Not documented | Not documented | Python, JavaScript/TypeScript, Go, Rust, C, CLI, REST API |
| Celesto (SmolVM) | Firecracker / QEMU microVM | Yes | Yes / No | ~500 ms (claim) | Not documented | Yes / Yes | Not documented | Python, JavaScript/TypeScript, CLI, MCP server |
| Microsandbox | MicroVM (libkrun) | Yes | Yes / Yes | <100 ms | Not documented | Yes / Not documented | No | TypeScript, Python, Rust, Go, Ruby, CLI, MCP server |
| Arrakis | Cloud Hypervisor microVM | Yes | Yes / No | Not documented | Not documented | Yes / Not documented | Not documented | Python, REST API, CLI, MCP server |
| libkrun | In-process microVM | Yes | Yes / No | Not documented | Not documented | Not documented / Not documented | Yes | Rust, C |
| Firecracker | KVM microVM | Yes | Yes / No | <125 ms (spec) | Not documented | Yes / Yes | No | REST API, CLI |
| E2B | Firecracker microVM | Yes | Yes / Yes | Not documented | 1 h / 24 h (Pro) | Yes / Yes | No | Python, JavaScript/TypeScript |
Frequently asked questions
What is BoxLite?
How does BoxLite isolate code?
Is BoxLite open source?
How much does BoxLite cost?
What are the alternatives to BoxLite?
Sources
Cite this page
Agent Sandboxes. (2026). BoxLite. agentsandboxes.org. Last reviewed November 9, 2026. https://agentsandboxes.org/sandboxes/boxlite/
Found an error or a missing sandbox? Submit a correction — every entry links to the sources it relies on.