Agent Sandboxesagentsandboxes.org
Sandbox profile · Open-source project

libkrun

Answer in brief

A dynamic library that lets any program launch a microVM in-process, on KVM in Linux or Hypervisor.framework on macOS; used by crun/Podman, krunkit and microsandbox. The microVM library to reach for when you want VM isolation inside your own tool, especially on macOS.

By the Agent Sandboxes editors · Updated

Overview

libkrun is an Apache-2.0 dynamic library from the containers GitHub organisation (its security contact is a Red Hat mailing list) that gives a program "the ability to run processes in a partially isolated environment" using "KVM Virtualization on Linux, HVF on macOS/ARM64", with Windows Hypervisor Platform support listed as upcoming. It bundles a VMM with virtio console, block, fs, gpu, net, vsock, balloon, rng and rtc devices and exposes a native Rust API plus an autogenerated C API, so the microVM is created inside the calling process rather than by launching a separate binary. Variants add AMD SEV (libkrun-sev) and Intel TDX (libkrun-tdx) memory encryption. The README warns that "The VM boundary does not restrict host resources exposed through devices".

libkrun is the microVM layer in several tools: crun uses it for "virtualization-based isolation to container and confidential workloads" (Podman's --runtime=krun), krunkit runs GPU-enabled VMs on macOS, and muvm launches GPU-accelerated microVMs for games. microsandbox, which is on this site, credits libkrun in its README acknowledgements as a project that "made microsandbox possible" alongside smoltcp. Being a library, libkrun has no snapshot, session or orchestration features of its own. The stable branch reached libkrun-1.19.8 on 6 November 2026; the main branch is libkrun 2.0, which "isn't backwards compatible with 1.x" and whose API may still change.

Notable

  • Runs on Linux (KVM) and macOS/ARM64 (Hypervisor.framework), the only microVM primitive in this batch that documents Apple Silicon
  • libkrun-1.19.8 released 6 November 2026; main branch is libkrun 2.0 with a changing API
  • Named users: crun (Podman --runtime=krun), krunkit and muvm; microsandbox credits it in its acknowledgements

libkrun specifications

AttributeDetails
IsolationmicroVM embedded in the calling process via KVM on Linux or Hypervisor.framework (HVF) on macOS/ARM64, with a minimal set of virtio devices; the README calls this a "partially isolated environment"
DeploymentOpen-source project · Self-hostable
Open sourceYes (Apache-2.0)
SDKs and interfacesRust, C
Cold start (vendor claim)Not documented
Max session lengthNot documented
PersistenceNot documented
GPUYes - virtio-gpu with venus and native-context; krunkit uses it for "GPU-enabled (via venus) lightweight VMs on macOS" and muvm for GPU-accelerated microVMs
NetworkingTransparent Socket Impersonation (TSI) or virtio-net connected to a user-space proxy such as passt or gvproxy
PricingFree and open source
Free tierFree to self-host
ComplianceNot documented
RegionsNot documented

Facts from libkrun’s public documentation, verified November 9, 2026. Performance numbers are vendor claims.

Strengths and trade-offs

Strengths

  • You want microVM isolation on a developer Mac as well as Linux servers
  • You are writing your own sandbox tool and want to embed the VMM as a library with Rust or C bindings
  • You need GPU access inside the VM via virtio-gpu
  • You want confidential-computing variants (SEV, TDX) from the same codebase

Trade-offs

  • Described by its own README as "partially isolated"; devices you expose become part of the attack surface
  • No snapshot/restore or pause/resume documented
  • Rust and C only; no higher-level SDK or control plane
  • Windows support is upcoming, not shipped

Good fit for: Embedding a microVM in your own tool on Linux or Apple Silicon without shipping a separate VMM.

How libkrun compares

SandboxIsolationOpen sourceSelf-host / BYOCCold start (vendor)Max sessionSnapshots / pauseGPUSDKs
libkrunIn-process microVMYesYes / NoNot documentedNot documentedNot documented / Not documentedYesRust, C
FirecrackerKVM microVMYesYes / No<125 ms (spec)Not documentedYes / YesNoREST API, CLI
MicrosandboxMicroVM (libkrun)YesYes / Yes<100 msNot documentedYes / Not documentedNoTypeScript, Python, Rust, Go, Ruby, CLI, MCP server
Kata ContainersVM per podYesYes / NoNot documentedNot documentedNot documented / Not documentedYesCLI
Apple containerLightweight VM per containerYesNo / NoSub-second (claimed)Not documentedNo / NoNot documentedCLI
Celesto (SmolVM)Firecracker / QEMU microVMYesYes / No~500 ms (claim)Not documentedYes / YesNot documentedPython, JavaScript/TypeScript, CLI, MCP server

See all libkrun alternatives →

Frequently asked questions

What is libkrun?
A dynamic library that lets any program launch a microVM in-process, on KVM in Linux or Hypervisor.framework on macOS; used by crun/Podman, krunkit and microsandbox. The microVM library to reach for when you want VM isolation inside your own tool, especially on macOS.
How does libkrun isolate code?
libkrun documents its isolation as: microVM embedded in the calling process via KVM on Linux or Hypervisor.framework (HVF) on macOS/ARM64, with a minimal set of virtio devices; the README calls this a "partially isolated environment".
Is libkrun open source?
Yes (Apache-2.0). It can be self-hosted.
How much does libkrun cost?
Free and open source Check the official pricing page for current rates.
What are the alternatives to libkrun?
Common alternatives include Firecracker, Microsandbox, Kata Containers, Apple container, Celesto (SmolVM). See libkrun alternatives for a full comparison.

Sources

  1. github.com/containers/libkrun
  2. github.com/containers/libkrun/blob/main/README.md
  3. github.com/containers/libkrun/releases
  4. github.com/zerocore-ai/microsandbox

Cite this page

Agent Sandboxes. (2026). libkrun. agentsandboxes.org. Last reviewed November 9, 2026. https://agentsandboxes.org/sandboxes/libkrun/

Found an error or a missing sandbox? Submit a correction — every entry links to the sources it relies on.