Pullrun
Apache-2.0 sandbox runtime that runs the same OCI image as a runc container, a Firecracker microVM on Linux or an Apple Virtualization VM on macOS, with a CLI and MCP server. A promising self-hosted OCI-to-microVM runtime for teams who want to own the sandbox layer, but not yet a hosted platform.
Overview
Pullrun is an open-source runtime, written in Rust and Go, that takes an OCI image and runs it either as a runc container, as a Firecracker microVM with its own kernel on Linux (KVM) or as an Apple Virtualization.framework VM on Apple Silicon Macs; Windows is supported through WSL2. It ships as a single binary with a 30-plus-command CLI, Docker Compose compatibility, a Kubernetes CRI shim (labelled beta) and a built-in MCP server exposing 15 tools for agent clients such as Claude Code, Cursor and opencode. Images are stored in a content-addressed store so many concurrent sandboxes share one copy of each layer.
State is handled at the image level: commit turns a running workload's filesystem into a new layer and stopped VMs keep their rootfs, but there is no documented pause/resume of a running VM. Security controls include Cosign signature verification, SBOM checks, seccomp profiles, read-only rootfs and secrets encrypted at rest. The project is at v0.7.x; the README calls the container runtime stable, the CRI shim beta and the Firecracker and Apple VM backends "feature-complete but evolving". A hosted sandbox API and managed control plane are described as planned, so today it is self-host only.
Notable
- Version 0.7.8–0.7.9 at verification, 134 GitHub stars, Apache-2.0 with a CLA for contributions.
- README: single 12 MB binary with a 24.6 MiB idle daemon RSS; Firecracker cold boot ~500 ms and Apple VM boot ~160 ms (vendor benchmark on an Apple M3).
- Hosted API and managed control plane are listed as "Planned"; the Kubernetes CRI shim is labelled beta.
Pullrun specifications
| Attribute | Details |
|---|---|
| Isolation | Firecracker microVM with a per-VM kernel on KVM (Linux), Apple Virtualization.framework VM (macOS) or runc container, chosen per workload |
| Deployment | Open-source project · Self-hostable |
| Open source | Yes (Apache-2.0) |
| SDKs and interfaces | CLI, MCP server |
| Cold start (vendor claim) | README (vendor benchmark on an Apple M3, cold cache): Firecracker cold boot ~500 ms, warm ~200 ms; Apple Virtualization VM boot ~160 ms; container run ~400 ms |
| Max session length | Not documented |
| Persistence | commit writes a running workload's filesystem to a new image layer; stopped VMs retain state (Firecracker and Apple VM rootfs persist, container rootfs is ephemeral); save/load export tarballs |
| GPU | Not documented |
| Networking | Five --net modes: isolated, bridge, slirp, host and none, with IPAM, DNS and iptables integration; per-pod bridge subnets with NAT under the Kubernetes CRI shim |
| Pricing | Free to self-host under Apache-2.0. The website describes enterprise "per-node pricing" and a planned hosted API "billed per active sandbox-second", with no figures published |
| Free tier | Free to self-host |
| Compliance | Not documented |
| Regions | Not documented |
Facts from Pullrun’s public documentation, verified November 9, 2026. Performance numbers are vendor claims.
Strengths and trade-offs
Strengths
- You want one runtime that boots the same OCI image as a container or a microVM on Linux and on Apple Silicon.
- You need an Apache-2.0 sandbox layer you can self-host with no central daemon.
- You run agents through MCP clients and want a built-in MCP server rather than an SDK.
- You want image-level commits and air-gapped save/load of sandbox state.
Trade-offs
- No hosted service yet; the managed API is only "planned".
- No language SDKs; interaction is through the CLI, Compose files or MCP.
- Pause/resume of running VMs, GPU support and session limits are not documented.
- Early project: v0.7.x, 134 stars and backends the README describes as still evolving.
Good fit for: Running agent workloads from OCI images as microVMs on your own Linux hosts or Apple Silicon Macs.
How Pullrun compares
| Sandbox | Isolation | Open source | Self-host / BYOC | Cold start (vendor) | Max session | Snapshots / pause | GPU | SDKs |
|---|---|---|---|---|---|---|---|---|
| Pullrun | Firecracker / Apple VM / runc | Yes | Yes / No | ~500 ms (claim) | Not documented | Yes / Not documented | Not documented | CLI, MCP server |
| Microsandbox | MicroVM (libkrun) | Yes | Yes / Yes | <100 ms | Not documented | Yes / Not documented | No | TypeScript, Python, Rust, Go, Ruby, CLI, MCP server |
| Firecracker | KVM microVM | Yes | Yes / No | <125 ms (spec) | Not documented | Yes / Yes | No | REST API, CLI |
| BoxLite | microVM + jailer | Yes | Yes / No | ~1 s (claim) | Not documented | Not documented / Not documented | Not documented | Python, JavaScript/TypeScript, Go, Rust, C, CLI, REST API |
| Celesto (SmolVM) | Firecracker / QEMU microVM | Yes | Yes / No | ~500 ms (claim) | Not documented | Yes / Yes | Not documented | Python, JavaScript/TypeScript, CLI, MCP server |
| Docker Sandboxes | MicroVM | No | Yes / No | Not documented | Until removed (local) | Yes / Yes | Yes | sbx CLI, TypeScript (cloud), REST API (cloud) |
| Apple container | Lightweight VM per container | Yes | No / No | Sub-second (claimed) | Not documented | No / No | Not documented | CLI |
Frequently asked questions
What is Pullrun?
How does Pullrun isolate code?
Is Pullrun open source?
How much does Pullrun cost?
What are the alternatives to Pullrun?
Sources
Cite this page
Agent Sandboxes. (2026). Pullrun. agentsandboxes.org. Last reviewed November 9, 2026. https://agentsandboxes.org/sandboxes/pullrun/
Found an error or a missing sandbox? Submit a correction — every entry links to the sources it relies on.