BoxLite

Embed. Sandbox. Ship.

BoxLite is an embeddable micro-VM runtime that runs untrusted code in hardware-isolated sandboxes.

Unlike Docker containers that share the host kernel, each BoxLite sandbox runs its own kernel—making escape impossible. No daemon, no root access needed. Just pip install boxlite and sandbox.

Sub-second boot
OCI/Docker compatible
macOS & Linux
Python, Rust, C SDKs
Python
import boxlite

async with boxlite.SimpleBox("python:slim") as box:
    result = await box.exec("python", "-c", "print('Hello!')")
    print(result.stdout)  # Hello!

Why Choose BoxLite?

Hardware-isolated sandboxing with the simplicity of a library

Hardware Isolated

Why is BoxLite more secure than Docker?

Each sandbox runs in a micro-VM with its own Linux kernel. Unlike Docker containers that share the host kernel, BoxLite provides true hardware-level isolation—a VM escape is orders of magnitude harder than a container escape.

OCI Compatible

Can I use my existing Docker images?

Yes! BoxLite is fully OCI-compatible. Pull images from Docker Hub, GHCR, ECR, or any registry. Layer caching ensures fast subsequent startups.

Full Linux Environment

What can code do inside a BoxLite sandbox?

Everything. Each sandbox is a complete Linux environment—install packages, run services, use GPUs. Full freedom inside, complete isolation outside.

Batteries Included

Does BoxLite include networking and storage?

Yes. Full internet access, port forwarding, DNS resolution, volume mounts, and persistent QCOW2 disks—all built-in with zero configuration required.

Cross-Platform

What platforms does BoxLite support?

macOS on Apple Silicon (M1/M2/M3/M4) via Hypervisor.framework, and Linux on x86_64 and ARM64 via KVM. No Windows support currently.

Async-First

Is BoxLite async/await compatible?

Built for modern async Python and Rust. Non-blocking I/O, real-time stdout/stderr streaming, and concurrent sandbox execution.

BoxLite