microvm

Run Untrusted Code Safely.
Self-Hosted or Fully-Managed Sandbox Infrastructure for AI Agents and Ephemeral Workloads.

Documentation · Quick Start · Report Bug · Request Feature

AerolVM is open-source sandbox infrastructure for running isolated code environments - self-host it on your own Linux host, or run it as a managed, multi-tenant service. Each sandbox is a fully isolated compute unit with its own filesystem, network stack, and allocated resources - create latency as low as 4ms server-side (V8 isolate warm path) and supporting OCI containers on containerd (default), gVisor, Firecracker, WASM, and V8-isolate runtimes. Built for AI agent pipelines and ephemeral CI, it ships as a single Go binary backed by Caddy for TLS routing and SQLite for state, with no external dependencies and a one-line installer.

Features

AerolVM provides a complete surface for building sandbox-backed products and agent workflows.

Why AerolVM

AerolVM beats the two most common alternatives on the axes that matter most for AI workloads: isolation, cost, and operational simplicity.

See the full comparison →

vs e2b

e2b is the fastest managed path if you want zero infrastructure, but it means your code runs on someone else's hardware with no self-hosting option, per-sandbox-hour billing that compounds fast at scale, a hard 1-day sandbox lifetime cap, and a single isolation model. AerolVM covers the same AI execution use case on infrastructure you own — pick OCI on containerd, gVisor, Firecracker, WASM, or V8 isolates — with predictable fixed-cost pricing.

Already on the e2b SDK? AerolVM's /e2b API facade means your existing code keeps working - just point E2B_API_URL at your AerolVM host.

vs Daytona

Daytona targets long-lived developer workspaces, not high-frequency ephemeral agent workloads. It requires multi-component infrastructure that is genuinely difficult to self-host and has no kernel-level isolation, no per-sandbox egress control, and no port allowlist. AerolVM is a single binary you install in 60 seconds.

Already on the Daytona SDK? AerolVM's /daytona API facade lets you swap the backend without touching your SDK code - just update DAYTONA_API_URL.

Architecture

AerolVM is a single Go binary (sandboxd) wired to three components:

• Caddy - handles wildcard TLS via DNS-01, L7 HTTP routing (<sandbox-id>.<domain>), and L4 TCP SNI routing (<sandbox-id>-<port>.<domain>). The daemon talks to the Caddy admin API; no config files are reloaded at runtime.
• Runtimes - OCI containers (runtime: "docker" on the containerd engine by default; dockerd optional), gVisor (runsc), Firecracker (microVM), WASM (WASI workers / resident host), and V8 isolate (workerd). WASM and isolate are host-mediated and Runtime-only.
• SQLite (WAL mode, single-writer) - stores sandbox state, the TCP host-port pool, exposed-port intents, and sealed secrets. Single-writer means no contention; WAL mode means reads never block writes.

For multi-host deployments, sandboxd nodes form a cluster using Raft (FSM-replicated placement state) and SWIM gossip (membership + capacity heartbeats). Nodes take server, worker, or ingress roles. The Raft voter count stays fixed at 3 or 5 regardless of how many workers you add - the same topology Kubernetes uses for control-plane vs. data-plane scaling. See Cluster Setup.

┌─────────────────────────────────────────────────────┐
│                    sandboxd                         │
│                                                     │
│  ┌──────────┐   ┌──────────┐   ┌─────────────────┐  │
│  │  HTTP    │   │ Service  │   │    SQLite store │  │
│  │  API v1  │──▶│  layer   │──▶│  (WAL, 1-writer)│  │
│  └──────────┘   └────┬─────┘   └─────────────────┘  │
│                      │                              │
│          ┌───────────┼───────────┐                  │
│          ▼           ▼           ▼                  │
│  containerd/gVisor  Caddy      SSH gateway            │
│  FC/WASM/isolate  admin API  (Ed25519)              │
└─────────────────────────────────────────────────────┘

Runtimes

Create latency (live UC-94)

Server-side create from Server-Timing (excludes client↔cluster WAN). Artifacts under integration-tests/reports/. Production deployments use the containerd engine for OCI sandboxes (runtime: "docker" on the wire).

Reproduce: make integration-benchmark-isolate, integration-benchmark-wasm, integration-benchmark-containerd, integration-benchmark-fc, integration-benchmark-gvisor.

SDKs

AerolVM ships first-party SDKs for five languages. Install the one that matches your stack:

# TypeScript / Node.js
npm install @aerol-ai/aerolvm-sdk

# Python
pip install aerolvm

# Go
go get github.com/aerol-ai/microvm/sdk/go

# Rust
cargo add aerolvm

# Java (Maven)
# <dependency><groupId>ai.aerol</groupId><artifactId>aerolvm-sdk</artifactId></dependency>

Quick Start

import { MicroVM } from '@aerol-ai/aerolvm-sdk'

const client = new MicroVM({
  apiUrl: process.env.SB_API_URL,
  patToken: process.env.SB_PAT_TOKEN,
})

const sandbox = await client.create({ image: 'ubuntu:22.04' })

// Run a command and stream output
const stream = await sandbox.execStream('python3 -c "print(\'hello\')"')
stream.on('data', chunk => process.stdout.write(chunk))

// Expose a port and get a public URL
const url = await sandbox.exposePort(3000)
console.log(url) // https://<sandbox-id>-3000.sandbox.example.com

await sandbox.destroy()

from aerolvm import MicroVM
import os

client = MicroVM(
    api_url=os.environ["SB_API_URL"],
    pat_token=os.environ["SB_PAT_TOKEN"],
)

sandbox = client.create(image="ubuntu:22.04")

result = sandbox.exec("python3 -c \"print('hello')\"")
print(result.stdout)

url = sandbox.expose_port(3000)
print(url)  # https://<sandbox-id>-3000.sandbox.example.com

sandbox.destroy()

package main

import (
    "context"
    "fmt"
    "os"

    microvm "github.com/aerol-ai/microvm/sdk/go/pkg/microvm"
    sdktypes "github.com/aerol-ai/microvm/sdk/go/pkg/types"
)

func main() {
    client := microvm.New(microvm.Options{
        APIURL:   os.Getenv("SB_API_URL"),
        PATToken: os.Getenv("SB_PAT_TOKEN"),
    })

    ctx := context.Background()
    sandbox, _ := client.Create(ctx, sdktypes.CreateSandboxOptions{
        Image: "ubuntu:22.04",
    })

    result, _ := sandbox.Exec(ctx, "echo hello")
    fmt.Println(result.Stdout)

    sandbox.Destroy(ctx)
}

Full examples for Rust and Java are in the SDK Setup docs.

Drop-in SDK Compatibility

If you are already running the e2b or Daytona SDK, AerolVM has API facades that accept their wire format unchanged:

Using the e2b SDK → · Using the Daytona SDK →

Installation

See Server Setup for all installation paths: local development, single-node production with wildcard TLS, and multi-node cluster deployment.

Use Cases

Documentation

Contributing

AerolVM is open source under the MIT License. Contributions are welcome - open an issue first for non-trivial changes so we can align on the approach before you invest time in an implementation.

make fmt      # format Go code
make test     # run tests
make build    # build sandboxd + toolboxd into bin/

License

MIT · © Aerol AI, Inc.