arrakis
microvmmicrovm-toolopen sourceA self-hosted sandbox for agent code execution on Cloud , notable for snapshot-and-backtrack and for a badly stale engine pin.
Engine and architecture are from the project's own README; the attack-surface, leakage, and pin-lag figures are from the June 2026 study, measured on default settings around 2026-05-20. The pin in particular is worth re-checking before you rely on it, in either direction.
arrakis is a self-hosted sandboxing solution for AI agent code execution and computer use, built on Cloud , with a REST API, a Python SDK, automatic port forwarding, and out-of-the-box snapshot/backtracking for multi-step agent workflows. Each sandbox gets its own guest kernel behind a hardware boundary, with overlayfs protecting the root filesystem. The June 2026 comparative study makes it the sharpest illustration of this guide's pin-gap lesson: it had the widest host attack surface measured in that set, including live /dev/kvm ioctl responses from a reachable nested-KVM surface, and its engine pin sat at Cloud v44.0 for 471+ days across twelve upstream releases, leaving a host-leak CVE unpatched for 90+ days after upstream shipped the fix the same day it was disclosed. The authors are explicit that this is an absence of bump policy, not an engine defect.
Strengths
- Hardware boundary per sandbox via Cloud Hypervisor, self-hosted and fully customisable
- Snapshot and backtracking built in, which suits multi-step agent workflows better than plain restart
- REST API plus Python SDK, with automatic port forwarding
- Sits on the one microVM VMM in that study with an in-tree fuzzer
Limitations
- Widest host attack surface in the June 2026 study: 170 /dev entries, 12 of 14 kernel-LPE primitives reachable, and confirmed live /dev/kvm ioctl responses
- Worst engine pin measured anywhere in that study: Cloud Hypervisor v44.0 held for 471+ days across twelve upstream releases, with CVE-2026-27211 left unpatched 90+ days after a same-day upstream fix
- Applies one of seven standard hardening layers by default; the rest are the operator's to stack
- Leaks the host CPU brand string via cpuinfo by default, though this is configurable
- Linux only, and requires KVM
Files & editor
edit-insideProgrammatic microVMs driven over a REST API or Python SDK, with snapshot/backtracking rather than interactive editing.
How you get your project into the environment and edit it. Shared-kernel routes bind-mount host files for your desktop editor; own-kernel routes keep files in the guest, so a desktop editor attaches over remote, or you edit inside. Mounts and remote editing.
VMM second wall
VMM second wall: partialinherits Cloud Hypervisor's per-thread seccomp, measured at mode 2 on 32 of 33 threads with the leader thread unfiltered; no jailer-style privilege drop of its own.
The second wall confines the VMM itself, so a compromised device backend can't own the host. It's separate from the hardware boundary every microVM already has. The two walls, explained.