Hyperlight is a production-grade library for safely executing untrusted code inside hypervisor-isolated micro virtual machines. It spins up lightweight VMs in milliseconds without requiring a guest kernel or operating system, making it suitable for sandboxing plugins, serverless functions, and other untrusted workloads. The system supports multiple hypervisor backends (KVM on Linux, MSHV on Windows, WHP on Windows, HVF on macOS) and architectures (x86_64, aarch64), with guest binaries compiled as no_std Rust or C ELF files using a custom libc (picolibc). Communication between host and guest is performed via typed function calls serialized with FlatBuffers over VM exits, and the library provides snapshot/restore capabilities using an OCI-compatible image layout for state persistence. The architecture is centered around a host-side Rust library (`hyperlight_host`) that exposes a builder pattern (`SandboxBuilder`) to configure and create sandboxes. The guest runtime (`hyperlight_guest_bin`) handles initialization, page tables, exception handling, and function dispatch. A component model integration (`hyperlight_component_util`) generates Rust bindings from WIT (WebAssembly Interface Types) for higher-level interfaces. The system also includes guest tracing with OpenTelemetry, metrics collection, crash dump generation, and GDB debugging support. External dependencies include hypervisor-specific APIs (KVM ioctls, WHP, HVF), the FlatBuffers serialization library, and the OCI image layout specification for snapshot storage. Key data flows involve the host loading a guest binary, setting up memory regions (code, heap, stack, scratch), registering host functions, and then executing guest functions via VM entries. The guest can call back into the host through registered host functions. Snapshots capture the full guest state (memory, registers, MSRs) and can be saved to disk as OCI-compatible blobs, then restored to create new sandboxes or recover from failures. The library is extensively tested with unit tests, integration tests, fuzz targets, and concurrency stress tests, and is maintained as a CNCF sandbox project with active development and frequent releases.
Kata Containers is an open-source secure container runtime that runs each container inside a lightweight virtual machine (microVM), providing strong workload isolation while maintaining container-like performance and orchestration. The project provides a containerd shim-v2 implementation, a guest-side agent, and supports multiple hypervisors including QEMU, Cloud Hypervisor, Firecracker, and its own built-in VMM (Dragonball). It integrates deeply with Kubernetes (runtime classes, CSI, mutating webhooks, policy generation via Rego) and supports confidential computing features (TDX, SEV-SNP, IBM Secure Execution, ARM CCA). The codebase is dual-language: the primary runtime is written in Go, with a newer Rust rewrite (runtime-rs) that shares core libraries with the agent and Dragonball VMM. The project is actively maintained with extensive CI, multi-architecture support, and a large ecosystem of tools (agent-ctl, kata-ctl, log-parser, trace-forwarder, genpolicy). While the architecture is modular and many components (e.g., safe-path, dbs-allocator, retry library) are independently reusable, the coexistence of two runtime implementations, generated API clients, and architecture-specific code introduce some technical drift and maintenance overhead.
Ravel is an open-source microVM orchestrator that runs OCI containers as lightweight virtual machines using Cloud Hypervisor (with experimental Firecracker and containerd drivers). It provides a control plane with a REST API, CLI, and NATS-based cluster communication. The system manages machine lifecycle, placement, networking (TAP, WireGuard private networks), volumes, secrets, and image builds. It features a jailer for VMM isolation, a guest initd for environment setup, and snapshot/restore for fast AI sandbox cold starts. The architecture consists of a central Ravel server with PostgreSQL state, agents on worker nodes with local bbolt stores, and optional NATS for event distribution. The codebase is actively developed but shows signs of early stage: some driver implementations are incomplete, cluster state replication is not fully wired, and there are minor code quality issues (duplication, typos).
This repository implements Composite, a component-based research operating system where kernel policies (scheduling, memory management, synchronization) are implemented as user-level components. It runs on x86-32, x86-64, and ARMv7a architectures, primarily under QEMU. The system provides a minimal kernel with capability-based security, synchronous invocation (sinv) for inter-component communication, and shared-memory channels. It includes a full musl libc port for POSIX compatibility, a DPDK-based network stack, an lwIP adapter for TCP/IP, and a simple VMM with virtio-net and device emulation. The architecture is closer to a microkernel than a traditional monolithic kernel, with components loaded and composed via a Rust-based composer tool that reads TOML specifications. A large suite of microbenchmarks measures IPC, scheduling, and synchronization latency. The codebase is pre-alpha quality, with many FIXMEs and incomplete features, but demonstrates strong craftsmanship in its abstraction layers (assembly stubs, channel library, scheduler framework, perfdata utility).