Hyperlight isolates unmodified Linux apps in micro-VMs with snapshot speed

Recent security incidents involving AI-generated code and vulnerable runtimes have highlighted the urgent need for stronger isolation boundaries in cloud-native systems. In response, the CNCF Sandbox project Hyperlight has expanded its capabilities to run unmodified Linux applications inside lightweight, hypervisor-isolated micro-VMs. This development allows developers to execute potentially unsafe code from AI agents or third-party plugins with hardware-level security while maintaining startup speeds comparable to native processes through advanced snapshotting techniques.

What happened

Cloud infrastructure increasingly relies on executing code that development teams did not write, such as Python scripts generated by AI agents or plugins uploaded by customers. Two significant security events in 2026 underscored the risks of weak isolation. In May, the Mini Shai-Hulud npm worm infiltrated CI runners and developer machines, accessing over a thousand credential locations and persisting within AI coding agent session hooks. Later, in October, the PHP2Shell vulnerability exposed memory-handling bugs in the PHP runtime, allowing unauthenticated attackers to execute code on servers before patches were available. These incidents demonstrated that both malicious code and compromised runtimes can breach traditional software-based sandboxes.

Hyperlight addresses these threats by functioning as a library virtual machine monitor (VMM) rather than a standalone process like QEMU or Firecracker. Written in Rust with SDKs for Python and .NET, it embeds directly into applications to create micro-VMs isolated by CPU virtualization extensions. The project recently introduced hyperlight-unikraft, which enables the execution of standard Linux binaries without recompilation or special SDKs. This integration allows existing tools and workflows to leverage hypervisor-level security without the performance penalties typically associated with full virtual machines.

How it works

Hyperlight creates a micro-VM that contains only the necessary components for a single application, utilizing a unikernel from the Unikraft project. Unlike traditional virtual machines, these guests do not emulate unnecessary devices, reducing overhead and attack surface. The guest operating system shares no kernel with the host, meaning that even if the runtime or application code is compromised, the hypervisor prevents access to host resources. Permissions are capability-based, requiring the embedding application to explicitly allow network access or file mounts, ensuring that nothing is granted by default.

A key innovation in hyperlight-unikraft is its use of snapshots to mitigate startup latency. Language runtimes like Python, Node.js, and .NET often spend significant time importing modules or JIT-compiling code before executing user logic. Hyperlight performs this initialization once, then snapshots the micro-VM when the runtime is idle. Subsequent executions restore this snapshot in milliseconds, bypassing the heavy startup work. For workloads with substantial initialization costs, such as loading data science libraries, this approach can be significantly faster than native execution, while still providing the security benefits of hardware isolation.

Key details

• Hyperlight runs unmodified Linux binaries for languages including Python, Node.js, .NET, Java, PHP, Go, Rust, C, Bash, and PowerShell on x86_64 and arm64 architectures.
• The system uses hypervisor technologies such as KVM or MSHV on Linux, WHP on Windows, and Hypervisor.framework on macOS to enforce isolation.
• Snapshot restoration allows micro-VMs to start in milliseconds, with benchmarks showing a Python script importing numpy and pandas starting in 45 ms compared to 1,119 ms natively.
• Integrations include urunc for Kubernetes container runtime support, smolagents-hyperlight for AI agent code execution, and clickhouse-hyperlight for secure user-defined functions.
• The project demonstrated that a Wasmtime exploit (CVE-2023-26489) that could read host memory when run natively was contained within the micro-VM when executed via hyperlight-unikraft.
• Developers can build guest images using standard Dockerfiles to add packages via pip, npm, or other package managers, with the hluk CLI handling the conversion to guest images.

Why it matters

For software engineers building platforms that execute user-generated or AI-generated code, Hyperlight offers a practical solution to the trade-off between security and performance. Traditional process sandboxes are fast but vulnerable to kernel exploits, while full virtual machines are secure but slow to start. By combining hypervisor isolation with snapshot-based startup, Hyperlight enables secure execution environments that do not bottleneck application throughput. This is particularly critical for AI agent frameworks, which may need to spawn thousands of isolated execution environments to test or run model-generated code.

The ability to run unmodified binaries means teams do not need to refactor existing applications or learn new programming models to benefit from this security layer. Integrations with established ecosystems like Kubernetes and ClickHouse allow organizations to adopt this technology incrementally. For example, database users can define Python functions that run in isolated micro-VMs, ensuring that one user’s code cannot interfere with another’s or access server secrets. This capability supports multi-tenancy and security compliance without requiring complex infrastructure changes.

What you can do

• Install the hluk CLI on a Linux host with KVM or an Apple silicon Mac using the provided install script to begin experimenting with micro-VMs.
• Initialize a new project using the hluk init command with templates for Python or other supported languages to understand the build process.
• Evaluate the performance benefits for your specific workload by comparing native startup times against snapshot restoration times using the benchmark harness available on GitHub.
• Explore the urunc integration if you use Kubernetes, allowing you to run hyperlight-unikraft guests as standard OCI containers with optional snapshot resumption.
• Review the security demonstrations on GitHub, such as the Wasmtime exploit containment, to understand how the hypervisor boundary limits potential damage from runtime vulnerabilities.
• Consider integrating hyperlight-unikraft into AI agent frameworks or plugin systems where untrusted code execution is a regular requirement, leveraging the capability-based permission model to restrict access.