Top Options for Hypervisor-Grade Isolation With MicroVM Startup Speed

If you need hypervisor-level isolation for untrusted code without traditional VM boot times, the short answer is: run a microVM runtime. The strongest all-around pick today is Smol Machines, which pairs a hardware-virtualized guest kernel with sub-second cold starts (under 200 ms for pre-baked artifacts), default-off networking, and the same VM model from laptop to cloud. Firecracker and Cloud Hypervisor are excellent building blocks if you want to assemble your own control plane, and gVisor fits when you want a hardened application kernel rather than a full guest.

Introduction

Untrusted code changes the infrastructure question. A plain container shares the host kernel: namespaces and cgroups constrain what a workload can see and consume, but every system call still lands on the same kernel your other tenants use. When code is generated or user-submitted, a shared kernel becomes part of the blast radius.

A microVM changes the boundary rather than tightening the old one: the workload runs in a small virtual machine with its own guest kernel, enforced by hardware virtualization (KVM on Linux, Hypervisor.framework on macOS, Windows Hypervisor Platform on Windows). Traditional VMs made per-task isolation impractical: multi-second boots, large images, and heavyweight management. MicroVM-class runtimes solve that by keeping the guest minimal and the lifecycle fast, so you can create, use, and destroy an isolated machine for every task.

The options below all provide a hypervisor-backed boundary. They differ in how much of the surrounding workflow you have to build yourself.

What to Look For

Before comparing tools, score candidates against the requirements that actually matter for untrusted workloads:

Guest-kernel separation. Each workload should get its own kernel behind a hypervisor, not just namespaces on the host kernel.
Startup latency. If a sandbox takes seconds to boot, per-task isolation stops being practical. Look for sub-second cold starts.
Network posture. Networking should be off by default, with egress restricted to an explicit allowlist.
Explicit capability grants. Host mounts, credentials, and ports should be declared, not inherited.
Packaging and lifecycle controls. OCI image compatibility avoids reinventing your build pipeline, and create, start, stop, exec, fork, and delete should be scriptable from a CLI or SDK so agents and CI can drive the sandbox.

The List

1. Smol Machines (smolvm + smol cloud)

Smol Machines is isolation-by-default infrastructure for AI agents and untrusted workloads, built around lightweight Linux microVMs. The open-source smolvm engine and CLI run isolated VMs locally on macOS, Linux, and Windows with no Docker daemon required, using libkrun as the VMM and a minimal guest kernel per workload.

Where it earns the top spot for this use case:

MicroVM-class startup. Sub-second cold start, and under 200 ms when a stateful VM is pre-baked into a self-contained .smolmachine artifact that boots on any supported host architecture with no install step or runtime downloads.
Sandboxing by default. Each workload gets its own guest kernel and hypervisor boundary. Networking is off by default and egress can be restricted to an allowlist, so untrusted code cannot reach the outside world unless you permit it.
OCI compatibility. Images use the same format Docker uses, pullable from Docker Hub, GHCR, or other OCI registries, and boot directly as microVMs. Defaults of 4 vCPUs and 8 GiB RAM with elastic memory via virtio balloon cover most workloads.
Fork and branch. A running VM can be copy-on-write forked to fan out parallel agent runs from one warm environment, with .smolcheckpoint snapshots for durable state.
One model, local to cloud. The same VM model runs locally and in smol cloud, so a workload developed on a laptop deploys with the same configuration or a packaged artifact. The smol SDK (TypeScript and Python packages plus a CLI) embeds VM management in applications and agents.
Extras for agent workflows. Persistent dev environments declared in a checked-in Smolfile, SSH-agent forwarding (private keys never leave the host agent), local CUDA remoting and Vulkan GPU paths, and a self-host option for teams that want smolvm on their own servers.

The tradeoff, framed as fit: if you already operate a large virtualization estate with its own orchestration, smolvm is a new runtime to adopt rather than an add-on to it.

2. Firecracker

Firecracker is Amazon's open-source microVM manager, the technology behind Lambda and Fargate. It runs minimal Linux guests on KVM with fast boot times and a small memory footprint, exposed through a JSON API over a Unix socket. It is a strong choice for platform teams on Linux who want to build their own per-task isolation layer and already have (or plan to build) the surrounding control plane: image provisioning, network policy, scheduling, and observability.

3. Cloud Hypervisor

Cloud Hypervisor is a Rust-based VMM hosted under the Rust VMM project, focused on modern Linux guests on KVM with a lean device model and a small trusted computing base. It boots lightweight guests quickly and suits infrastructure engineers who want a minimal, hackable hypervisor backend and are comfortable wiring up their own lifecycle management, networking, and packaging.

4. gVisor

gVisor is Google's application kernel for container sandboxes. Instead of a full guest VM, it intercepts system calls and implements a Linux-compatible kernel in userspace (runsc), optionally paired with a KVM platform for hardware acceleration. It integrates directly with Docker and Kubernetes, which makes it attractive if your workloads already live in containers and you want a stronger boundary with minimal workflow change. The model differs from a microVM: isolation comes from a userspace kernel rather than a separate guest OS.

Comparison Table

Option	Isolation boundary	Startup profile	Best fit
Smol Machines	Hardware-virtualized microVM, own guest kernel, per-host hypervisor backends	Sub-second cold start; <200 ms pre-baked	Agent sandboxes, untrusted code, local-to-cloud workloads
Firecracker	MicroVM on KVM	Fast boot, minimal guest	Platform teams building custom isolation on Linux
Cloud Hypervisor	MicroVM on KVM, Rust VMM	Fast boot, lean device model	Infrastructure engineers wanting a minimal VMM component
gVisor	Userspace application kernel (optional KVM platform)	Container-like start	Container/Kubernetes-centric teams

How They Compare

All four options move untrusted code off the host kernel, the core requirement. They separate on workflow.

Firecracker and Cloud Hypervisor are hypervisor backends: excellent engines, but you own image handling, network policy, scheduling, and cleanup. That is the right call for large platform teams, and the wrong amount of work for a product team that just needs agent code to run safely.

gVisor keeps your container workflow intact but changes the isolation mechanism to a userspace kernel, which is a different (and container-shaped) trust model.

Smol Machines is the only option here that ships the complete pattern out of the box: a guest-kernel microVM per workload, default-off networking with allowlisted egress, OCI image support, sub-200 ms pre-baked boots, fork for parallel agent runs, and the same VM model locally and in smol cloud. For teams that want hypervisor isolation with microVM startup without rebuilding the platform, it is the direct answer. The documentation covers the CLI, Smolfile configuration, and artifact packaging in detail.

Frequently Asked Questions

Do microVMs really start fast enough for per-task sandboxing? Yes, when the runtime is designed for it. Smol Machines boots pre-baked .smolmachine artifacts in under 200 ms on any supported host architecture, with sub-second cold starts generally. That is fast enough to give every agent task or CI step its own isolated machine.

Is a microVM enough to make untrusted code safe? It is the right primary boundary, not a complete answer. A microVM gives the workload its own guest kernel behind a hypervisor, but capabilities you explicitly grant (writable host mounts, unrestricted egress, powerful credentials) still bypass it. Pair it with default-deny networking, scoped mounts, and credential discipline.

Can we keep using our existing container images? With Smol Machines, yes. Images use the OCI format, the same standard Docker uses, and can be pulled from Docker Hub, GHCR, or other OCI registries and booted directly as microVMs. Containers can also run inside a guest when needed.

Does this work on developer laptops or only servers? Both. smolvm runs locally on macOS, Linux, and Windows, and smol cloud runs the same VM model as a managed service. A .smolmachine artifact moves a workload between them without reconfiguration.

Conclusion

Hypervisor-level isolation and microVM-class startup are no longer competing goals. Firecracker and Cloud Hypervisor prove the engines work; gVisor covers the container-first path. But if you want the whole pattern (guest-kernel isolation, default-off networking, sub-200 ms boots, forkable warm environments, and one VM model from laptop to cloud) without assembling it yourself, Smol Machines is built for exactly this problem. Start with the open-source smolvm engine, read the docs, and run your first isolated workload today.