Ordinary Linux programs, each in its own micro‑VM.

hyperlight-unikraft runs Python, Node.js, .NET, Go, Rust and more on a Unikraft kernel inside Hyperlight. The guest reaches nothing on the host unless you allow it, and a warmed guest comes back from a snapshot in milliseconds.

curl -fsSL https://raw.githubusercontent.com/hyperlight-dev/hyperlight-unikraft/main/install.sh | sh

irm https://raw.githubusercontent.com/hyperlight-dev/hyperlight-unikraft/main/install.ps1 | iex

cargo install hyperlight-unikraft

Then hluk init hello --template python, cd hello, hluk run. The CLI is hluk, pronounced "hulk".

hluk init, then two runs of a Python project

Recorded with hluk 0.17.0 on Linux/KVM. The first run boots the guest and saves a snapshot of it; the second restores the snapshot.

Boot once. Restore in milliseconds.

Booting a guest and starting CPython takes a couple of hundred milliseconds. Restoring a snapshot of the booted guest takes under ten, and a guest already in memory resets in about one. The bars play ten times slower than real time.

Loading the latest results from CI…

A thousand Python sandboxes in under 3 GiB

Guests restored from one snapshot share it, so each sandbox adds only the memory it changes. One hluk process ran 1,000 Python micro-VMs at once, each running a script in a loop, and peaked at 2.7 GiB of private memory: about 2.8 MiB per sandbox.

1,000: Python micro-VMs running at once, in one process
2.8 MiB: private host memory per sandbox, 2.7 GiB for all of them at the peak
74 MiB: the one snapshot all of them start from

Measured with hluk bench parallel --vms 1000 (hluk 0.17.0) on Linux/KVM, an 8-vCPU Xeon Platinum 8370C. Peak RssAnon of the process; site/tools/density.sh repeats it.

One command for every runtime

hluk init starts a project from a template and pulls the runtime's image. Interpreted languages run as scripts; compiled ones are built on the host by hluk build and mounted into the guest.

Six projects, each restoring its warm snapshot

Add packages with a Dockerfile

Every runtime image is published as a base to build FROM. Install packages in a normal Linux stage, copy them onto the rootfs, and hluk build exports the result as the guest's filesystem. The http-python, http-node and http-dotnet templates follow this pattern.

Build a Flask image and serve from the guest

The guest gets what the manifest grants

A guest starts with no host files, no network and no listening ports. Each capability is a line in hluk.toml or a flag to hluk run.

# hluk.toml
[run]
script = "main.py"
mounts = ["./data:/mnt/data:ro"]

[run.net]
allow = ["pypi.org", "files.pythonhosted.org"]
ports = [8080]

Files: mounts preopens a host directory, read-only with :ro. Nothing else on the host filesystem is visible. fs.md
Network: No [run.net] table means no sockets. allow or block lists name hosts or addresses. net.md
Listening: ports lists what the guest may listen on. A guest socket is a host socket at the address the guest binds, so 0.0.0.0 listens on every host interface.
Isolation: Each sandbox is a hardware-virtualized VM with its own kernel. A compromised interpreter is still inside the VM.

Embed it as a Rust library

hluk is one consumer of the hyperlight-unikraft crate. Your service can boot a guest, load code once, call it with JSON as often as you like, and give it host functions you choose. The quickjs, node, python, dotnet-jit and wasmtime images take these calls.

use hyperlight_unikraft::SandboxBuilder;
use serde_json::json;

let mut sandbox = SandboxBuilder::from_initrd("quickjs-rootfs.cpio")
    .host_function("db.lookup", |args| {
        let [id]: [u32; 1] =
            serde_json::from_str(args).map_err(|e| e.to_string())?;
        Ok(json!({ "id": id, "name": "Ada" }).to_string())
    })
    .boot()?;

// Load the code once...
sandbox.run(r#"
    import { lookup } from "host:db";
    globalThis.greet = (e) => ({ message: `Hello, ${lookup(e.id).name}` });
"#)?;

// ...then call it as often as you like.
let out = sandbox.call("greet", r#"{"id": 7}"#)?;
assert_eq!(out, r#"{"message":"Hello, Ada"}"#);

A guest function call from the CLI

Runs where Hyperlight runs

Host	Hypervisor	Guests
Linux	KVM, or MSHV with `--features mshv`	x86_64, arm64
Windows	Windows Hypervisor Platform	x86_64, arm64
macOS on Apple silicon	Hypervisor.framework	arm64