zerobootdev/zeroboot

For anyone landing here because they need sandboxing on Azure (or other environments where `/dev/kvm` isn't available or nested virt is unreliable):

[sandlock](https://github.com/multikernel/sandlock) takes a non-VM approach to sandboxing — it uses Linux Landlock LSM + seccomp user notification instead of Firecracker/KVM. That means:

- Runs on any Linux 5.13+ kernel, no `/dev/kvm` required
- Works on Azure, ARM, burstable instances, and inside containers
- ~7ms startup overhead

It won't give you the same hardware-level isolation boundary as a microVM, but if your goal is sandboxing untrusted code or AI agent workloads, it covers network isolation, syscall filtering, resource limits (memory/CPU/processes), and filesystem COW out of the box.

Interesting thread. We've been working on a similar problem space with [sandlock](https://github.com/multikernel/sandlock), which takes a different approach (Landlock + seccomp instead of VMs). A few things that might be relevant to what you're describing:

- **Copy-on-write filesystem** with configurable exit behavior (`COMMIT` to persist changes, `ABORT` to discard) , so workspace state survives across runs without snapshotting a full VM
- **Checkpoint/restore** — captures full process state (registers, memory maps, FDs) and resumes from it
- **Pause/resume** API for session-like workflows
- Writable directories via `fs_writable` for persistent workspace mounts

Different tradeoff than VM snapshots (weaker isolation boundary, but no KVM dependency and ~7ms startup), which may or may not fit your use case.

Yes, please!

Mounting Host dirs into the vm is possible.
Some inspiration could be taken from bake: https://github.com/losfair/bake/blob/main/src/fileshare.rs

If this feature is on the roadmap and collaboration would be welcome, I’d be very interested in supporting it if circumstances permit. I’d be happy to help with use cases, design discussion, testing, or other practical contributions if that would be helpful.