compare · reviewed 2026-10-27
microsandbox vs semantic
microsandbox is an Apache-2.0 SDK that starts hardware-isolated libkrun microVMs as child processes, with no server or daemon. [1] It runs on Linux, macOS on Apple Silicon and Windows. [1]
Its secrets never enter the VM and are tied to the hosts they may be sent to; egress is a per-sandbox allowlist. [1] Semantic adds per-path, per-repo and per-host permissions enforced outside the agent and a tamper-evident log.
| microsandboxopen source · embedded SDK | Semantic (smx)microVM + policy on your machines | |
|---|---|---|
| Isolation | libkrun microVMs [1] | One microVM per agent, own kernel |
| Where it runs | Self-hosted, embedded in your process [1] | Managed private beta; on-prem for enterprise (contact us) |
| Egress rules | Per-sandbox host and port allowlist [1] | Security profiles enforced by host firewall; metadata and link-local always closed |
| Credentials kept out | Secrets never enter the VM, bound to hosts [1] | Git tokens, SSH keys and model sign-ins stay on the host |
| File, Git, SSH permissions | not documented (volumes only) | Per path, repo, branch and SSH host; deny beats allow; enforced on the host |
| Tamper-evident agent log | not documented (metrics and inspect) | Hash-chained log of runs, events and refusals; read with smx agent logs |
| Snapshots, pause/resume | Fork live sandboxes, save and restore running ones [1] | Snapshot, pause and resume with memory, disk and running processes |
| Local hosts (Linux / WSL2 / macOS) | Linux (KVM), macOS (Apple Silicon), Windows; WSL2 — [1] | Linux (KVM) and Windows via WSL2; macOS planned |
| License | Apache-2.0 [1] | Proprietary (private beta) |
microsandbox, per its docsSemanticnot documented in the vendor's public docs
Which one fits
When microsandbox fits better
- You want to embed sandboxes as a library, with no daemon. [1]
- Your developers are on macOS today. [1]
When Semantic fits better
- Agents work on your repos and you need branch-level Git and per-path file permissions enforced outside the agent.
- You need a tamper-evident log of what the agent did inside the sandbox, including refusals.
- You need SSH work on remote machines with short-lived certificates bound to one sandbox and one policy.
Library vs gateway
microsandbox lives inside your application. [1] Semantic puts a permission gateway on the host between the agent and your files, repos and SSH hosts, so the policy holds whatever the agent runs.
Questions
Is microsandbox open source?
Yes, Apache-2.0. [1]
Does microsandbox run on macOS?
Yes, on Apple Silicon. [1] Semantic's macOS support is planned.
Sources
- microsandbox repository · last verified 2026-10-27