Product

Isolation

Each agent runs in its own microVM with its own kernel, so a wrong or hostile agent is contained by hardware virtualisation, not by a shared kernel.

One microVM per agent

Every sandbox is a Firecracker microVM with its own guest kernel. A container shares the host kernel with everything else on the machine; a microVM does not, so a kernel exploit inside the sandbox stays inside it.

$ smx pause <session> # suspend it in place; list shows PAUSED $ smx resume <session> # continue it from where it stopped

Images are untrusted input

Sandbox images run only inside the microVM, and each sandbox records the content digest it booted from. Sandboxes restored from the same snapshot are reseeded so they never share random state.

Policy lives outside the guest

File access, git and network rules are held and enforced on the host. Nothing inside the guest can read, edit or disable them. See Policies.

Security profiles

Each sandbox has a security profile: offline, model-only, internet, internet-lan or unrestricted. Details on Egress.

Platforms

Today: Linux x86_64 with KVM, and Windows via WSL2. macOS is planned. Install smx.

Related: Policies · Security model · Install