back to microsandbox

compare

microsandboxvsfirecracker

pick firecracker to build and operate a microvm platform. [1] pick microsandbox for a sandbox runtime with local snapshots, employee-device policy, and a hosted cloud option. [20][21][22]

firecracker and microsandbox both put workloads in microvms with their own guest kernels. firecracker is the virtual machine monitor used for aws lambda and fargate workloads, with a linux and kvm operating model. [1] it gives an infrastructure team direct control over a deliberately narrow device and api surface.

microsandbox starts one level higher. it uses an embeddable vmm through libkrun, then supplies oci image handling, sandbox lifecycle, language sdks, destination-bound credentials, and network policy as one runtime.

microsandbox cloud runs sandboxes on hosted infrastructure through the same CLI and SDKs; access is by request during private beta. local installations can run on employee devices with settings deployed through Jamf or Intune. [20][22]

microsandbox
local + cloud
firecracker
open-source microvm monitor [1]
what it is
complete agent sandbox runtime
virtual machine monitor [1]
maintainer
super rad company
amazon web services [1]
host platform
macOS · Linux · Windows (WHP, preview)
linux with kvm [1]
underlying vmm
libkrun · embeddable and cross-platform
firecracker itself [1]
programming model
embed an sdk · sandbox per call
vmm api · build the surrounding runtime [1]
oci image support
native · pull from a standard registry
supply a guest kernel and root filesystem [1]
sdks
rust · typescript · python · go · ruby · cli
vmm api rather than an agent sandbox sdk [1]
credentials
credentials are destination-bound. the sandbox works with a placeholder; the real value is substituted host-side into supported intercepted outbound requests, only for destinations on your allow-list. an approved destination still receives the real credential and could reflect or misuse it, so scope your allow-lists accordingly.
not supplied by the vmm [1]
network policy
by default, sandboxes can reach the public internet. private, host-local, link-local, and metadata destinations are blocked. egress can be reduced to an allowlist or disabled entirely. in the cloud, the non-public block cannot be lifted, even by you.
tap interfaces; the platform supplies policy [1]
snapshots
local snapshots save disk state, or disk, memory, and running processes with --full. cloud currently supports disk snapshots from stopped persistent sandboxes and disk restore. [21]
VM state and memory snapshots; disk files must be managed separately [4]
hosting and rollout
local runtime · hosted cloud · managed settings on employee devices [20][22]
you supply host provisioning and fleet management [1]
operational control
runtime conventions are already chosen
direct control of kernel, rootfs, devices, api, and lifecycle [1]
license
apache 2.0
apache 2.0 [1]
pick firecracker

choose firecracker when

  • you are building a linux microvm platform and want direct vmm control. [1]
  • you intend to own kernels, root filesystems, networking, lifecycle, and fleet operations. [1]
  • a narrow, infrastructure-level api is the interface you want. [1]
pick microsandbox

choose microsandbox when

  • your application needs a sandbox sdk instead of a vmm api.
  • you want oci images, local disk and full snapshots, credentials, and network policy in one runtime.
  • the runtime must also work on macos or windows preview.
  • you want hosted cloud execution or a managed rollout to employee devices. [20][22]

01

libkrun vs firecracker

firecracker exposes a VMM API on linux/kvm. libkrun exposes a C library that applications can embed. [1][3] microsandbox uses libkrun underneath its SDKs and CLI, then adds OCI image handling, commands, files, network policy, and secrets. [25]

choose at the level you need to own. a platform team can build around firecracker's kernel, disk, and network primitives. an application can use microsandbox to create and control sandboxes, either locally or through its hosted cloud backend. [1][20]

create your first sandbox

02

from VM snapshots to reusable agent state

firecracker snapshots preserve VM state and memory; the platform must retain and restore the associated disk files. [4] microsandbox exposes disk snapshots, full execution checkpoints, and local branching through its CLI and SDKs. [21]

a local full snapshot resumes processes in a new sandbox. compatible runtime, CPU, and memory settings are required, and host-side connections must reconnect. microsandbox cloud currently supports disk capture from stopped persistent sandboxes, not full checkpoints. [21]

snapshot guide

03

deploying to employee devices

microsandbox's managed configuration lets IT distribute administrator settings through Jamf or Intune. supported CLI and SDK releases apply the protected file above user settings for newly constructed backends. local administrators can remove policy or replace the runtime. [22]

provision runtime dependencies and approved images in advance for offline use. [23] firecracker supplies the virtualization layer; equivalent packaging and configuration rollout belong to the platform built around it. [1]

managed deploymentoffline provisioning

common questions

does microsandbox use firecracker?

no. microsandbox uses libkrun as its embeddable vmm. both approaches create microvms with their own guest kernels.

is microsandbox a firecracker alternative?

not at the same layer. firecracker is a vmm for teams building infrastructure. [1] microsandbox is a complete sandbox runtime for applications that need to execute untrusted code.

is firecracker open source?

yes. firecracker is published under apache 2.0. [1] microsandbox is also apache 2.0.

can firecracker run oci images directly?

firecracker expects a guest kernel and root filesystem. [1] the image conversion and lifecycle around them belong to the platform you build. microsandbox accepts oci images as a runtime input.

which one runs on a developer mac?

microsandbox runs on macos. firecracker documents linux hosts with kvm. [1]

primary sources

  1. [1] firecracker repository and documentation: scope, platform requirements, api, snapshots, license, and aws usage · last verified 2026-09-24
  2. [3] libkrun embeddable VMM library and C API · last verified 2026-09-24
  3. [4] firecracker snapshot state, memory, and disk requirements · last verified 2026-09-24
  4. [20] microsandbox cloud availability and backend compatibility · last verified 2026-09-24
  5. [21] microsandbox disk snapshots, full checkpoints, and local branching · last verified 2026-09-24
  6. [22] microsandbox managed deployment with Jamf and Intune · last verified 2026-09-24
  7. [23] microsandbox offline provisioning of runtime dependencies and images · last verified 2026-09-24
  8. [24] microsandbox microVM isolation · last verified 2026-09-24
  9. [25] microsandbox runtime, CLI, images, and language SDKs · last verified 2026-09-24

run it locally.

put the boundary on your own machine before you choose anything else.

run it locally