Run untrusted code and data in isolated VMs. In just milliseconds.

Hotcell runs code inside tiny virtual machines. Each execution gets its own kernel, its own memory, its own process tree. The code runs on separate virtual hardware and cannot access the host.

View on GitHub Read Docs

terminal — hotcell cli

$ time hotcell run alpine -- sh -c '
    echo "Hello from a microVM"
    echo "{\"ok\": true}" > /hotcell/result.json
'
Hello from a microVM

real    0m0.329s

$ cat result.json
{"ok": true}

EXIT: 0

security

Untrusted code meets its own kernel.

Every execution runs in its own VM with a dedicated kernel, memory, and process tree. If someone breaks out of the VM, they land in a jailed process with no capabilities and a syscall filter that kills on violation.

22 hardening layers across two isolation boundaries. Kernel sandboxing, filesystem access control, resource limits, network egress filtering, and capability dropping. Full security model →

Libkrun

Firecracker

Cloud Hypervisor

Hypervisor.framework

KVM

inventory_2

OCI Image Support

No special image format. Pull any Docker/OCI image, run it in a VM.

stream

Real-Time Streaming

Stream console output in real-time via SSE or WebSocket. Output streams as the VM runs.

swap_horiz

Pluggable Backends

Choose your VMM per-request. libkrun for development and macOS. Firecracker for production Linux with stronger isolation. Cloud Hypervisor as an alternative Linux backend. Same API, same results, regardless of backend.

devices

Dual-Platform

macOS (Apple Silicon via Hypervisor.framework) and Linux (x86_64/aarch64 via KVM). Native hypervisors for zero-overhead performance.

~300ms Boot → Result

4 VMM Backends

277+ Tests

37 Adversarial Tests

Who it's for

Anywhere untrusted code and data meets your infrastructure.

smart_toy

AI & agent developers

Let your agent run code without risking your infrastructure. Ephemeral VMs execute code and return structured JSON results. Persistent VMs run long-lived services with automatic port forwarding. Network access is off by default.

Ephemeral + persistent / structured I/O / network-isolated by default

code_blocks

Platform builders

Add sandboxed execution to your product. Run one-off commands or long-lived services inside VMs. One Rust dependency, no Docker daemon, no sidecar. Pull any OCI image and run it with a single function call.

FaaS / code evaluation / CI runners / sandboxed services

shield_locked

Security teams

Open-source, auditable isolation. Every syscall in the allowlist is documented. Every hardening layer is in the code, not behind a vendor's wall. Stronger than containers, simpler than managing your own Firecracker fleet.

MIT licensed / 22 hardening layers / seccomp in Kill mode

Stronger isolation than gVisor. Simpler than Kata Containers. Open-source alternative to E2B, Modal, and SlicerVM. Works with your existing Docker images.

Ready to try Hotcell?

Open-source, MIT-licensed. Use the CLI, embed the Rust library, or run the HTTP server. Works on macOS and Linux with any Docker image.

View on GitHub Read Docs