🔶 Show HN：Tarit — 面向 AI Agent 的自托管沙箱云与 Hypervisor

面向 AI 代理与强化学习环境的最快虚拟机管理器与沙箱云。

Tarit 是一个微虚拟机平台，为安全、快速、即用即毁的沙箱而设计，专为 AI 代理工作负载构建。它能在几毫秒内启动一个真正的硬件虚拟化 VM，在内部运行任务，然后拆除，为每个沙箱提供内核级隔离，而非共享内核的容器边界。

它由两个部分组成，在这个 monorepo 中共同开发：

• vmm/ - Tarit VMM，一个基于 rust-vmm 的极简 microVM 监视器（虚拟机管理器层）。一个进程运行一个 microVM。可独立使用，也可在任何编排器下运行。
• orch/ - taritd，一个多节点编排器和 PaaS 控制平面，负责在整个集群中启动和管理 microVM，提供调度、热池、网络、快照、SSH/PTY 访问、每密钥用量统计以及审计追踪。

它们通过 Unix 域套接字协议进行通信，其类型定义在一个共享的、依赖极少的 crate 中，即 proto/（tarit-proto）。该 crate 是线路契约，因此你可以通过 taritd 或你自己的控制平面来驱动 VMM，而无须手动复制类型。

• 真正的隔离。 每个沙箱都是一个带有自己内核的 KVM 客户机，而不是命名空间进程。受损或失控的工作负载无法看到主机或其邻居。
• 快速且廉价。 极简设备模型（仅 MMIO virtio，无 PCI，无 BIOS），按需分页客户机 RAM，以及快照/恢复实现亚秒级启动。
• 默认即用即毁。 创建、运行、丢弃。快照和写时复制叠加层使大量相同沙箱的启动成本极低。
• 为代理构建。 基于 vsock 的执行和交互式 PTY，每密钥用量计量与审计，以及针对突发创建/执行/销毁优化的编排器。

以下是在裸机环境下验证的 Tarit 性能数据；Firecracker 的数据来自其已发布文档。

taritd 及任何第三方编排器都通过同一 tarit-proto 协议与 vmm serve 通信：每个 VM 的 Unix 套接字上发送一个长度前缀的 JSON 请求和一个响应。如需自带编排器，请参阅 vmm/docs/INTEGRATION.md。

        HTTP API + CLI + SSH gateway
                    |
               taritd (orch)          one multi-node control plane
               /      |     \          placement, warm pool, fleet
              /       |      \         usage + audit -> PostgreSQL
    vmm serve   vmm serve   vmm serve  one process per microVM
       |            |           |
    microVM      microVM     microVM   KVM guest, own kernel

快速起步是分层的。第 1 层让你的代码在 microVM 中运行。第 2 层增加快照、挂起和恢复。第 3 层用编排器运行托管集群。只取你需要的层。

你需要一台具备 KVM（/dev/kvm）的 Linux 主机和 Rust 工具链。运行 microVM 需要 root 权限（或 kvm 组成员），因此命令使用 sudo。

第 1 层：在 microVM 中运行代码

git clone https://github.com/instavm/tarit && cd tarit sudo make install # build + install vmm, taritd, and the guest agent sudo make guest # one-time: build a guest kernel + pull an Ubuntu rootfs

make guest 一次性完成耗时工作（内核构建 + OCI 拉取），生成 guest-assets/vmlinux 和 guest-assets/rootfs.ext4，因此此后启动 VM 是即时的。启动一个 VM，在其中运行命令，然后拆除：

sudo vmm serve --socket /tmp/vm.sock & sudo vmm --socket /tmp/vm.sock create --kernel guest-assets/vmlinux --rootfs guest-assets/rootfs.ext4 sleep 12 # let the guest boot and dial the agent sudo vmm --socket /tmp/vm.sock exec "uname -a" sudo vmm --socket /tmp/vm.sock stop

只想使用虚拟机管理器？sudo make install-vmm 仅安装 vmm。

第 2 层：快照、挂起、恢复

驱动同一个套接字来捕获和迁移 VM 状态。完整快照写入内存和设备状态；--diff 仅写入脏页。挂起释放客户机常驻 RAM；恢复则将其取回。Restore 命令从快照启动一个新的 VMM 进程。

sudo vmm --socket /tmp/vm.sock snapshot # full snapshot, prints the .snap path sudo vmm --socket /tmp/vm.sock snapshot --diff # incremental (dirty pages only) sudo vmm --socket /tmp/vm.sock suspend # release resident guest RAM sudo vmm --socket /tmp/vm.sock resume sudo vmm restore --snapshot /path/to.snap # restore into a new VMM process

Tarit 还支持实时快照：对运行中的客户机做内存一致性快照，无需停机，因此忙碌的 VM 可以被检查点或派生。完整设备、出站、隔离及 PTY 接口详见 vmm/docs/STANDALONE.md。

第 3 层：使用编排器运行集群

taritd 通过 HTTP API 管理一个或多个节点上的众多 microVM，提供调度、热池、每密钥用量统计和 SSH/PTY 网关。单节点：

cd orch TARIT_API_KEY=$(openssl rand -hex 24)
TARIT_VMM_BIN=$(command -v vmm)
TARIT_KERNEL=$PWD/../guest-assets/vmlinux TARIT_ROOTFS=$PWD/../guest-assets/rootfs.ext4
taritd serve

然后通过 HTTP 创建并驱动 VM，并扩展到多节点集群：

vmm/ the Tarit VMM (microVM monitor) - its own cargo workspace orch/ taritd, the orchestrator and PaaS control plane - its own cargo workspace proto/ tarit-proto, the shared UDS wire protocol crate (KVM-free)

vmm/ 和 orch/ 是独立的 cargo 工作区，因此 VMM 可以单独构建、测试和使用。两者都依赖 proto/ 获取线路类型。

• 宿主机：x86_64 Linux 且支持 KVM。开发也可在 macOS 上进行构建和交叉检查；运行 microVM 需要 KVM。
• 尚未实现：aarch64 客户机、virtio-balloon。

已在 AWS 和 GCP 上测试自托管，Azure 支持即将推出。

Tarit 使用 AGPL-3.0-or-later 许可。详见 LICENSE。

The fastest hypervisor and sandbox cloud for AI agents and RL environments.

Tarit is a microVM platform for secure, fast, ephemeral sandboxes, built for AI agent workloads. It boots a real hardware-virtualized VM in milliseconds, runs a task inside it, and tears it down, giving each sandbox kernel-level isolation instead of a shared-kernel container boundary.

It has two parts, developed together in this monorepo:

• vmm/ - the Tarit VMM, a minimal rust-vmm based microVM monitor (the hypervisor layer). One process runs one microVM. Usable on its own or under any orchestrator.
• orch/ - taritd, a multi-node orchestrator and PaaS control plane that launches and manages microVMs across a fleet, with placement, warm pools, networking, snapshots, SSH/PTY access, per-key usage stats, and an audit trail.

They talk over a Unix-domain-socket protocol whose types live in one shared, dependency-light crate, proto/ (tarit-proto). That crate is the wire contract, so you can drive the VMM from taritd or from your own control plane without hand-copying types.

• Real isolation. Each sandbox is a KVM guest with its own kernel, not a namespaced process. A compromised or runaway workload cannot see the host or its neighbors.
• Fast and cheap. Minimal device model (MMIO virtio only, no PCI, no BIOS), demand-paged guest RAM, and snapshot/restore for sub-second starts.
• Ephemeral by design. Create, run, discard. Snapshots and copy-on-write overlays make many identical sandboxes cheap to spin up.
• Built for agents. vsock-based exec and interactive PTY, per-key usage metering and audit, and an orchestrator tuned for bursty create/exec/destroy.

Tarit column from bare-metal validation; Firecracker column from its published docs.

| Tarit, bare metal (p50) | Firecracker
---|---|---
Ready to exec from snapshot | 83 ms (node -v result) | no published number
Snapshot restore to running VM | 2.9 ms | no published number
Warm-pool VM handout | 12.3 ms | n/a
Exec round trip in a running VM | 0.6 ms | n/a, no exec agent
Full snapshot, 256 MiB | 60 ms, guest keeps running | pause required
Live snapshot of a running guest | yes | no
Suspend that releases guest RAM | yes | no
PTY over the API | yes | serial console only
OCI image boot | built in | no
Egress filtering | per-VM allowlist + rate limits | rate limits only

            HTTP API + CLI + SSH gateway
                        |
                   taritd (orch)          one multi-node control plane
                   /      |     \          placement, warm pool, fleet
                  /       |      \         usage + audit -> PostgreSQL
        vmm serve   vmm serve   vmm serve  one process per microVM
           |            |           |
        microVM      microVM     microVM   KVM guest, own kernel

taritd and any third-party orchestrator speak the same tarit-proto protocol to vmm serve: one length-prefixed JSON request, one response, over a per-VM Unix socket. See vmm/docs/INTEGRATION.md for bring-your-own-orchestrator.

The quickstart is layered. Layer 1 gets your code running in a microVM. Layer 2 adds snapshots, suspend, and restore. Layer 3 runs a managed fleet with the orchestrator. Take only the layer you need.

You need a Linux host with KVM (/dev/kvm) and a Rust toolchain. Running microVMs needs root (or membership in the kvm group), so the commands use sudo.

Layer 1: run code in a microVM

git clone https://github.com/instavm/tarit && cd tarit
sudo make install      # build + install vmm, taritd, and the guest agent
sudo make guest        # one-time: build a guest kernel + pull an Ubuntu rootfs

make guest does the slow work once (kernel build + OCI pull) and writes guest-assets/vmlinux and guest-assets/rootfs.ext4, so starting a VM afterwards is instant. Boot one, run a command in it, tear it down:

sudo vmm serve --socket /tmp/vm.sock &
sudo vmm --socket /tmp/vm.sock create --kernel guest-assets/vmlinux --rootfs guest-assets/rootfs.ext4
sleep 12                                             # let the guest boot and dial the agent
sudo vmm --socket /tmp/vm.sock exec "uname -a"
sudo vmm --socket /tmp/vm.sock stop

Only want the hypervisor? sudo make install-vmm installs just vmm.

Layer 2: snapshot, suspend, restore

Drive the same socket to capture and move VM state. A full snapshot writes memory plus device state; --diff writes only dirty pages. Suspend releases resident guest RAM; resume brings it back. Restore boots a fresh VMM from a snapshot.

sudo vmm --socket /tmp/vm.sock snapshot              # full snapshot, prints the .snap path
sudo vmm --socket /tmp/vm.sock snapshot --diff       # incremental (dirty pages only)
sudo vmm --socket /tmp/vm.sock suspend               # release resident guest RAM
sudo vmm --socket /tmp/vm.sock resume
sudo vmm restore --snapshot /path/to.snap            # restore into a new VMM process

Tarit also does live snapshots : a memory-consistent snapshot of a running guest with no downtime, so a busy VM can be checkpointed or forked. See vmm/docs/STANDALONE.md for the full device, egress, jailer, and PTY surface.

Layer 3: run a fleet with the orchestrator

taritd manages many microVMs across one or more nodes over an HTTP API, with placement, warm pools, per-key usage accounting, and an SSH/PTY gateway. Single node:

cd orch
TARIT_API_KEY=$(openssl rand -hex 24) \
TARIT_VMM_BIN=$(command -v vmm) \
TARIT_KERNEL=$PWD/../guest-assets/vmlinux TARIT_ROOTFS=$PWD/../guest-assets/rootfs.ext4 \
  taritd serve

Then create and drive VMs over HTTP, and scale to a multi-node cluster:

vmm/     the Tarit VMM (microVM monitor) - its own cargo workspace
orch/    taritd, the orchestrator and PaaS control plane - its own cargo workspace
proto/   tarit-proto, the shared UDS wire protocol crate (KVM-free)

vmm/ and orch/ are independent cargo workspaces so the VMM can be built, tested, and consumed on its own. Both depend on proto/ for the wire types.

• Host: x86_64 Linux with KVM. Development also works on macOS for building and cross-checking; running microVMs needs KVM.
• Not yet implemented: aarch64 guests, virtio-balloon.

Self-hosting has been tested on AWS and GCP. Azure support is coming soon.

Tarit is licensed under AGPL-3.0-or-later. See LICENSE.