Hyperlight hyperlight-unikraft runs unmodified Linux binaries in micro-VMs with snapshot restore

The Cloud Native Computing Foundation's Sandbox project Hyperlight has expanded beyond WebAssembly and JavaScript guests to run unmodified Linux applications through a new component called hyperlight-unikraft. This library-based VMM embeds into applications via Rust, Python, or .NET SDKs and creates micro-VMs isolated by the host CPU's virtualization extensions—KVM or MSHV on Linux, WHP on Windows, and Hypervisor.framework on macOS—without emulated devices or a full operating system boot. The hyperlight-unikraft CLI (hluk) packages Linux binaries with a Unikraft unikernel kernel, supporting runtimes including Python, Node.js, .NET JIT and Native AOT, Java, PHP, Go, Rust, C, Bash, and PowerShell on x86_64 and arm64.

A key operational innovation is snapshot-based restore: hyperlight-unikraft performs runtime initialization once, snapshots the micro-VM, and restores it in milliseconds for subsequent runs. Benchmarks on an 8-vCPU Azure VM with nested KVM show a Python script importing numpy, pandas, and scikit-learn starting in 45 ms versus 1,119 ms natively, and C# source compilation via Roslyn starting in 95 ms versus 1,549 ms. The capability-based security model exposes only host functions explicitly allow-listed by the embedder, and the hypervisor boundary has been demonstrated to contain sandbox escapes such as the CVE-2023-26489 Wasmtime vulnerability.

Architecture and runtime mechanics

• Library VMM embedding: Hyperlight links directly into the host application as a Rust library with Python and .NET SDKs, avoiding separate processes like QEMU or Firecracker and reducing attack surface by eliminating emulated devices.
• Unikraft unikernel guest: hyperlight-unikraft uses the Linux Foundation's Unikraft project to provide a single-address-space kernel containing only components the target application requires, with no SDK, special libc, or recompilation needed for guest binaries.
• Snapshot/restore for runtime warm-up: hluk snapshots micro-VMs after runtime initialization and optional warm_exec preloading, restoring them in milliseconds; eight Python guests sharing one snapshot served approximately 850 calls per second with individual restores in a few milliseconds.
• Capability-based host exposure: Guest-to-host interaction is restricted to an explicit allow-list defined by the embedder, with no default permissions requiring lockdown after deployment.
• Nested sandboxing support: Because guests run ordinary Linux binaries, they can host additional sandboxes such as Wasmtime, with the hypervisor containing failures that would escape process-level isolation.

Why it matters

For cloud-native operators and platform engineers, hyperlight-unikraft offers a path to isolate third-party, AI-generated, or customer-uploaded code without the startup latency that has traditionally made VMs impractical for short-lived or high-density workloads. The integration with Kubernetes container runtimes and support for extending base rootfs images via standard Dockerfiles positions it as a drop-in security layer for existing CI/CD and serverless pipelines. As supply-chain attacks against language runtimes and package ecosystems increase, the ability to turn sandbox escapes into contained guest crashes via hardware virtualization provides a defense-in-depth mechanism that complements rather than replaces process-level isolation.