# Hyperlight hyperlight-unikraft runs unmodified Linux binaries in micro-VMs with snapshot restore

> **Key takeaway:** Hyperlight's new hyperlight-unikraft component uses Unikraft unikernels to run unmodified Linux binaries inside hypervisor-isolated micro-VMs, with snapshot restore enabling sub-100ms startup for heavy runtimes like Python with numpy/pandas.

**Published:** 2026-11-09T12:00:00+00:00 
**Source:** Cloud Native Computing Foundation (CNCF) 
**Category:** cloud-native 
**Canonical URL:** https://fosswire.org/news/hyperlight-hyperlight-unikraft-runs-unmodified-linux-binarie.html 

## Summary
The Cloud Native Computing Foundation's Sandbox project Hyperlight has expanded beyond WebAssembly and JavaScript guests to run unmodified Linux applications through a new component called hyperlight-unikraft. This library-based VMM embeds into applications via Rust, Python, or .NET SDKs and creates micro-VMs isolated by the host CPU's virtualization extensions—KVM or MSHV on Linux, WHP on Windows, and Hypervisor.framework on macOS—without emulated devices or a full operating system boot. The hyperlight-unikraft CLI (hluk) packages Linux binaries with a Unikraft unikernel kernel, supporting runtimes including Python, Node.js, .NET JIT and Native AOT, Java, PHP, Go, Rust, C, Bash, and PowerShell on x86_64 and arm64.

A key operational innovation is snapshot-based restore: hyperlight-unikraft performs runtime initialization once, snapshots the micro-VM, and restores it in milliseconds for subsequent runs. Benchmarks on an 8-vCPU Azure VM with nested KVM show a Python script importing numpy, pandas, and scikit-learn starting in 45 ms versus 1,119 ms natively, and C# source compilation via Roslyn starting in 95 ms versus 1,549 ms. The capability-based security model exposes only host functions explicitly allow-listed by the embedder, and the hypervisor boundary has been demonstrated to contain sandbox escapes such as the CVE-2023-26489 Wasmtime vulnerability.

## Architecture and runtime mechanics
- **Library VMM embedding:** Hyperlight links directly into the host application as a Rust library with Python and .NET SDKs, avoiding separate processes like QEMU or Firecracker and reducing attack surface by eliminating emulated devices.
- **Unikraft unikernel guest:** hyperlight-unikraft uses the Linux Foundation's Unikraft project to provide a single-address-space kernel containing only components the target application requires, with no SDK, special libc, or recompilation needed for guest binaries.
- **Snapshot/restore for runtime warm-up:** hluk snapshots micro-VMs after runtime initialization and optional warm_exec preloading, restoring them in milliseconds; eight Python guests sharing one snapshot served approximately 850 calls per second with individual restores in a few milliseconds.
- **Capability-based host exposure:** Guest-to-host interaction is restricted to an explicit allow-list defined by the embedder, with no default permissions requiring lockdown after deployment.
- **Nested sandboxing support:** Because guests run ordinary Linux binaries, they can host additional sandboxes such as Wasmtime, with the hypervisor containing failures that would escape process-level isolation.

## Why it matters
For cloud-native operators and platform engineers, hyperlight-unikraft offers a path to isolate third-party, AI-generated, or customer-uploaded code without the startup latency that has traditionally made VMs impractical for short-lived or high-density workloads. The integration with Kubernetes container runtimes and support for extending base rootfs images via standard Dockerfiles positions it as a drop-in security layer for existing CI/CD and serverless pipelines. As supply-chain attacks against language runtimes and package ecosystems increase, the ability to turn sandbox escapes into contained guest crashes via hardware virtualization provides a defense-in-depth mechanism that complements rather than replaces process-level isolation.