Terrarium open-sources local VM sandbox giving AI agents explicit, auditable permissions

v_0009 · reddit · 2026-11-07

Terrarium is a new open-source (Apache-2.0, beta) tool that runs AI agents inside persistent local Linux VMs with explicit, auditable permissions, inspired by pi.dev.

How it works:

A YAML recipe declares which host folders a box can read/write and which network destinations it can reach; everything else is blocked for every process in the VM. An empty recipe shares nothing and allows no network.
Each box is a full VM with its own kernel — not a container; unlike Firecracker/Cloud Hypervisor it's a ready-to-use single binary with network policy enforced outside the VM, same recipe across Linux, macOS and Windows.
Under the hood: a small custom VMM on rust-vmm parts; filesystem/block/network devices run as WebAssembly components with memory limits and restricted host functions; the VM process has no network — connections pass through a sandboxed broker; Linux builds use statically generated per-role seccomp allowlists.
Daily use: persistent boxes, built-in terminal multiplexing, one executable bundling kernel and Alpine base; existing boxes boot and run a first command in <200 ms with 45 MB idle memory.

Limits: granted permissions still matter (writable shares can be deleted, passed credentials read); no CPU/memory/disk quotas yet. Supports Linux (KVM), Apple Silicon, Windows (amd64 HVP, arm64 build untested). Repo includes quickstart and example recipes.

Original post →

Terrarium open-sources local VM sandbox giving AI agents explicit, auditable permissions

More from coding & agent