Hyperlight Unikraft

Hyperlight Unikraft runs ordinary Linux programs inside Hyperlight micro virtual machines, using a Unikraft unikernel as the guest kernel. Python, Node.js, .NET, Go, Rust, C, Bash, PowerShell, QuickJS and Wasmtime run unmodified. A guest reaches nothing on the host unless you allow it, and a warmed guest comes back from a snapshot in milliseconds.

It ships as a CLI, hluk (pronounced “hulk”), and as a Rust library.

# Linux, macOS
curl -fsSL https://raw.githubusercontent.com/hyperlight-dev/hyperlight-unikraft/main/install.sh | sh
# Windows (PowerShell)
irm https://raw.githubusercontent.com/hyperlight-dev/hyperlight-unikraft/main/install.ps1 | iex

hluk init hello --template python   # pulls the python image
cd hello
hluk run                            # boots the micro-VM and saves a snapshot
hluk run                            # restores the snapshot

As a library, load code once and call it with JSON, giving it only the host functions you choose:

use hyperlight_unikraft::SandboxBuilder;
use serde_json::json;

let mut sandbox = SandboxBuilder::from_initrd("quickjs-rootfs.cpio")
    .host_function("db.lookup", |args| {
        let [id]: [u32; 1] =
            serde_json::from_str(args).map_err(|e| e.to_string())?;
        Ok(json!({ "id": id, "name": "Ada" }).to_string())
    })
    .boot()?;

sandbox.run(r#"
    import { lookup } from "host:db";
    globalThis.greet = (e) => ({ message: `Hello, ${lookup(e.id).name}` });
"#)?;

let out = sandbox.call("greet", r#"{"id": 7}"#)?;

Key features include:

• Snapshot restore: boot and warm a guest once, then start from its snapshot in milliseconds.
• Default-deny host access: no host files, network or listening ports unless the manifest or a flag grants them.
• Templates: hluk init starts a project for any supported runtime, and a Dockerfile extends a runtime image with packages.
• Guest and host function calls: from the quickjs, node, python, dotnet-jit and wasmtime images.
• Linux, Windows and macOS hosts: KVM or MSHV, Windows Hypervisor Platform, and Hypervisor.framework on Apple silicon.

Project site GitHub