Starlight
Agent microVMs
Early access
Let agents act. Keep the host yours.
Agent microVMs give AI agents a real place to run commands, code, and tools, inside their own hardware-isolated machines, while your host keeps the credentials, the policy, and the evidence.
A model-generated action should never be a host-level action.
Agents compile code, browse, and edit files. Run that directly on your servers and the model effectively holds shell access.
Your framework decides what happens. Agent microVMs control where and how.
Your agent framework decides what work should happen.
Agent microVMs control where and how that work executes.
Hardware-isolated machines contain untrusted actions.
The host stays authoritative for policy, credentials, budgets, and audit evidence.
Ephemeral and long-lived sessions
A machine for the moment, or for the mission.
Spin up a session for one task and destroy it at the end, or keep a long-lived session that holds state and context across work. Either way the boundary is the same hardware-isolated machine, and either way teardown is clean when the session ends.
Networking and credentials
Nothing leaves by default.
Sessions start with no general network access; connectivity is granted through explicit destination and port allowlists. Credentials never enter the guest at all: the host holds them and exposes constrained interfaces, so a compromised tool has no long-lived secrets to read.
Budgets and determinism
Bounded and deterministic.
The host sets each session's CPU, memory, runtime, output, and token budgets, and the guest cannot raise them. Commands carry idempotency keys and end in explicit states: success, failure, cancelled, exhausted, expired, or unknowable. Never a silent retry.
Artifacts and audit
Evidence, not trust.
Results come back as content-addressed artifacts, collected only after the machine is confirmed stopped, alongside a tamper-evident record of what was requested, what was authorized, and what came back.
Outcomes
Safer autonomy
Agents compile code, run tests, process files, and invoke tools without receiving equivalent access to the server underneath.
Keep your agent stack
Your framework stays responsible for workflows and intelligence. Agent microVMs become the execution boundary beneath it.
Failures stay contained
Budgets, network policy, and clean teardown limit the impact of mistakes or adversarial input, whether a session lives for a minute or a month.
Credentials stay home
Provider and platform credentials remain on the host. Sessions use constrained interfaces instead of carrying reusable secrets.
How it works
01
Your framework calls one API
Create a session, run commands, transfer files, stream events, and collect results through a versioned execution API.
02
The task runs in its own machine
Each session gets a hardware-isolated microVM with its own resource limits and network policy, enforced by the host.
03
Evidence comes back, the machine goes away
Verified artifacts and an audit record return to your application. The machine is destroyed when the session ends, after one task or after weeks.
Under the hood
Framework-neutral API
Sessions, commands, file transfer, event streams, and cancellation through one versioned API, whatever drives it.
Digest-pinned images
Sessions boot from exact container-image digests admitted by policy, so operators know which userspace every session used.
Resumable event streams
Live progress with recovery after disconnection and ordered terminal events, so long tasks never depend on one fragile connection.
Minimal privileged surface
Most of the runtime is unprivileged. A deliberately narrow launcher owns the few operations that require privilege.
Exec and managed sessions
Drive execution from your own framework, or let a hardened host-side planner drive it. Both use the same policy and audit path.
Hardened platform integration
Runs on Starlight's hardened OS: SELinux enforcement, FIPS-approved cryptography, and an immutable operating system.
Works with your stack
Keep your framework. Add the boundary.
- LangChain and LangGraph
- CrewAI
- OpenAI Agents SDK
- Vercel AI SDK
- More on the way
Built for the places agents are hardest to trust.
Edge, disconnected, and regulated environments, running alongside local inference on Starlight nodes.
Put a boundary under your agents.
Agent microVMs are in early access. Tell us about your agent architecture and we will give you an architectural review.