How to Run Untrusted Code Without Going Gray

Imagine you need to execute a piece of code sent by a user or a third-party service. Regular Docker feels too heavy, and just running it in a separate process is terrifying. One wrong move and your server turns into a pumpkin or, worse, becomes part of a botnet. This is exactly the kind of scenario the folks from CNCF Sandbox are developing Hyperlight for.

What Is This Beast

Hyperlight is a Rust library that creates micro-virtual machines on the fly. It doesn't try to emulate an entire computer with a graphics card and keyboard. Instead, the project spins up a maximally stripped-down execution environment that doesn't even have an OS kernel. The entire "guest" is just a binary compiled for no_std Rust or C.

The main selling point here is speed. The authors claim that a micro-VM starts in milliseconds, and function calls between host and guest take microseconds. This sounds like the perfect foundation for building your own serverless platforms or secure plugins.

How It Works in Practice

Working with Hyperlight feels like regular programming, except functions execute in different worlds. You add the library to your Rust application, feed it a compiled guest binary, and call methods.

Here's what host-side initialization looks like:

// Подготавливаем песочницу, пока без запуска VM
let mut sandbox = UninitializedSandbox::new(GuestBinary::FilePath(guest_path), None)?;

// Можно прокинуть функцию из хоста в гостя, например, для доступа к БД
sandbox.register("GetWeekday", || Ok("Monday".to_string()))?;

// А теперь «зажигаем» VM
let mut sandbox: MultiUseSandbox = sandbox.evolve()?;

// Вызываем функцию внутри виртуалки
let greeting: String = sandbox.call("SayHello", "World".to_string())?;
println!("{greeting}"); 

And here's what the code inside the virtual machine looks like. Thanks to macros, everything is very transparent:

#[host_function("GetWeekday")]
fn get_weekday() -> Result<String>;

#[guest_function("SayHello")]
fn say_hello(name: String) -> Result<String> {
    let weekday = get_weekday()?;
    Ok(format!("Hello, {name}! Today is {weekday}."))
}

Why It's Faster Than Regular VMs

The secret lies in total minimalism. Hyperlight doesn't have Linux inside Linux. There are no filesystem drivers, network stack, or task scheduler. When you call a function, the hypervisor (KVM on Linux or MSHV/WHP on Windows) simply switches the CPU context.

An interesting detail: the project supports snapshot and restore mechanisms. If you need to execute thousands of similar calls, you can initialize the sandbox once, take a memory snapshot, and roll back to it before each new run. This ensures every call starts with a clean slate without spending time reloading the binary.

Who Needs This and Why

I see several scenarios where Hyperlight could really take off.

First, there's cloud functions (FaaS). If you're building your own AWS Lambda alternative, you need hypervisor-level isolation but don't want to wait a second for a container to spin up.

Second, there are extensions for complex systems. Say you have a database or game server and want to let users write their own scripts. Lua or WASM is cool, but Hyperlight provides even stricter isolation and lets you write in familiar Rust or C.

By the way, the repository has links to related projects like hyperlight-wasm and hyperlight-js. This means you can already run WebAssembly or JavaScript inside these micro-VMs, making the tool even more versatile.

Nuances and Limitations

The project is in pre-1.0 status. This means the API can change at any moment, and the documentation is occasionally head-scratching.

Important note: Hyperlight isn't designed for running regular Linux applications. You won't be able to run ls or curl there because system calls simply don't exist. If you need exactly that, you'll have to look at Unikraft or full-fledged VMMs like Firecracker. Here we're talking about pure code in a vacuum.

Is It Worth Trying

If your task is to safely execute a small piece of code with minimal latency, Hyperlight looks very promising. It provides that sweet spot between "leaky" processes and heavyweight VMs.

The easiest way to get started is through GitHub Codespaces, with links right in the README. Everything is already configured there, including KVM, so you can poke around the examples without setting up your local machine. The project is actively maintained under the CNCF umbrella, with regular community calls, so its long-term prospects look solid.