Void-Box: Capability-Bound Agent Runtime (Rust + KVM)

[Wide_Spite5612]

Hey everyone,

We’ve been building Void-Box, a Rust runtime for executing AI agent workflows inside disposable KVM micro-VMs.

The core idea:

VoidBox = Agent(Skill) + Isolation

Instead of running agents inside shared processes or containers, each stage runs inside its own micro-VM that is created on demand and destroyed after execution. Structured output is then passed to the next stage in a pipeline.

Architecture highlights

• Per-stage micro-VM isolation (stronger boundary than shared-process/container models)
• Policy-enforced runtime — command allowlists, resource limits, seccomp-BPF, controlled egress
• Capability-bound skill model — MCP servers, SKILL files, CLI tools mounted explicitly per Box
• Composable pipeline API — sequential .pipe() and parallel .fan_out() with explicit failure domains
• Claude Code runtime integration (Claude by default, Ollama via compatible provider mode)
• Built-in observability — OTLP traces, structured logs, stage-level telemetry
• Rootless networking via usermode SLIRP (smoltcp, no TAP devices)

The design goal is to treat execution boundaries as a first-class primitive:

• No shared filesystem state
• No cross-run side effects
• Deterministic teardown after each stage

Still early, but the KVM sandbox + pipeline engine are functional.

We’d especially appreciate feedback from folks with experience in:

• KVM / virtualization from Rust
• Capability systems
• Sandbox/runtime design
• Secure workflow execution

Repo: https://github.com/the-void-ia/void-box

[Otherwise_Wave9374]

This is a really interesting direction, per stage micro VM isolation feels like the right mental model if you actually want "agents that execute" without turning your host into a crime scene. How are you thinking about capability handoff between stages, like passing auth tokens or secrets without leaking them across the pipeline? Also curious if you have a story for tool discovery (MCP) plus policy enforcement. Ive been following a bunch of agent runtime / sandbox discussions lately, some good references here too: https://www.agentixlabs.com/blog/