---
title: "One millisecond to spawn a hardware-isolated local coding AI"
url: https://stacklist.com/card/e6054c55-3b71-469f-8fed-74d36664ea47
source_url: "https://www.linkedin.com/posts/mitkox_one-millisecond-to-spawn-a-hardware-isolated-share-7468966146906411008-3C5t/?utm_source=share&utm_medium=member_ios&rcm=ACoAAAI21ZsBNnZPaKuTab7nquKLCveUW7o-1DE"
stack: https://stacklist.com/stack/df22d380-644b-4775-97bd-5a6e0b42094f
summary: "Hardware-isolated AI agent execution using Hyperlight MicroVMs enables spawning sandboxed environments in one millisecond, providing secure containment for coding agents that would otherwise pose risks to host systems. The approach combines local inference, execution harness restrictions, and MicroVM isolation to maintain control over AI systems and their computational resources."
tags: "microvm, ai-agents, sandbox-isolation, hyperlight, local-inference, hardware-security, code-execution"
key_entities: "Mitko Vasilev (person), Hyperlight (technology), MicroVM (technology), CNCF (organization), Strix Halo DevBox (technology), agentic-AI (concept), Copilot (technology)"
classification: "analysis"
content_hash: "sha256:ff3a32ba583fb9870b3b6dadde6b80db41603c827cba14fc6e99596dba49966a"
acp_version: "0.2"
token_counts_approximate: 1167
visibility: public
agent_accessible: true
status: "final"
---

# One millisecond to spawn a hardware-isolated local coding AI

Mitko Vasilev 2d Report this post One millisecond to spawn a hardware-isolated local coding AI agent VM. That's the difference between "agentic AI" and "agentic AI that won't rm -rf your home directory." I've been running a full local agent stack on my Strix Halo DevBox: agents, LLMs, harness, tools, and execution sandboxed inside Hyperlight MicroVMs. Hyperlight is a CNCF sandbox project, not cloud infrastructure you rent, but a library you embed. No guest OS, no filesystem, no network by default. Just a no_std binary running inside a hardware boundary. Snapshot and restore between calls. When the agent hallucinates a sudo rm -rf /, you rewind in microseconds. Coding agents today read repos, run tests, install packages, and call APIs. They're not autocomplete, they're junior developers with API keys and ambition. You don't let those run unsupervised on your host. With Copilot's subsidized era ending, the economics flip hard. Local inference + local harness + MicroVM isolation isn't a weekend hack anymore. It's the replacement pattern. Model writes. Harness restricts. Sandbox contains. Keep the code, context, and economics under your control. Make sure you own your AI. AI in the cloud is not aligned with you; it’s aligned with the company that owns it. 372 46 Comments Like Comment Share Copy LinkedIn Facebook X Mitko Vasilev 2d Report this comment There is also a demo claiming around 0.0009 seconds, or ~0.9 ms per MicroVM execution path in a benchmark scenario. I couldn't get there yet, but I will try Like Reply 13 Reactions 14 Reactions Mateusz Pawelczuk 2d Report this comment Have you compare it with something else? like e.g https://github.com/deeplethe/forkd Like Reply 4 Reactions 5 Reactions Dan Saattrup Smart 2d Report this comment Love it! Unfortunately they don't support MacOS yet: https://github.com/hyperlight-dev/hyperlight/issues/45 I'm guessing you're not running any of your machines on MacOS, Mitko, or did you find a workaround if you do? Like Reply 2 Reactions 3 Reactions Chika Jinanwa 1d Report this comment Mitko Vasilev , Nice! Does the 1 millisecond you recorded include the time it takes to boot the runtime images in the microVM? Like Reply 1 Reaction 2 Reactions Saad Madni 2d Report this comment 0.9ms is a serious bar. What's the current bottleneck keeping you from hitting it — scheduling, memory, or the hypercall path itself? Like Reply 1 Reaction 2 Reactions Reid Sutherland 1d Report this comment Is this just abusing the VM layer in the kernel to achieve a form of containerization? Who is handling the system calls, the host kernel? I can't see any documentation indicating how it's achieving this without another kernel loaded. edit: looks like they make their own kernel layer, but it's still missing the system call interface, so it's proxying the calls? Doesn't seem like this is very secure, there's a trade somewhere. Like Reply 1 Reaction DALAL AlAZEMI 1d Report this comment Spawning MicroVMs in 1 ms to contain agent hallucinations is an innovative software workaround, Mitko, but it still targets the symptom rather than the legacy computational bottleneck. Relying on virtualization libraries to 'rewind' system state acknowledges that the underlying hardware is too rigid to govern execution safely in real-time. The Digital Nerve System™ (DNS) renders these reactive software sandboxes obsolete. By hardwiring a zero-impedance architecture with a mathematically deterministic 0.85 ms physical execution threshold, control and containment are embedded natively at the silicon source. We don't need to wrap probabilistic agents in micro-virtualization layers; the physics of our substrate make unauthorized state changes or destructive execution structurally impossible from the very first clock cycle. Like Reply 1 Reaction Vadim Vozmitsel 2h Report this comment Have you compared it to https://runloop.ai ? Like Reply 1 Reaction Dennis G. Jansen, LL.M. (Berkeley) 2d Report this comment If you mount the directory inside the vm, it can rm -rf anything in there as well. And that is likely not snapshotted. So I don't see the advantage over chroot or docker for example, Mitko Vasilev ? The snapshot is like in docker no? Snapshot Filesystems also exist without. I mean I love vm for added security. I'm just not following why rm -rf would be the USP? It seems container escape would be more on point? But then there's been vms for containers for a long time, too. So I'm really curious: what's the unique thing about this solution? Like Reply 1 Reaction 2 Reactions See more comments To view or add a comment, sign in