AI BriefingTerrarium: Local VMs for AI agents with explicit permissions
·2026.11.07 22:55
Key point
The tool uses a custom VMM and WebAssembly components to enforce strict network and filesystem policies, supporting Linux, macOS, and Windows.
Details
- Terrarium is an open-source (Apache-2.0) tool that runs AI agents in persistent Linux VMs to isolate them from the host machine.
- Each VM uses a YAML recipe to define allowed host folders and network destinations, blocking all other access for the agent and its launched processes.
- Performance benchmarks show an existing box boots and runs its first command in under 200 ms, with idle boxes consuming approximately 45 MB of host memory.
- The architecture uses a custom VMM built on rust-vmm parts, with filesystem, block, and network devices running as WebAssembly components with individual memory limits.
- Network traffic is routed through a sandboxed broker that enforces policies, while Linux builds use generated seccomp allowlists for syscall restriction.
- The tool is distributed as a single binary without a daemon, supporting Linux (amd64/aarch64), Apple Silicon macOS, and Windows (amd64/arm64).
This summary was generated automatically by AI. Check the original for the author's claims and context. Copyright belongs to the original author.
Our guide explains how the AI works. Report summary errors, attribution issues, or removal requests via Contact.
Related
Devvm: Open-Source Tool Creates Isolated VMs for AI Coding Agents
Replit Replaces Docker with MicroVMs for AI Agent SandboxingCraft Anything: Open-source Rust engine for AI-driven software reverse engineering and recreationZalando Incubator Opens agentic-identity-broker for OAuth2 Delegation in AI Agents