Hyperlight is a lightweight Virtual Machine Manager designed to be embedded within applications for safe execution of untrusted code in micro virtual machines with minimal overhead.
Hyperlight addresses the need to safely execute untrusted or third-party code with strong isolation guarantees. It works by embedding as a library in Rust applications and running guest code in hypervisor-isolated micro VMs that start in milliseconds. Guest binaries are purpose-built using the Hyperlight guest library without requiring a kernel or operating system, and host and guest communicate through typed function calls. Guests are sandboxed by default with no access to the host filesystem, network, or other resources. The tool supports multiple hypervisors including KVM, MSHV, and Windows Hypervisor Platform, and guests can be written in no_std Rust or C. State can be persisted across calls using snapshot and restore operations, allowing VMs to be reused efficiently while ensuring each call starts from a clean state.
Hyperlight suits applications that need to run untrusted code with hypervisor-level isolation, create and tear down sandboxes in milliseconds, and make guest function calls in microseconds. It is well-suited for embedding sandboxed execution directly in applications and building functions-as-a-service platforms with strong isolation. The tool is not designed for general-purpose virtualization or running full Linux guest workloads that require syscalls, networking, or filesystem access. The project is pre-1.0, meaning the API may change between releases and upgrades may require code changes.
Development activity shows consistent engagement with the codebase through regular commits and pull request activity. The project maintains active issue tracking and responds to community contributions. Documentation is actively maintained with guides for getting started and building guest binaries. The team addresses bug reports and feature requests through the standard GitHub workflow.
