HN Explorer

Show HN: Local-First Linux MicroVMs for macOS (shuru.run)

213 points by harshdoesdev ↗ HN
Shuru is a lightweight sandbox that spins up Linux VMs on macOS using Apple's Virtualization.framework. Boots in about a second on Apple Silicon, and everything is ephemeral by default. There's a checkpoint system for when you do want to persist state, and sandboxes run without network access unless you explicitly allow it. Single Rust binary, no dependencies. Built it for sandboxing AI agent code execution, but it works well for anything where you need a disposable Linux environment.

24 comments

[ 2.8 ms ] story [ 45.1 ms ] thread
xrd
What is the benefit of this over lima, for example?
7777777phil
The agent stack is splitting into specialized layers and sandboxing is clearly becoming its own thing. Shuru, E2B, Modal, Firecracker wrappers.

Earlier this month I wrote about how these layers have very different defensibility profiles and why going monolithic is the wrong call: https://philippdubach.com/posts/dont-go-monolithic-the-agent...

EDIT: Spelling

josephg
What does local first mean in this context? Does it just mean local? Like, the software runs locally?
Krisso
Why was using straigt containers not enough?
conradev
Use OrbStack. It’s faster than Virtualization.framework because it has its own hypervisor.
rishabhaiover
I've noticed claude forks parallel agents on an assigned task. How would they communicate in isolated sandboxes like these? Would it be cleaner and more effective for a harness to orchestrate swarms of agents in a single clean linux environment like OrbStack?
Xlab
I will steal this to make a local-first version of https://microterm.dev for macOS :)

My idea is to have unified environment across all targets, so the only thing that changes is speed and amount of RAM.

BrandiATMuhkuh
Very cool. Was looking for something like this for a new project of mine. (I'm working on a project that is like a marriage of retool+OpenClaw. It's used by SME to quickly build inhouse apps)
praveenhm
How does it compare to Lume. It uses Apple's native Virtualization Framework to run macOS and Linux VMs at near-native speed on Apple Silicon.
jclay
Has anyone tackled this for Windows? WSL isn’t ideal when shipping a consumer app to a non-developer target audience since it requires some setup.
raihansaputra
man this is cool. this is what i want since i read about fly.io's sprites.

slightly related to this, and i'm not familiar with linux sandboxing/containerization in depth, but any similar turn key solution for linux desktop/server? ideally i have something like sprites/shuru but on my own linux/ubuntu server instead of in the cloud.

servercobra
Same, I really want to use sprites (for me and my whole team) but every time I try to set up, I run into weird issues. Last time I got in some state where trying to launch Claude froze the whole VM every time.
apatheticonion
How are we going for gpu acceleration in Linux VMs on MacOS?
steve1977
Let's not call this local-first please. Especially since there is no wherever- else-second. The term first makes no sense here.
srinath693
The value here isn't 'local VMs'. it's that the defaults are inverted. Everything else defaults to persistent and networked. This defaults to ephemeral and isolated. Small shift, but matters when you don't trust the code that's about to run.
scosman
This looks amazing. I’ve been wanting virtualization.framework micro VMs for months! Docker is fine, but the overhead isn’t ideal.

I like the defaults (ephemeral, network off). Any thoughts on adding host-mapped directories?

I have a MCP server for ephemeral sandboxes that supports various backends (Docker, E2B, Modal, even WASM). I’ll look at adding this. https://github.com/Kiln-AI/Kilntainers

Cyphase
Shuru looks cool! I've been working on something with a similar vibe, for Linux hosts first; MicroVMs, default offline, etc. Not ready to release, but I'm starting to dogfood it.
omrimaya
The design decision I find most interesting here is ephemeral-by-default with opt-in checkpointing, that inversion of the usual "persist everything, clean up manually" model fits agent code execution well. Most sandboxing approaches I've seen treat isolation as the hard problem, but state leakage across runs is the subtler foot-gun when you're executing LLM-generated code repeatedly.

One thing I ran into building agent infrastructure: the boundary between "sandbox that runs code" and "agent that decides what code to run" wants to be a clean HTTP interface, not a library call. Makes it easier to audit what crossed the boundary. Does Shuru expose any hook for streaming stdout back to the caller during execution, or is it strictly "wait for exit, get result"?