# Gondolin

Local Linux micro-VMs with programmable network and filesystem control.

Source: https://wheredoirunthis.com/products/gondolin · JSON: https://wheredoirunthis.com/api/products/gondolin · Read on 2026-10-12

## At a glance

- Type: Sandbox
- Kind: Open source tool
- Isolation: Virtual machine
- Free tier: Not documented
- Starting price: Not disclosed
- GPU: Not documented
- Regions: Not disclosed
- Coverage: 15 of 61 assessed capabilities supported
- Agent readiness: read 5 of 10 signals, drive 5 of 6 signals

## Links

- Homepage: https://earendil-works.github.io/gondolin/
- Docs: https://earendil-works.github.io/gondolin/
- Repository: https://github.com/earendil-works/gondolin

## Runtime

- **GPU & accelerators**: Not documented — "No GPU-backed workload or passthrough documented in backend matrix or images." [source](https://earendil-works.github.io/gondolin/backends/) (confidence: low)
- **BYOC (Bring your own cloud)**: na — "Self-hosted local tool, no managed customer-cloud placement offering." [source](https://github.com/earendil-works/gondolin) (confidence: high)
- **Secrets management**: Host-held placeholder credentials injected into allowed outbound request headers (optional queries); never present as real values in guest env. Bodies/path/response substitution excluded; custom host hooks can observe actual values. [source](https://earendil-works.github.io/gondolin/secrets/)
- **Storage options**: Host-backed programmable VFS via FUSE; MemoryProvider, RealFSProvider, ReadonlyProvider, ShadowProvider; readonly/memory/cow rootfs modes and configurable disk size. [source](https://earendil-works.github.io/gondolin/vfs/)
- **Supported workloads**: Agent-generated shell/code execution, Disposable task/turn sandboxes, Local guest HTTP services, Headless Chromium browser automation via Browser Use, Pi tool execution [source](https://github.com/earendil-works/gondolin)
- **Persistence**: Default rootfs ephemeral; durable RealFSProvider host mounts; qcow2 disk checkpoints. VFS/tmpfs are not checkpointed. [source](https://earendil-works.github.io/gondolin/workloads/)
- **Data jurisdiction**: na — "Workload placement determined by operator, not vendor regions." [source](https://github.com/earendil-works/gondolin) (confidence: high)
- **Resource limits & quotas**: Configurable sandbox.cpus, sandbox.memory and rootfs.size; capacity depends on operator host. No complete DoS isolation. No full-memory snapshots, Windows, HTTP/2/3 or default generic UDP. [source](https://earendil-works.github.io/gondolin/backends/)
- **SDK languages**: TypeScript, JavaScript [source](https://earendil-works.github.io/gondolin/sdk/)
- **Network & egress controls**: Host-side JavaScript HTTP/TLS mediation, allowedHosts, default internal-range blocking, DNS-rebinding defense; optional allowlisted SSH and explicitly mapped TCP. [source](https://earendil-works.github.io/gondolin/security/)
- **Snapshots & forks**: Disk-only qcow2 checkpoints stop the original VM; multiple resumes use temporary CoW overlays and fresh boots. Matching guest assets required. [source](https://earendil-works.github.io/gondolin/snapshots/)
- **Deployment methods**: cli, sdk, container-image [source](https://github.com/earendil-works/gondolin)
- **Isolation**: Virtual machine — "QEMU default, optional libkrun backend; both boot an independent Linux kernel. Schema has no QEMU/libkrun-specific enum; vm is used without claiming Firecracker or gVisor." [source](https://earendil-works.github.io/gondolin/backends/) (confidence: high)

## Capabilities

### AI & agents

| Capability | Status | Evidence |
| --- | --- | --- |
| Agent skills | Supported | "This extension overrides pi's built-in `read`/`write`/`edit`/`bash` tools so they execute inside a Gondolin micro-VM instead of on the host." [source](https://github.com/earendil-works/gondolin/blob/main/host/examples/pi-gondolin.ts) |
| AI app builder | Not supported | "Not advertised in the fetched README, CLI/SDK, workload, networking, filesystem, image, security, and limitations documentation." [source](https://github.com/earendil-works/gondolin) |
| Autonomous QA agent | Not supported | "Not advertised in the fetched README, CLI/SDK, workload, networking, filesystem, image, security, and limitations documentation." [source](https://github.com/earendil-works/gondolin) |
| Built-in coding agent | Not supported | "Not advertised in the fetched README, CLI/SDK, workload, networking, filesystem, image, security, and limitations documentation." [source](https://github.com/earendil-works/gondolin) |
| BYOK for LLMs | Not supported | "Not advertised in the fetched README, CLI/SDK, workload, networking, filesystem, image, security, and limitations documentation." [source](https://github.com/earendil-works/gondolin) |
| Credential-injection proxy | Supported | "The guest only sees placeholders in env vars" [source](https://earendil-works.github.io/gondolin/secrets/) |
| LLM gateway | Not supported | "Not advertised in the fetched README, CLI/SDK, workload, networking, filesystem, image, security, and limitations documentation." [source](https://github.com/earendil-works/gondolin) |
| MCP client | Not supported | "Not advertised in the fetched README, CLI/SDK, workload, networking, filesystem, image, security, and limitations documentation." [source](https://github.com/earendil-works/gondolin) |
| MCP-server hosting | Not supported | "Not advertised in the fetched README, CLI/SDK, workload, networking, filesystem, image, security, and limitations documentation." [source](https://github.com/earendil-works/gondolin) |
| MCP server | Not supported | "Not advertised in the fetched README, CLI/SDK, workload, networking, filesystem, image, security, and limitations documentation." [source](https://github.com/earendil-works/gondolin) |
| Model inference API (first-party) | Not supported | "Not advertised in the fetched README, CLI/SDK, workload, networking, filesystem, image, security, and limitations documentation." [source](https://github.com/earendil-works/gondolin) |
| Preinstalled coding agent | Not supported | "Not advertised in the fetched README, CLI/SDK, workload, networking, filesystem, image, security, and limitations documentation." [source](https://github.com/earendil-works/gondolin) |

### Networking & delivery

| Capability | Status | Evidence |
| --- | --- | --- |
| Automatic HTTPS | Not supported | "The gateway only speaks HTTP (HTTP/1.1 on the host side)." [source](https://earendil-works.github.io/gondolin/ingress/) |
| Custom domains | Not supported | "Not advertised in the fetched README, CLI/SDK, workload, networking, filesystem, image, security, and limitations documentation." [source](https://github.com/earendil-works/gondolin) |
| Direct public IPv6 | Not supported | "software that relies on UDP-based application protocols (or generic UDP connectivity) will not work in the default network model." [source](https://earendil-works.github.io/gondolin/limitations/) |
| Edge KV store | Not supported | "Not advertised in the fetched README, CLI/SDK, workload, networking, filesystem, image, security, and limitations documentation." [source](https://github.com/earendil-works/gondolin) |
| Egress controls | Supported | "allowedHosts controls global egress policy (`undefined` = allow all, explicit `[]` = deny all)" [source](https://earendil-works.github.io/gondolin/secrets/) |
| Email send / receive | Not supported | "Not advertised in the fetched README, CLI/SDK, workload, networking, filesystem, image, security, and limitations documentation." [source](https://github.com/earendil-works/gondolin) |
| Public preview URLs | Not supported | "Not advertised in the fetched README, CLI/SDK, workload, networking, filesystem, image, security, and limitations documentation." [source](https://github.com/earendil-works/gondolin) |
| Private networking | Not supported | "Not advertised in the fetched README, CLI/SDK, workload, networking, filesystem, image, security, and limitations documentation." [source](https://github.com/earendil-works/gondolin) |
| Built-in reverse proxy | Supported | "Starting a host-side HTTP gateway that listens on a host port." [source](https://earendil-works.github.io/gondolin/ingress/) |

### Organisation & security

| Capability | Status | Evidence |
| --- | --- | --- |
| Built-in auth | Not supported | "Not advertised in the fetched README, CLI/SDK, workload, networking, filesystem, image, security, and limitations documentation." [source](https://github.com/earendil-works/gondolin) |
| BYOC | Not applicable | "Standalone self-hosted tool, not a managed BYOC offering." [source](https://github.com/earendil-works/gondolin) |
| Deploy into customers' VPCs | Not applicable | "No hosted vendor control plane to deploy software into customers’ VPCs." [source](https://github.com/earendil-works/gondolin) |
| Secrets management | Supported | "On outbound HTTP, the host replaces placeholders with real values (only for allowed hosts)" [source](https://earendil-works.github.io/gondolin/secrets/) |
| Self-host / OSS core | Supported | "License: Apache-2.0" [source](https://github.com/earendil-works/gondolin) |
| Sharing | Not supported | "Not advertised in the fetched README, CLI/SDK, workload, networking, filesystem, image, security, and limitations documentation." [source](https://github.com/earendil-works/gondolin) |
| SSO / SAML | Not applicable | "No hosted account or enterprise SSO surface." [source](https://github.com/earendil-works/gondolin) |
| Teams | Not applicable | "No hosted team-account service." [source](https://github.com/earendil-works/gondolin) |
| Workload identity | Not supported | "Not advertised in the fetched README, CLI/SDK, workload, networking, filesystem, image, security, and limitations documentation." [source](https://github.com/earendil-works/gondolin) |

### Developer access

| Capability | Status | Evidence |
| --- | --- | --- |
| CLI | Supported | "npx @earendil-works/gondolin bash" [source](https://earendil-works.github.io/gondolin/cli/) |
| E2B-compatible API | Not supported | "Not advertised in the fetched README, CLI/SDK, workload, networking, filesystem, image, security, and limitations documentation." [source](https://github.com/earendil-works/gondolin) |
| Filesystem API | Supported | "Filesystem operations are exposed under `vm.fs`." [source](https://earendil-works.github.io/gondolin/sdk-vm/) |
| Git deploy | Not supported | "Not advertised in the fetched README, CLI/SDK, workload, networking, filesystem, image, security, and limitations documentation." [source](https://github.com/earendil-works/gondolin) |
| HTTP data API | Not supported | "Not advertised in the fetched README, CLI/SDK, workload, networking, filesystem, image, security, and limitations documentation." [source](https://github.com/earendil-works/gondolin) |
| OpenAPI spec | Not supported | "Not advertised in the fetched README, CLI/SDK, workload, networking, filesystem, image, security, and limitations documentation." [source](https://github.com/earendil-works/gondolin) |
| Private container registry | Not supported | "Not advertised in the fetched README, CLI/SDK, workload, networking, filesystem, image, security, and limitations documentation." [source](https://github.com/earendil-works/gondolin) |
| Public API | Supported | "This section documents the programmatic API in `@earendil-works/gondolin`." [source](https://earendil-works.github.io/gondolin/sdk/) |
| SDK | Supported | "import { VM } from "@earendil-works/gondolin";" [source](https://earendil-works.github.io/gondolin/sdk/) |
| SSH access | Supported | "vm.enableSsh()" [source](https://earendil-works.github.io/gondolin/ssh/) |

### Compute & storage

| Capability | Status | Evidence |
| --- | --- | --- |
| Cloud-init / ignition config | Not supported | "Not advertised in the fetched README, CLI/SDK, workload, networking, filesystem, image, security, and limitations documentation." [source](https://github.com/earendil-works/gondolin) |
| Desktop / computer-use sandbox | Partially supported | "There is a Browser Use example that runs Chromium inside a micro-VM and drives it from a Browser Use agent on the host through the ingress gateway." [source](https://github.com/earendil-works/gondolin) |
| GPU compute | Not supported | "Not advertised in the fetched README, CLI/SDK, workload, networking, filesystem, image, security, and limitations documentation." [source](https://github.com/earendil-works/gondolin) |
| Live-state (memory) snapshots | Not supported | "Gondolin does not provide full VM save/restore (capturing in-VM process state + RAM) today." [source](https://earendil-works.github.io/gondolin/limitations/) |
| Multi-region | Not applicable | "Region placement is operator infrastructure choice; no provider-operated regions." [source](https://github.com/earendil-works/gondolin) |
| Object storage | Not supported | "Not advertised in the fetched README, CLI/SDK, workload, networking, filesystem, image, security, and limitations documentation." [source](https://github.com/earendil-works/gondolin) |
| Persistent disk | Supported | "VFS-mounted paths (e.g. `/workspace`) \| Host provider \| Yes (provider-dependent) \| No" [source](https://earendil-works.github.io/gondolin/workloads/) |
| Sandbox templates / custom images | Supported | "When `oci` is set, Gondolin exports the OCI image filesystem and uses it as the rootfs base." [source](https://earendil-works.github.io/gondolin/custom-images/) |
| Scale to zero | Not supported | "Idle VMs waste resources. A parked QEMU process still holds memory." [source](https://earendil-works.github.io/gondolin/workloads/) |
| Selectable isolation runtime | Supported | "sandbox.vmm \| qemu \| krun \| Select backend (`"qemu"` or `"krun"`)" [source](https://earendil-works.github.io/gondolin/backends/) |
| Snapshots / forking | Supported | "A snapshot can be resumed into a new VM using `checkpoint.resume()` and it can be loaded with `VmCheckpoint.load(...)`. It can be resumed multiple times." [source](https://earendil-works.github.io/gondolin/snapshots/) |

### Data

| Capability | Status | Evidence |
| --- | --- | --- |
| Database branching | Not supported | "Not advertised in the fetched README, CLI/SDK, workload, networking, filesystem, image, security, and limitations documentation." [source](https://github.com/earendil-works/gondolin) |
| Ephemeral instant DB (no-signup) | Not supported | "Not advertised in the fetched README, CLI/SDK, workload, networking, filesystem, image, security, and limitations documentation." [source](https://github.com/earendil-works/gondolin) |
| First-party database | Not supported | "Not advertised in the fetched README, CLI/SDK, workload, networking, filesystem, image, security, and limitations documentation." [source](https://github.com/earendil-works/gondolin) |
| Vector search | Not supported | "Not advertised in the fetched README, CLI/SDK, workload, networking, filesystem, image, security, and limitations documentation." [source](https://github.com/earendil-works/gondolin) |

### Platform & operations

| Capability | Status | Evidence |
| --- | --- | --- |
| Managed CI/CD runners | Not supported | "Not advertised in the fetched README, CLI/SDK, workload, networking, filesystem, image, security, and limitations documentation." [source](https://github.com/earendil-works/gondolin) |
| Built-in observability | Partially supported | "Debug output is routed through a callback so you can capture it in your own code." [source](https://earendil-works.github.io/gondolin/debug/) |
| Preview environments | Not supported | "Not advertised in the fetched README, CLI/SDK, workload, networking, filesystem, image, security, and limitations documentation." [source](https://github.com/earendil-works/gondolin) |
| Scheduled tasks | Not supported | "Not advertised in the fetched README, CLI/SDK, workload, networking, filesystem, image, security, and limitations documentation." [source](https://github.com/earendil-works/gondolin) |
| Project template marketplace | Not supported | "Not advertised in the fetched README, CLI/SDK, workload, networking, filesystem, image, security, and limitations documentation." [source](https://github.com/earendil-works/gondolin) |
| Durable workflows | Not supported | "Not advertised in the fetched README, CLI/SDK, workload, networking, filesystem, image, security, and limitations documentation." [source](https://github.com/earendil-works/gondolin) |

## Agent readiness

### Read: 5 of 10 signals present

5/10 signals (3 full, 2 partial)

- Llms txt: fail — "https://earendil-works.github.io/gondolin/llms.txt and host-root llms.txt: HTTP 404."
- Llms full txt: fail — "https://earendil-works.github.io/gondolin/llms-full.txt and host-root llms-full.txt: HTTP 404."
- Robots AI policy: partial — "Project and host-root robots.txt return HTTP 404; default-allow."
- JSON LD: fail — "https://earendil-works.github.io/gondolin/ has no application/ld+json script."
- Sitemap: fail — "https://earendil-works.github.io/gondolin/sitemap.xml returns HTTP 200 with empty <urlset> (zero URLs)."
- Meta quality: fail — "Homepage title Gondolin Documentation - Gondolin exists; no description or OpenGraph metadata."
- Markdown negotiation: partial — "Accept: text/markdown returns HTML; site index.md/sdk.md 404. Homepage View source links expose raw Markdown docs on GitHub."
- Content efficiency: pass — "Homepage readable text/HTML = 12.0503%; >5% server-rendered threshold."
- Docs discoverable: pass — "Homepage is docs index with first-class CLI/SDK/security/workload links in server-rendered HTML."
- Pricing machine readable: na — "Self-host-only Apache-2.0 tool, no hosted pricing tiers."
- Anti bot: pass — "All required public documentation and raw source pages fetched HTTP 200 without a challenge; ordinary missing paths returned 404."

### Drive: 5 of 6 signals present

5/6 signals (2 full, 3 partial)

- Public API: pass — "https://earendil-works.github.io/gondolin/sdk/ documents VM.create, exec, fs, network, checkpoint APIs (local API)."
- Openapi spec: na — "No hosted HTTP API; local TypeScript API. Probed openapi.json/swagger.json return 404; SDK intro links no REST spec."
- MCP server: fail — "No documented Model Context Protocol control server; .well-known/mcp 404."
- SDK packages: partial — "One official TypeScript/JavaScript npm SDK @earendil-works/gondolin."
- Auth docs: na — "Local runtime requires no service-account API authentication. Upstream secret documentation is not Gondolin API authentication."
- Agent self serve creds: na — "No hosted account/API credential issuance."
- Webhooks: na — "Local process control plane, no hosted event webhook endpoint; JS hooks are not webhooks."
- CLI tool: pass — "https://earendil-works.github.io/gondolin/cli/ official npx CLI for bash/exec/list/attach/snapshot/build."
- Error model: partial — "https://earendil-works.github.io/gondolin/sdk-vm/ documents ExecResult exitCode/signal/stdout/stderr and abort rejection; no common JSON error envelope."
- Rate limit docs: na — "No hosted API or provider-imposed request-rate quotas; CPU/memory are local VM configuration."
- Agent config: partial — "https://github.com/earendil-works/gondolin/blob/main/AGENTS.md available; .well-known/agent HTTP 404, no additional agent-config/skill discovery surface found."

## Coding harnesses

- Pi (earendil-works) — "This extension overrides pi's built-in `read`/`write`/`edit`/`bash` tools so they execute inside a Gondolin micro-VM instead of on the host." [source](https://github.com/earendil-works/gondolin/blob/main/host/examples/pi-gondolin.ts)

Plausible compatibility (derived, not stored):

- Aider
- Amp
- Antigravity
- Claude Code
- Codex CLI
- Devin
- Droid
- Gemini CLI
- Goose
- Hermes Agent
- Kilo Code
- Kiro CLI
- OpenCode
- Qwen Code

## Open source

- Repository: https://github.com/earendil-works/gondolin
- License: Apache-2.0
- Stars: 2281
- Forks: 140
- Self-host methods: package-manager, source-build
- Self-host dependencies: nodejs, qemu

## Company & presence

- GitHub: https://github.com/earendil-works/gondolin
- Documentation: https://earendil-works.github.io/gondolin/
- Company posts: https://earendil.com/posts/

## Nearby in the atlas

- [Agent Safehouse](/products/agent-safehouse.md)
- [Agent Sandbox](/products/agent-sandbox.md)
- [Agent Substrate](/products/agent-substrate.md)
- [Agent37](/products/agent37.md)
- [AgentNest](/products/agentnest.md)
- [Anthropic Sandbox Runtime (srt)](/products/sandbox-runtime.md)

## Method

Facts come from the product's own public pages. Each claim carries its evidence: a quote and the page it came from. We count capabilities rather than grade products, and "Not assessed" means we have not checked, never that the product lacks it.