# vmsan

Firecracker made simple. Spin up secure microVMs in milliseconds, from install to interactive shell in one command — full lifecycle management, network isolation, Docker image support, and shell access (no SSH).

Source: https://wheredoirunthis.com/products/vmsan · JSON: https://wheredoirunthis.com/api/products/vmsan · Read on 2026-10-15

## At a glance

- Type: Sandbox
- Kind: Open source tool
- Isolation: Firecracker microVM
- Free tier: Not documented
- Starting price: Not disclosed
- GPU: No
- Regions: Not disclosed
- Coverage: 9 of 61 assessed capabilities supported
- Agent readiness: read 10 of 10 signals, drive 4 of 8 signals

## Links

- Homepage: https://vmsan.dev/
- Docs: https://vmsan.dev/
- Repository: https://github.com/angelorc/vmsan

## Website design

Desktop public website · assessed 2026-10-15

Complete assessment.

Restrained white technical site: large text-led hero and terminal install card, followed by structured three-column documentation with green navigation accents.

- Styles: Editorial minimalism
- Landing page: captured
- Pricing: not applicable
- Docs: captured

## Runtime

- **GPU & accelerators**: No — "No GPU passthrough feature; vmsan launches CPU/RAM Firecracker microVMs." (source: docs) (confidence: medium)
- **BYOC (Bring your own cloud)**: na — "BYOC does not apply — vmsan runs on your own Linux host; no managed control plane." (source: n/a (self-host CLI)) (confidence: high)
- **Secrets management**: No — "No managed secrets store; env vars are injected at exec time (operator's responsibility), not a first-class secrets feature." (source: docs) (confidence: medium)
- **Storage options**: Per-VM ext4 rootfs + ~/.vmsan/ state (vms/, rootfs/, snapshots/, registry/ OCI cache); file upload/download over the agent HTTP API (no SSH). — "`vmsan upload`/`download` (no SSH); each VM has its own ext4 rootfs; Docker/OCI images are flattened to ext4 and cached in ~/.vmsan/registry/." [source](https://vmsan.dev/guide/file-operations) (confidence: high)
- **Supported workloads**: ai-agent-sandboxing, untrusted-code-execution, multi-tenant-isolation, ephemeral-microvm-sandboxes, ci-isolation — "Comparison table 'Best for: AI sandboxing, untrusted code, multi-tenant'; topics ai-agents/firecracker/sandbox; hardware-isolated microVMs for running untrusted/agent-generated code." [source](https://github.com/angelorc/vmsan) (confidence: high)
- **Persistence**: VMs persist across stop/start (state files in ~/.vmsan/vms/, per-VM ext4 rootfs); snapshots save/restore VM state. Sandbox-oriented (ephemeral by intent) but stoppable/restartable. — "`vmsan stop`/`start`; state persisted in ~/.vmsan/ (vms/, rootfs/, snapshots/); `vmsan snapshot create` + `create --snapshot` restore." [source](https://github.com/angelorc/vmsan) (confidence: high)
- **Data jurisdiction**: na — "Data residency is moot — microVMs run on your own machine." (source: n/a (self-host CLI)) (confidence: high)
- **Resource limits & quotas**: Per-VM CPU/memory at create (`--cpus`, `--memory`); per-VM bandwidth cap (`--bandwidth`); bounded by the host machine; single-host (no multi-host until 0.7.0). — "`vmsan create --runtime node22 --memory 512 --cpus 2`; bandwidth cap per VM; resources bounded by your Linux host." [source](https://github.com/angelorc/vmsan) (confidence: high)
- **SDK languages**: TypeScript — "Published on npm as `vmsan` — a CLI AND a TypeScript library; the SDK exports VMService, FirecrackerClient, AgentClient, NetworkManager, Jailer, ShellSession." [source](https://npmjs.com/package/vmsan) (confidence: high)
- **Network & egress controls**: Yes — "Docs: allow-all outbound is default; deny-all/custom policy available, domain/CIDR rules and runtime updates. Baseline blocks ICMP and UDP except DNS, known resolver DoH/DoT and cross-VM subnets." [source](https://vmsan.dev/guide/networking) (confidence: high)
- **Snapshots & forks**: Yes — "`vmsan snapshot create/list/delete`; `vmsan create --snapshot <id>` boots a new VM from a saved snapshot (memory+state), agent token preserved — snapshot + restore-as-new-VM (fork-like)." [source](https://vmsan.dev/guide/snapshots) (confidence: high)
- **Deployment methods**: cli, sdk, container-image — "The `vmsan` CLI (create/list/exec/connect/upload/download/network/snapshot/doctor) + the importable TS library; interactive shell via WebSocket PTY (`vmsan connect`)." [source](https://github.com/angelorc/vmsan) (confidence: high)
- **Isolation**: Firecracker microVM — "'vmsan uses Firecracker to create lightweight microVMs with a jailer for security isolation'; hardware (KVM) isolation + jailer + seccomp + cgroups + per-VM network namespace. The README comparison table lists 'Isolation level: Hardware (KVM)'." [source](https://github.com/angelorc/vmsan) (confidence: high)

## Capabilities

### AI & agents

| Capability | Status | Evidence |
| --- | --- | --- |
| Agent skills | Not supported | "No agent-skills system." [source](https://github.com/angelorc/vmsan) |
| AI app builder | Not supported | "No prompt-to-app builder." [source](https://github.com/angelorc/vmsan) |
| Autonomous QA agent | Not supported | "Not advertised in the refreshed README and complete public documentation corpus (2026-10-15)." [source](https://github.com/angelorc/vmsan) |
| Built-in coding agent | Not supported | "Ships no AI coding agent. (The 'agent' in vmsan is the in-VM Go HTTP agent for exec/files/shell — not an AI agent.)" [source](https://github.com/angelorc/vmsan) |
| BYOK for LLMs | Not applicable | "Not an LLM product — env vars can be injected at exec, but that is generic, not a BYOK-LLM feature." [source](https://github.com/angelorc/vmsan) |
| Credential-injection proxy | Not supported | "Not advertised in the refreshed README and complete public documentation corpus (2026-10-15)." [source](https://github.com/angelorc/vmsan) |
| LLM gateway | Not applicable | "Not an LLM product — vmsan provides isolation, not LLM routing." [source](https://github.com/angelorc/vmsan) |
| MCP client | Not supported | "No MCP client." [source](https://github.com/angelorc/vmsan) |
| MCP-server hosting | Not supported | "No MCP-hosting feature (you could run an MCP server inside a VM = generic usage)." [source](https://github.com/angelorc/vmsan) |
| MCP server | Not supported | "No MCP server (/.well-known/mcp 404; no MCP in docs/repo)." [source](https://vmsan.dev/) |
| Model inference API (first-party) | Not applicable | "Serves no first-party model inference API." [source](https://github.com/angelorc/vmsan) |
| Preinstalled coding agent | Not supported | "Not advertised in the refreshed README and complete public documentation corpus (2026-10-15)." [source](https://github.com/angelorc/vmsan) |

### Networking & delivery

| Capability | Status | Evidence |
| --- | --- | --- |
| Automatic HTTPS | Not applicable | "Not a web host — microVM sandbox CLI; no per-workload TLS provisioning." [source](https://github.com/angelorc/vmsan) |
| Custom domains | Not applicable | "Local sandbox CLI — no public domain mapping." [source](https://github.com/angelorc/vmsan) |
| Direct public IPv6 | Not applicable | "Per-VM /30 IPv4 TAP (198.19.{slot}.0/30) on a local host; no per-instance public IPv6." [source](https://github.com/angelorc/vmsan) |
| Edge KV store | Not applicable | "Not an edge-runtime KV store." [source](https://github.com/angelorc/vmsan) |
| Egress controls | Supported | "Docs: allow-all outbound is default; deny-all/custom policy available, domain/CIDR rules and runtime updates. Baseline blocks ICMP and UDP except DNS, known resolver DoH/DoT and cross-VM subnets." [source](https://vmsan.dev/guide/networking) |
| Email send / receive | Not applicable | "Not an email product." [source](https://github.com/angelorc/vmsan) |
| Public preview URLs | Not applicable | "Not a deploy host — no shareable preview URLs (port publishing exposes raw host ports)." [source](https://github.com/angelorc/vmsan) |
| Private networking | Not supported | "Not advertised in the refreshed README and complete public documentation corpus (2026-10-15)." [source](https://github.com/angelorc/vmsan) |
| Built-in reverse proxy | Not supported | "Port publishing (`--publish-port`, maps a VM port to the host) exists, but no reverse-proxy/ingress layer; the reserved per-VM SNI/HTTP proxy port ranges remain unshipped." [source](https://github.com/angelorc/vmsan) |

### Organisation & security

| Capability | Status | Evidence |
| --- | --- | --- |
| Built-in auth | Not applicable | "Single-operator local CLI — no workload auth/IAM (the agent uses an internal host-guest token, not user-facing auth)." [source](https://github.com/angelorc/vmsan) |
| BYOC | Not applicable | "Local CLI — you own the machine; managed-control-plane BYOC does not apply." [source](https://github.com/angelorc/vmsan) |
| Deploy into customers' VPCs | Not supported | "Not advertised in the refreshed README and complete public documentation corpus (2026-10-15)." [source](https://github.com/angelorc/vmsan) |
| Secrets management | Partially supported | "Exec supports environment-variable injection; no managed secret store or external-credential proxy is documented." [source](https://vmsan.dev/api/cli-reference) |
| Self-host / OSS core | Supported | "Apache-2.0; self-host is the only deployment (one-command installer / npm / source build). 'Apache-2.0' license." [source](https://github.com/angelorc/vmsan) |
| Sharing | Not applicable | "Single-operator local CLI — no share-a-resource-by-link primitive." [source](https://github.com/angelorc/vmsan) |
| SSO / SAML | Not applicable | "Single-operator local CLI — no SSO/SAML." [source](https://github.com/angelorc/vmsan) |
| Teams | Not applicable | "Single-operator local CLI — no team accounts." [source](https://github.com/angelorc/vmsan) |
| Workload identity | Not supported | "Not advertised in the refreshed README and complete public documentation corpus (2026-10-15)." [source](https://github.com/angelorc/vmsan) |

### Developer access

| Capability | Status | Evidence |
| --- | --- | --- |
| CLI | Supported | "The `vmsan` CLI is THE product — create/list/start/stop/remove/exec/connect/upload/download/network/snapshot/doctor, with `--json` output for automation. Official, comprehensive." [source](https://vmsan.dev/api/cli-reference) |
| E2B-compatible API | Not supported | "Not advertised in the refreshed README and complete public documentation corpus (2026-10-15)." [source](https://github.com/angelorc/vmsan) |
| Filesystem API | Supported | "`vmsan upload`/`download` perform remote file operations over the in-VM agent's HTTP API — file transfer WITHOUT SSH (the defining filesystem-api shape)." [source](https://vmsan.dev/guide/file-operations) |
| Git deploy | Not applicable | "Not a deploy platform — a microVM sandbox CLI; no push-to-deploy." [source](https://github.com/angelorc/vmsan) |
| HTTP data API | Not applicable | "Data-layer primitive — not applicable." [source](https://github.com/angelorc/vmsan) |
| OpenAPI spec | Not supported | "No OpenAPI/Swagger for vmsan's own API; src/generated/ holds Firecracker's API type definitions, not a vmsan spec." [source](https://github.com/angelorc/vmsan) |
| Private container registry | Not supported | "No hosted private image registry; ~/.vmsan/registry/ is a LOCAL OCI rootfs cache, not a user-facing registry." [source](https://github.com/angelorc/vmsan) |
| Public API | Partially supported | "A programmatic TypeScript library (npm `vmsan`: VMService/FirecrackerClient/AgentClient/NetworkManager) + the in-VM agent's HTTP API — but a local/library API, not a hosted remote public API." [source](https://npmjs.com/package/vmsan) |
| SDK | Supported | "Published on npm as a CLI AND a TypeScript library — 'vmsan is a CLI tool and TypeScript library for managing Firecracker microVMs' (exports VMService, FirecrackerClient, AgentClient, NetworkManager, etc.)." [source](https://npmjs.com/package/vmsan) |
| SSH access | Not supported | "DELIBERATELY no SSH — 'run commands, transfer files — no SSH required'; interactive shell is a WebSocket PTY via the in-VM Go agent (`vmsan connect` / `exec -i`). (So the ssh-keyed might-work harness derivation does not fire.)" [source](https://github.com/angelorc/vmsan) |

### Compute & storage

| Capability | Status | Evidence |
| --- | --- | --- |
| Cloud-init / ignition config | Not supported | "No cloud-init / declarative launch config yet — declarative config / `vmsan.toml` is roadmap (planned 0.5.0); customisation is via CLI flags (`--runtime`, `--memory`, `--cpus`, `--from-image`)." [source](https://github.com/angelorc/vmsan) |
| Desktop / computer-use sandbox | Not supported | "No virtual-desktop / computer-use GUI — headless microVMs with a PTY shell." [source](https://github.com/angelorc/vmsan) |
| GPU compute | Not supported | "No GPU passthrough; CPU/RAM Firecracker microVMs only." [source](https://github.com/angelorc/vmsan) |
| Live-state (memory) snapshots | Supported | "preserving the full machine state including memory, processes, and open files" [source](https://vmsan.dev/guide/snapshots) |
| Multi-region | Not applicable | "Single-host self-host CLI (no multi-host until roadmap 0.7.0); no region concept — runs on your own machine." [source](https://github.com/angelorc/vmsan) |
| Object storage | Not supported | "Not advertised in the refreshed README and complete public documentation corpus (2026-10-15)." [source](https://github.com/angelorc/vmsan) |
| Persistent disk | Supported | "Each VM has its own ext4 rootfs; VM state persists across `vmsan stop`/`start` (state files in ~/.vmsan/vms/), and snapshots capture/restore disk+memory state." [source](https://github.com/angelorc/vmsan) |
| Sandbox templates / custom images | Supported | "Prebuilt runtimes (`base`, `node22`, `node24`, `python3.13`) AND `--from-image` builds a VM rootfs from ANY Docker/OCI image (flattened to ext4, cached). Reusable base images you launch instances from." [source](https://vmsan.dev/guide/docker-images) |
| Scale to zero | Not supported | "No scale-to-zero / auto-idle-suspend primitive; `vmsan stop` is a manual full stop (and there is no billing context)." [source](https://github.com/angelorc/vmsan) |
| Selectable isolation runtime | Not supported | "Not advertised in the refreshed README and complete public documentation corpus (2026-10-15)." [source](https://github.com/angelorc/vmsan) |
| Snapshots / forking | Supported | "`vmsan snapshot create/list/delete`; `vmsan create --snapshot <id>` boots a NEW VM from a saved snapshot (memory+state, agent token preserved) — snapshot + restore-as-new-VM." [source](https://vmsan.dev/guide/snapshots) |

### Data

| Capability | Status | Evidence |
| --- | --- | --- |
| Database branching | Not applicable | "Data-layer primitive — not applicable to a microVM sandbox CLI." [source](https://github.com/angelorc/vmsan) |
| Ephemeral instant DB (no-signup) | Not applicable | "Data-layer primitive — not applicable." [source](https://github.com/angelorc/vmsan) |
| First-party database | Not supported | "Offers no managed database (you'd run one inside a VM)." [source](https://github.com/angelorc/vmsan) |
| Vector search | Not applicable | "Data-layer RAG primitive — not applicable." [source](https://github.com/angelorc/vmsan) |

### Platform & operations

| Capability | Status | Evidence |
| --- | --- | --- |
| Managed CI/CD runners | Not applicable | "Not a CI-runner platform (though microVMs are usable for CI isolation, there is no managed-runner offering)." [source](https://github.com/angelorc/vmsan) |
| Built-in observability | Not supported | "`vmsan list`/`doctor` + `--json` output show state/health, but no metrics/logs/tracing observability stack." [source](https://github.com/angelorc/vmsan) |
| Preview environments | Not applicable | "Not a PaaS — no per-PR ephemeral environment primitive." [source](https://github.com/angelorc/vmsan) |
| Scheduled tasks | Not supported | "No cron/scheduled-task primitive." [source](https://github.com/angelorc/vmsan) |
| Project template marketplace | Not supported | "Not advertised in the refreshed README and complete public documentation corpus (2026-10-15)." [source](https://github.com/angelorc/vmsan) |
| Durable workflows | Not applicable | "Not a durable-execution / workflow engine." [source](https://github.com/angelorc/vmsan) |

## Agent readiness

### Read: 10 of 10 signals present

10/10 signals (7 full, 3 partial)

- Llms txt: pass — "Real /llms.txt (1.7KB): summary + links to all docs pages + a llms-full.txt pointer — well-structured."
- Llms full txt: pass — "/llms-full.txt present and comprehensive (34KB — the full docs corpus)."
- Robots AI policy: partial — "robots.txt is default-allow (Allow: / for *) + a Sitemap pointer, with no explicit AI-UA mention (silent default-allow)."
- JSON LD: partial — "1 application/ld+json block, but minimal (@type WebSite only — not SoftwareApplication/Product)."
- Sitemap: pass — "Real /sitemap.xml with 10 URLs (all docs pages + home), referenced from robots.txt."
- Meta quality: pass — "Complete: descriptive <title>, a real meta description, and full OG set (image×4 + site/title/description/type)."
- Markdown negotiation: pass — "Content negotiation serves clean text/markdown: curl to vmsan.dev returns markdown (not HTML), and /raw/*.md returns text/markdown (e.g. /raw/getting-started/introduction.md → 200 text/markdown)."
- Content efficiency: partial — "Fresh browser DOM: 2974 readable text bytes / 83115 HTML bytes = 3.58%, partial (1–5% band)."
- Docs discoverable: pass — "First-class docs site at vmsan.dev (Introduction/Guide/API), linked from the README and llms.txt."
- Pricing machine readable: na — "oss-tool — free under Apache-2.0; no hosted pricing surface."
- Anti bot: pass — "Fresh anonymous Chromium landing/docs and curl documentation/well-known fetches showed no challenge."

### Drive: 4 of 8 signals present

4/8 signals (1 full, 3 partial)

- Public API: partial — "A programmatic TypeScript library (npm `vmsan`) + the in-VM agent HTTP API — but a local/library API, not a hosted remote public API."
- Openapi spec: fail — "No OpenAPI for vmsan's own API (src/generated/ is Firecracker's types)."
- MCP server: fail — "No MCP server advertised in refreshed full documentation and README."
- SDK packages: partial — "One official SDK (TypeScript, npm `vmsan`); single language → half."
- Auth docs: na — "Local CLI; no remote API to authenticate to."
- Agent self serve creds: na — "No hosted signup — self-hosted CLI; nothing to self-serve credentials for."
- Webhooks: fail — "No webhooks."
- CLI tool: pass — "The `vmsan` CLI IS the product — comprehensive, official, with `--json` output for automation."
- Error model: partial — "A typed error system (src/errors/) + `--json` structured output; no separately-documented API JSON error-model spec."
- Rate limit docs: na — "Local CLI — no hosted API rate limits."
- Agent config: fail — "No agent configuration/skills surface linked from refreshed README or full documentation."

## Open source

- Repository: https://github.com/angelorc/vmsan
- License: Apache-2.0
- Stars: 87
- Forks: 8
- Self-host methods: binary, package-manager, source-build
- Self-host dependencies: docker

## Company & presence

- Founded: vmsan repo created 2026-02-28
- Team size: Single maintainer (@angelorc) + community contributors
- GitHub: https://github.com/angelorc/vmsan
- npm: https://npmjs.com/package/vmsan
- Docs (vmsan.dev): https://vmsan.dev/

## Nearby in the atlas

- [Agent Safehouse](/products/agent-safehouse.md)
- [Agent Sandbox](/products/agent-sandbox.md)
- [Agent Substrate](/products/agent-substrate.md)
- [Agent37](/products/agent37.md)
- [AgentNest](/products/agentnest.md)
- [Anthropic Sandbox Runtime (srt)](/products/sandbox-runtime.md)

## Method

Facts come from the product's own public pages. Each claim carries its evidence: a quote and the page it came from. We count capabilities rather than grade products, and "Not assessed" means we have not checked, never that the product lacks it.