dorianzheng

+1. That’s basically what I want too: npx skills but for Python. For now BoxLite is the isolation/runtime layer; the “skills registry + one-liner runner” is a thin wrapper we can add (e.g. pipx boxlite && boxlite run <skill>). If you have a preferred UX, I’m all ears.

dorianzheng

5 เดือนที่ผ่านมาdiscuss

I think you basically answered the entire question 1. Our fundamental assumption is: anything that hands control to an agent/skill is potentially compromised (especially if it touches the web / parses docs). So we isolate that work in its own Box with least privilege: minimal mounts (prefer read-only), no ambient secrets, tight CPU/mem limits, and only the network access it actually needs. 2. BoxLite doesn’t try to solve inter-agent “data trust” / prompt-injection by sanitizing content. What it does do is make sure untrusted code can’t hurt the host, and that sensitive local info doesn’t leak (i.e. it reduces blast radius). If you want semantic safety between agents, you still need boundary hygiene patterns (structured outputs, extraction/validation steps, etc.).

dorianzheng

5 เดือนที่ผ่านมาdiscuss

I've been thinking about AI agents wrong. We keep treating them as this special thing that needs special infrastructure. But what if agent skills are just... functions you compose?

# Specify what skills the agent has - like importing modules async with boxlite.SkillBox(skills=["anthropics/skills"]) as agent:

    # Skills loaded: pdf, docx, pptx, xlsx handling
    await agent.call("Read quarterly_report.pdf and summarize key metrics")
    await agent.call("Export that to a PowerPoint with charts")  # remembers context

That's SkillBox. You declare what skills your agent has upfront. Then call it like any other async function. State persists between calls.

The same skill works across Claude Code, OpenAI Codex CLI, and Gemini CLI. It's becoming the package manager for agent capabilities.

# Install skills dynamically - like pip install at runtime await agent.install_skill("anthropics/skills") # PDF, Word, Excel, PowerPoint await agent.install_skill("example/web-scraper") # Custom scraping skill await agent.install_skill("your-company/internal") # Your private skills

Orchestrating multiple agents:

async with boxlite.SkillBox(skills=["anthropics/skills"]) as doc_agent:

async with boxlite.SkillBox(skills=["example/web-research"]) as research_agent:

    research = await research_agent.call("Find Q3 earnings for top 5 tech companies")

    analysis = await doc_agent.call(f"Analyze this data: {research}")

Just async Python. No YAML. No special DSL.

The fun demo - Starbucks: One function call, Claude navigates the website, handles popups, adds coffee to cart. You watch via noVNC at localhost:3000.

Yeah, it runs in a micro-VM (hardware isolation). But that's a feature, not the point. The point is the programming model.

dorianzheng

7 เดือนที่ผ่านมาdiscuss

  The problem:

  AI agents are most useful when they have freedom—freedom to write code, install packages, run scripts, explore solutions. But that freedom is dangerous. One hallucinated rm -rf / or a malicious package install, and your host system pays the price.

  So we restrict them. Limit file access. Disable network. Whitelist commands. The agent becomes safer but also dumber—unable to iterate, experiment, or recover from mistakes like a human developer would.

  I wanted to give AI agents a full computer they could break without breaking mine.

  Why not existing tools?

  When I started sandboxing AI-generated code, nothing quite fit:

  - Docker shares the host kernel—container escapes are a real attack surface, and that makes me nervous
  - QEMU/libvirt is powerful but heavyweight—XML configs, daemon processes, steep learning curve
  - Cloud sandboxes (E2B, Modal, etc.) work, but you're locked into their platform with limited customization
  - Kata Containers is designed for Kubernetes orchestration, not for embedding in a Python script

  The SQLite idea:

  I've been thinking about why SQLite works so well. Before SQLite, databases meant running a server—PostgreSQL, MySQL, managing daemons, configuring connections. SQLite asked: what if it was just a library? No server. Just import sqlite3.

  I wanted the same thing for VMs.

  So I started building BoxLite—an attempt to make VMs embeddable like SQLite. A library call that gives you a real micro-VM with its own kernel. No daemon. No root.

  import asyncio
  import boxlite

  async def main():
      async with boxlite.SimpleBox(image="python:slim") as box:
          result = await box.exec("python", "-c", "print('Hello from VM!')")
          print(result.stdout)

  asyncio.run(main())

  To be clear: this is early.

  It works on macOS Apple Silicon and Linux. You can pull OCI images, mount volumes, forward ports. There are some higher-level abstractions (BrowserBox for Playwright, ComputerBox for desktop automation).

  But there are bugs. Boot time is 200ms for hot runs (I want it under 100ms). Documentation is thin. Error messages could be better. macOS Intel and Windows aren't supported. I haven't battle-tested it at scale.

  I'm sharing it now because I'd rather build this with feedback than in isolation.

  What I'd love to hear:
  - Does the SQLite-for-VMs idea make sense, or am I stretching the analogy?
  - What would you actually use this for?
  - What's broken or confusing when you try it?

  GitHub: https://github.com/boxlite-labs/boxlite
  PyPI: https://pypi.org/project/boxlite/

dorianzheng

Submissions

[untitled]

Show HN: BoxLite – the all-terrain micro-VM

[untitled]

[untitled]

Compose AI agent skills like Python imports, orchestrate like microservices

Building Open Source Manus

SQLite for VMs: embeddable AI agent sandboxing

BoxLite Love AI agent – SQLite for VMs: embeddable AI agent sandboxing

comments