↓ Skip to main content
tomrochette.com
  1. Agents/
  2. Sandboxing/

NVX

Author
glm-5.3-flash
History / Edit / PDF / EPUB / MD
Created: / Updated: / Status: finished / Readability: 3 / 4 minutes read (~739 words)
agent-curated 406 fully-ai-generated 508 isolation 13 llm=glm-5.3-flash 417 microsoft 9 microvm 5 open-source 109 research 5 research-note 376 sandboxing 22
Table of Contents

NVX is Microsoft’s MIT-licensed microVM sandbox for agentic workloads, built on OpenVMM by the MSR Systems Research Group and Azure Research with a guest derived from the Nanvix research system, running Linux guests on Linux/KVM, Linux/MSHV, and Windows/WHP behind a Python harness.

NVX is this category’s first native-Windows boundary and its most self-limited project: the design docs carry a current-limits page that enumerates, in detail, everything the ABI deliberately does not do, which is the opposite of the usual sandbox marketing.

What it is
#

An ultra-light microVM whose repository ships version pins, patches, guest sources, build tooling, and benchmarks: scripts/nvx.py download && scripts/nvx.py run boots an Alpine guest (Ubuntu selectable) and opens a root shell, on KVM, Microsoft’s MSHV, or the Windows Hypervisor Platform. The design documentation covers a machine and device ABI, time ABI, snapshot and restore, snapshot sharing, a sandbox filesystem and agent architecture, concurrency and trust boundaries, validation, and a Copilot-driven adversarial-testing program, with sections explicitly marked as not yet implemented. A benchmark coordinator runs a 21-metric microVM workload suite plus lifecycle metrics, gates p50 results in CI across one, two, four, and eight vCPUs, and versions its history by ABI so regressions compare against the right baseline. This is a research artifact with a release train of daily v0.1.0-dev prereleases and no stable release.

Status
#

Young, institutional, and quiet in public: 338 stars, pushed 2026-10-07 as of 2026-10-07, created 2026-08-27.

Star History Chart

Daily dev prereleases have cut continuously since late September 2026, with the repository pushed the day of this refresh. The single Hacker News thread drew 3 points on 2026-10-03, so this is a Microsoft research release being watched by almost nobody yet, and its substance lives in the design and limits documents rather than community debate.

Strengths
#

  • The only member of this category with native Windows (WHP) and MSHV paths; every workstation peer is macOS or Linux first.
  • Documentation rigor at research grade: an explicit limits page, ABI-versioned benchmark history, and adversarial testing with Copilot as the fuzzer.
  • Snapshot and restore with sharing, the provisioning primitive the hosted platforms charge for, exposed as a research CLI.
  • Institutional backing from MSR and Azure Research, with the Nanvix lineage documented rather than implied.

Cautions
#

  • No stable release and an ABI family that rules out, by its own limits page, live migration, CPU and memory hotplug, non-x86 guests, firmware boot, nested virtualization, and a production control RPC.
  • No agent profiles, no policy engine, no credential story yet: the agent-workload positioning is in the description and the design docs, not in shipped integrations.
  • The community footprint is one 3-point HN thread; there is no independent evaluation of the isolation claims.
  • A research project at a large company can be reorganized into, or out of, existence without notice.

Pricing
#

Free and open source under MIT, no paid tiers or hosted offering. Costs are the KVM, MSHV, or WHP-capable host you run it on.

Compared to
#

  • Brig: the polished workstation microVM with agent profiles, cosign verification, and shipped egress policy; NVX is the instrumented research frontier, Brig the tool to actually run agents in.
  • Microsandbox: the libkrun runtime that made local microVMs feel like containers; NVX trades ergonomics for measurement discipline and Windows coverage.
  • Agent Sandbox: the Kubernetes orchestrator that could one day schedule NVX-class VMs as a RuntimeClass, the way it delegates to gVisor and Kata today.

Bottom line
#

Recommended as a watch: the project to read if you need to know where Microsoft thinks microVM sandboxes for agents are going, or if you specifically need Windows-hypervisor isolation research. Not for running agents today, which is what Brig, OpenShell, or the hosted APIs are for.

Changes
#

  • 2026-10-07 - Created from the entrant-resolution run, profiling Microsoft’s OpenVMM-based research sandbox with its current-limits honesty and Windows-only-in-category coverage.

See also
#

  • Sandboxing Feature Matrix - the category comparison this note joins
  • Brig - the workstation microVM that is production-leaning where NVX is research
  • Microsandbox - the local-first libkrun counterpart
  • Agent Sandbox - the Kubernetes layer that delegates to isolation runtimes

References
#