Tag
Microsoft has open sourced NVX, an ultra-lightweight cross-platform MicroVM sandbox built on OpenVMM, designed to run untrusted workloads with hardware-enforced isolation. It supports Windows (WHP) and Linux (KVM/MSHV), and is believed to be the underlying implementation of Azure Sandbox.
Burrow MacOS is a free, open-source tool that lets users instantly run Windows 11 or any Linux distribution on a Mac with one click, launched on Product Hunt.
VMMouse for NT 3.x 是一个开源的 QEMU/VMware 鼠标集成驱动，支持在 Windows NT 3.x 虚拟机中实现无缝鼠标指针整合。
Pwn.ai researchers detail CVE-2026-99999, a critical Linux networking flaw that allowed guest-controlled checksum metadata to rewrite IPv4 headers after validation, escalating from a 32-byte host-memory disclosure to a full guest-to-host KVM escape discovered during Vercel's $1 million Sandbox challenge.
STAC发布了STAC-M3基准测试审计结果：L Labs的L tick database 1.0在Oxide OxVM云虚拟机（128 vCPU、1.25 TiB内存、5块NVMe盘）上运行，在Antuco套件中创下多项纪录，包括最高存储效率（为此前最佳的1.86倍）以及多个查询时间指标领先。
Perplexity 开源了其代理沙箱平台 SPACE，该平台是 Computer 背后的安全基础设施，为开发者提供隔离执行、状态恢复和网络/凭证控制等生产级代理运行时基础。
Oxide Computer 介绍 Voxel（Virtual OXidE Labs）——一套在单机上模拟完整 Oxide 机架的软件仿真栈，集成 Propolis 虚拟化、FRR/BGP 网络、SoftNPU P4 交换机以及 SP/RoT 微控制器仿真，使产品保障团队无需特殊测试版本即可用真实控制面软件进行高保真 CI 测试。
Topgolf 报告称在从 VMware 迁移到 VergeIO 的 VergeOS 平台后节省了超过 1130 万美元，用约 400 台 Dell PowerEdge 服务器替换了 650 台 VxRail 主机，硬件支出降低 87%、软件成本降低 77%。这是自 Broadcom 收购 VMware 以来，企业因涨价和许可变动而大规模外迁的又一案例。
微软开源 Quicksand，一个用于启动、控制和快照 QEMU 虚拟机的异步 Python API，专注于为 AI 智能体提供沙箱环境，无需 root 权限或 Docker 即可运行。
WSL3（Linux 内核 6.18）相比 WSL2（内核 6.6）在实际开发者工作负载上带来约 5-60% 的性能提升，其中内存带宽提升最为显著（+61%），调度器与 IPC 延迟下降约 11%，Go 编译任务也获得约 4% 的提速。
A survey finds that licensing costs are driving about 90% of VMware users to explore alternatives following Broadcom's acquisition, with organizations increasingly adopting multi-hypervisor and hybrid virtualization strategies.
作者（前 Docker 员工）回顾了 Docker 自 2016 年起在 Docker Desktop 中使用基于 hyperkit/ LinuxKit 的微虚拟机架构的历史，并指出该技术如今是 Docker Sandboxes 运行 AI coding agent 的安全隔离基础。
Cua (trycua) announced the free, source-available launch of Cua Spaces on macOS — agent-ready virtual desktops built on Cua Driver and the Lume virtualization stack, featuring Teleport session bundling, the RCDP streaming protocol with per-agent cursors, and direct-agent connectivity via the Cua MCP.
The upcoming space game SEEDS ships with a built-in RISC-V 64 emulator, PasRISCV, written in Object Pascal and open-sourced under the zlib license, which boots a full Alpine Linux system to run in-game tools as native Linux programs.
Microsoft has open-sourced NVX, an ultra-light micro-VM sandbox for running untrusted workloads with hardware-enforced isolation, built on OpenVMM with Linux as guest and support for KVM, MSHV, and Windows Hypervisor Platform.
NSL is a tool that provides WSL-style persistent Linux machines on Linux hosts using systemd-nspawn containers in a VM, enabling work in different distros with file and port access.
Anthropic's engineering team shared lessons learned from three personal agent isolation architectures, analyzing the costs and practical vulnerabilities of different security models.
The article discusses how by 2026, foundational components for building AI agents like Manus will become commercialized, with AWS AgentCore as a leading example, reducing the need for custom development.
The nspawn tool has been revived with version 1.0.0 rewritten in Rust, featuring a new OCI registry hub for managing Linux container images.
The author discusses building a deterministic hypervisor, explaining the challenges of achieving determinism due to concurrency and hardware issues, while critiquing existing implementations in cybersecurity and virtualization.