arcbox vs forkd
Open-source container and VM runtime for macOS in pure Rust: drop-in Docker engine, sub-100ms agent sandboxes (`abctl claude`), full Linux VMs and throwaway macOS guests on one daemon. — versus — fork() for agent microVMs: children fork copy-on-write from a warm Firecracker parent — 100 KVM-isolated VMs in ~100ms, live-VM branching in ~56ms, portable snapshots from a hub.
Both are sandbox primitives for agents rather than services. forkd forks warm Firecracker VMs on Linux/KVM; ArcBox boots microVMs on Apple's hypervisor with a Docker-compatible engine beside them.
| arcbox | forkd | |
|---|---|---|
| Stars | 3.0k | 2.8k |
| Forks | 93 | 208 |
| Language | Rust | Rust |
| License | Apache-2.0 | Apache-2.0 |
| Last activity | 5 days ago | 3 days ago |
| Topics | local, agents | agents, local |
| Curated connections | 3 | 2 |
arcbox — the curator's take
The macOS answer to 'where does my agent run?': one daemon, its own VMM and VirtIO stack, and four workloads on it — Docker-compatible containers (your Compose files just work), disposable microVM sandboxes for agents and untrusted code, full Linux machines, and cloned macOS guests. OrbStack's speed, open source. `abctl claude` drops Claude Code into an isolated VM in one command, and the same sandbox primitive runs in ArcBox's cloud if you outgrow the laptop. NOT for Linux servers (this is a Mac runtime), and it's public beta — Docker parity is broad but not total; run `abctl doctor` before trusting a workflow.
forkd — the curator's take
The sandbox primitive agent fan-out actually wants: instead of cold-booting a kernel per child, a parent VM boots once with your runtime warm (deps imported, model loaded, JVM JITed) and children mmap its memory copy-on-write — so spawning 100 isolated environments costs ~100ms, and v0.4 can BRANCH a live running VM. Tree-search agents, parallel experiment runners and RL rollouts are the natural fits. NOT a managed platform: Linux/KVM only, you operate it, and there's no E2B-style API compatibility — this is a runtime primitive you build on, not a sandbox service you call.