Capsule documentation
A private, owner-operated Firecracker microVM platform for agent workloads.
Capsule turns a Linux machine you control into a private place for running small, isolated computers. It is designed for AI-agent workloads that need a stronger boundary than a subprocess, without assuming a managed cloud fleet.
Capsule is experimental research software. It has no SLA, has not received an independent security audit, and can make breaking changes without migration support.
What you get
- Firecracker microVMs with cloned root filesystems, cgroup limits, per-VM networking, and a management vsock channel.
- One private control plane for the full lifecycle: create, execute, transfer files, inspect, snapshot, clone, and destroy.
- Explicit egress policies, scoped expiring tokens, audit events, TTL reaping, and immutable image provenance.
- A host you own: start with one Linux machine rather than a shared public sandbox fleet.
Start here
- Get started — prepare a private Linux host and launch one disposable VM.
- Understand the architecture — see the control and data paths.
- Read the security model — understand the boundary and the known limits before running sensitive work.
- Operate Capsule — health, cleanup, snapshots, and upgrade discipline.
Scope
Capsule is intentionally a private single-host platform today. It does not claim multi-host scheduling, regional availability, SaaS tenancy, or a replacement for a cloud sandbox provider. The value is the portable, policy-aware agent-computer experience on hardware you operate.
These docs track the current Capsule codebase and will evolve with the project.