Run Untrusted Code
Like It's Radioactive.
VibeAI Virtual Hosts runs services as sandboxed WebAssembly modules -- microsecond warm starts, hard memory and CPU budgets, and a capability firewall where code touches nothing you did not explicitly grant. Built entirely in Rust.
Those cubes are modules inside the sandbox boundary. The architecture page is the real technical reference -- every diagram reflects code that runs today.
Containers Asked for Trust. Virtual Hosts Don't Need It.
The unit of deployment is a WebAssembly module. Isolation comes from the runtime's memory model and a capability firewall -- not from hoping a kernel namespace holds.
Deny by default, always
A module starts with nothing: no filesystem, no network, no environment, no databases. Every capability it has is one you declared -- a folder, a private database, a cache bucket, a list of hosts it may call. Anything not granted simply does not exist from inside the sandbox.
A firewall between your code and your machine
Every data and network request a module makes crosses a firewall that checks it against the module's declared grants. Denials come back with reasons. Every network attempt and every denial lands in an append-only audit log, so you can answer 'what did this thing actually touch?' with a file, not a guess.
Warm starts measured in microseconds
Containers ship operating systems; virtual hosts ship WebAssembly modules. Compiled code is cached in memory and on disk, so after the first run a new instance is just fresh memory and a fuel budget -- fast enough to spin up per request.
CPU you can meter like a utility
Every instruction a module executes consumes fuel from a budget you set. An infinite loop does not take down a core -- it hits its budget and stops, deterministically. Services can refill fuel per message, so one poisoned request burns itself out, never the service.
Supervision that survives reboots
Services restart on failure with exponential backoff, and 'always' services come back automatically when the daemon itself restarts. Run history, module registry, and desired state all live on disk. Kill the daemon mid-flight and it picks up where it left off.
One definition file for a whole host
A vhost.toml declares your modules, their grants, and their budgets -- the Dockerfile and compose file of this world, in one place. One command brings the whole virtual host up, batch jobs and long-running services alike.
From Module to Running Service
Load
Import a .wasm module into the content-addressed registry under a name. Same bytes under two names are stored once.
Grant
Declare its context: folders, a private database, cache buckets, allowed hosts. That declaration is the entire attack surface.
Run
Start it as a one-shot job or a supervised service with a message inbox. Send it requests, read its live logs, watch its fuel.
Observe
A built-in dashboard, a native macOS app, and a CLI all speak to the same daemon. Every hop between modules is routed and visible.
Traditional Containers vs. Virtual Hosts
What You Get
A complete runtime platform, not a library: daemon, registry, CLI, dashboard, and a native app -- all speaking the same protocol to the same independent service.
Who It's For
Teams running plugins or user-submitted code. Marketplaces, automation platforms, AI-agent tools -- anywhere third-party code must run without being trusted.
Builders drowning in container overhead. When the service is 200 lines of logic, a 400 MB image and a second of cold start is the wrong tax.
AI-agent platforms. Give every agent tool its own sandbox, budget, and audited capability list -- and let agents message each other through a router you can see.
Anyone who has to answer a security review. “Here is the TOML block and here is the audit log” is a very short meeting.
See a Hostile Module Get Stopped, Live
The best demo we can give you is a module that tries to escape: allocate a gigabyte, spin forever, read /etc, call a host it was never granted. You will watch each attempt die inside the sandbox -- with the audit log entry to prove it. Book a call and bring your nastiest workload.