A3S Box
  • English

      • Platform matrix

      An implemented API is not a production guarantee for every host. Admission depends on the operating system, architecture, virtualization backend, and requested isolation class.

      Host execution paths

      PathCurrent statusBoundary
      Linux MicroVMPrimary local runtimeRequires KVM and libkrun; Linux/KVM has the broadest feature surface
      macOS MicroVMImplemented and build-checkedApple Silicon and Hypervisor.framework only; Intel macOS is unsupported
      Windows MicroVMImplemented and real-host soak validatedx86_64 WHPX, exactly one vCPU, with the limitations below
      Linux SandboxPreview and real-runtime CI validatedCertified Linux hosts only; shares the host kernel
      KubernetesPreviewLinux CRI v1 server and containerd runtime-v2 shim; full conformance is not claimed
      TEEHost-specificSEV-SNP-oriented workflows; simulation is not hardware security evidence

      Run this on every target host before scheduling a workload:

      a3s-box info

      Isolation comparison

      ContractDefault MicroVMExplicit Sandbox
      SelectionOmit --isolation--isolation sandbox
      Runtime boundaryDedicated guest Linux kernelShared host Linux kernel
      Intended trustUntrusted workloads and stronger tenant boundariesTrusted or semi-trusted tools and automation
      Required hostLinux/KVM, Apple Silicon/HVF, or Windows/WHPXCertified Linux with namespaces, seccomp, subordinate IDs, and delegated cgroup v2
      Bridge networks and static published portsSupported within host limitsRejected; use explicit loopback forwarding
      TEE, warm pool, snapshot-forkAvailable only on qualifying hostsRejected
      Automatic fallbackNeverNever

      An explicit --isolation microvm value is rejected. Omission is the public default, which prevents scripts from treating backend labels as interchangeable compatibility modes.

      Windows WHPX limits

      CapabilityWindows
      Linux OCI pull and runSupported
      Foreground and detached lifecycleSupported
      Logs, inspect, stats, and read-only attachSupported
      Published TCP portsSupported
      Bind mounts, named volumes, stopped-box commit and filesystem snapshotsSupported
      vCPUsExactly one
      Container health checksNot supported
      Bridge networks and Compose service networkingNot supported
      Interactive PTY and post-boot execNot supported
      Memory snapshot-fork, TEE, and CRINot supported

      Follow the Windows WHPX guide before first use.

      Evidence levels

      Different checks prove different things:

      • Unit and fixture tests prove deterministic logic and protocol behavior.
      • Hosted compilation proves that a supported target builds.
      • A real-host smoke test proves the observed workload on that host and backend.
      • A soak test adds repeated lifecycle and cleanup evidence.
      • Simulated TEE flow never proves hardware-backed confidentiality.

      Record the host, architecture, backend, image digest, runtime version, and evidence bundle for release qualification. A green hosted build does not prove a KVM, HVF, WHPX, or TEE boot unless that hardware path actually ran.

      For detailed release gates, see Host integration and the soak test plan.