forkd : the Rust project that forks AI agent micro-VMs in 100 ms — agent sandboxing rethought

forkd : the Rust project that forks AI agent micro-VMs in 100 ms — agent sandboxing rethought

🔎 AI agent sandboxing had just found its missing link

The problem is well known: Docker is too heavy for agent loops, and process isolation is too permissive. Between the two, something was missing. In August 2026, a developer publishes forkd on GitHub, and the project explodes within AI engineering circles. The concept? Forking entire micro-VMs in sub-milliseconds thanks to Linux's memory copy-on-write, all packaged into a Rust binary of just a few megabytes.

The reason it's taking off now: code agents have moved from the demo stage to production. They execute code, modify files, spawn processes. Without real isolation, it's a security disaster. With classic containers, it's a performance disaster. forkd arrives at the exact moment the industry realizes that sandboxing is the number one bottleneck for deploying agents at scale.

The essentials

• forkd is an open-source Rust runtime that forks KVM micro-VMs (based on Firecracker) in ~0.8 ms per instance, with only ~265 KB of memory per fork.
• The mechanism relies on a MAP_PRIVATE mapping that delegates copy-on-write to the Linux kernel: no page copying, no heavy serialization.
• Two key operations: fork() to clone a snapshot into a child micro-VM, and branch() to pause a running VM, snapshot its state on the fly, and resume from that point.
• The project is described as an "e2b killer" by the community, directly targeting proprietary sandboxing platforms.

Recommended tools

The architecture of forkd — from snapshot to fork in a single system call

The fundamental idea behind forkd is simple: why recreate a VM from scratch at each iteration of an agent, when you can clone the state of an existing VM in a single system call?

Everything starts with an initial snapshot. A Firecracker micro-VM is started for the first time, its environment is prepared (dependencies, files, filesystem state), and then its state is serialized. As explained in the article from builders.cortex.io, this serialization captures the vCPU state, KVM structures, and the state of emulated devices in a compact file.

Once this snapshot is in memory, the magic happens. forkd uses a MAP_PRIVATE mapping on the snapshot's memory, which automatically gives the Linux kernel copy-on-write pages. As detailed in the discussion on Hacker News (47412569), this is the same mechanism as the classic Unix fork(), but applied to an entire VM.

Each child created via fork() initially shares 100% of its memory pages with the parent. Only modified pages are copied, on demand. The post Reddit r/SideProject reports that each fork creates a new KVM VM by mapping the snapshot memory in CoW, all in ~0.8 ms.

The memory consumption is the real shocking figure: ~265 KB per child sandbox. Not 265 MB. 265 kilobytes. This is what makes it possible to fork 100 children in ~100 ms without blowing up the server's RAM.

fork() vs branch() — the two primitives of forkd

forkd exposes two distinct operations, and the difference between the two is crucial to understanding the use cases.

fork() — cloning a cold snapshot

fork() takes an existing snapshot and creates a child micro-VM that starts from this state. It is the fastest operation: ~0.8 ms per clone. The child is an independent copy that can execute code, modify files, crash — the parent is not affected.

The typical use case: a code agent that needs to test 50 variants of a fix in parallel. We prepare a snapshot with the cloned repo and installed dependencies, then fork 50 children. Each one executes its variant. Results are collected, children are destroyed. Total: a few tens of milliseconds.

branch() — snapshotting a VM in flight

branch() is more subtle. It takes a running VM, pauses it, snapshots its in-flight state (running processes, open files, active network connections), then resumes a new VM from this exact point. Reported time: ~150 ms.

This is the operation that interests developers of iterative agents the most. Imagine a code agent like Grok Build, xAI's first coding CLI agent: the agent has already spent 30 seconds installing dependencies and indexing a codebase. Rather than starting from scratch for each fix attempt, we branch from the current state.

The parallel with Addy Osmani's Agent Skills framework is interesting: agent workflows require save and restore points. branch() provides this primitive at the infrastructure level, not at the application level.

Why Docker Is No Longer Enough for AI Agents

A container is isolation via cgroups + namespaces. It works well for deploying microservices. But for code agents, it falls short on three points.

First, startup time. A cold Docker container takes 200 ms to 2 seconds depending on the image size. When an agent like Prime Agent iterates dozens of times per minute, this cost becomes prohibitive. forkd starts a child in 0.8 ms — that's 250 to 2500 times faster.

Second, the attack surface. A container shares the kernel with the host. A malicious agent or a prompt injection can exploit kernel vulnerabilities to escape. A KVM micro-VM, even a lightweight one, has its own virtual kernel. The isolation is hardware-based, not software-based. The northflank guide on agent sandboxing reminds us of this: for running untrusted code, micro-VMs offer a level of security that containers cannot match.

Third, density. 100 Docker containers with development images easily weigh several gigabytes of memory. 100 forkd forks weigh ~26 MB (100 × 265 KB). Emir's Blog article "Your Container Is Not a Sandbox" provides a comprehensive overview of this argument: the shared VVM ecosystem in Rust allows for optimizations that the OCI (Docker/containerd) ecosystem does not allow by design.

The agent VM trend — forkd is not an isolated case

forkd is not the only project in this space. It is part of a broader movement that manveerc's guide on Substack calls the "agent VM era" — the shift from container to micro-VM as the unit of compute for AI agents.

Multikernel with its Sandlock project pushes things even further: 1000 sandboxes in 718 ms with a process-level CoW fork as a first-class API. Their approach is complementary: where forkd forks at the KVM VM level, Sandlock forks at the process level with enhanced isolation.

rust-nano-vm adopts a different strategy: a single Rust binary with a ~12 ms cold start and ~0.5 MiB per fork. Slower than forkd on the fork, but simpler to deploy since there is no dependency on Firecracker.

The awesome-agent-sandbox list actually tracks dozens of solutions in this category: micro-VMs, containers with enhanced isolation (gVisor), specialized isolation harnesses. The common denominator: they all target the same problem that forkd solves with a particular elegance.

What sets forkd apart in this landscape is the combination of MAP_PRIVATE mapping (zero page copies) with Firecracker (proven KVM isolation) in a self-sufficient Rust binary. It's the right compromise at the right time.

Concrete use cases — when forkd changes the game

Parallel fleets of code agents

When a tool like Orca, l'IDE qui pilote une flotte d'agents en parallèle launches 10 agents on 10 different files, each agent needs its own isolated environment. With forkd, we prepare a snapshot with the codebase, fork 10 children in ~8 ms, and each agent works in its dedicated VM. If an agent does whatever it wants (infinite loop, file deletion), the others are not impacted.

Sub-agent delegation

The architecture of délégation de tâches avec sous-agents dans Hermes Agent #14 assumes that each sub-agent executes in an isolated environment that is consistent with that of the parent. forkd provides exactly that: a sub-agent is a fork of the parent snapshot, with the same filesystem and the same state, but unable to affect the other sub-agents.

Agent-driven CI/CD pipelines

An agent equipped with GPT-5.3 Codex (OpenAI) — an agentic score of 80 on the reference benchmark — generates a patch, tests it in a fork, observes the result, and iterates. Each iteration costs less than a millisecond of setup time. A pipeline that used to take 5 minutes drops to 30 seconds, almost all of which is the actual test execution time.

Integration with agentic LLMs — which model to drive in a fork?

Sandboxing performance doesn't matter if the model driving the agent is unable to produce correct code. The forkd + good LLM combination is what makes the architecture viable in production.

For agents that iterate intensively (edit-test-fix loop), a fast model like Claude Sonnet 4.6 (Anthropic, score 81.4) is a good speed/quality trade-off. Each iteration is fast, the cost per turn is moderate, and the code quality is sufficient for the majority of tasks.

For more complex reasoning tasks where the number of iterations is low but each iteration must be relevant, GPT-5.5 (OpenAI, score 98.2) or Gemini 3 Pro Deep Think (Google, score 95.4) are more suitable. You fork less often, but each fork executes higher-quality code.

For full self-hosting — the ultimate combo — Kimi K2.6 Moonshot AI (score 88.1, self-host) or GLM-5 Reasoning from Z.AI (score 82, self-host) allow you to keep everything local: the LLM, the agent runtime, and the forkd sandboxes. This is the architecture targeted by teams that want an open source AI agent with Ollama locally.

The key point: forkd is model-agnostic. It sandboxes execution, not reasoning. But the model's quality determines the number of forks required, and therefore the real benefit of forkd's speed.

Detailed performance — the numbers that matter

The data published by the project and the community make it possible to build a clear comparison table.

Source: data compiled from GitHub/deeplethe/forkd, Reddit r/SideProject, northflank, and rust-nano-vm.

The most significant figure is the memory ratio. 265 KB per instance means that a server with 8 GB of RAM can theoretically host ~30,000 simultaneous sandboxes. In practice, with the KVM overhead and modified pages, we are talking more like 5,000 to 10,000. This is nevertheless an order of magnitude above containers.

Technical limits and trade-offs — forkd is not magic

KVM isolation comes with a CPU cost. Each forked VM has its own virtual vCPU, even if the Linux scheduler handles this efficiently. For workloads where the agent runs CPU-intensive code (compilation, computation), the overhead compared to a native process is measurable — typically 5 to 15% depending on the benchmark.

The CoW filesystem also has its limits. Writes are isolated per instance, but reading remains shared via the snapshot. If an agent massively modifies the filesystem (full npm install, dependency compilation), CoW pages multiply and memory consumption explodes. forkd is optimized for workloads where the fork is short and modifications are targeted — exactly the pattern of a code agent that edits a file and then runs a test.

Networking is another point of attention. Firecracker supports networking via TAP devices, but configuring networking for 100 forked VMs in parallel requires specific network infrastructure. Most forkd deployments for code agents use minimal networking (localhost only) or no networking at all, which is sufficient for unit tests but not for integrations that call external APIs.

Finally, forkd is a young project. The ecosystem around créer un agent IA is mature, but integrating forkd into existing frameworks requires glue code work. It is not a SaaS product with a REST API and a dashboard — it is a runtime that you have to integrate yourself.

forkd vs proprietary sandboxing platforms

The post by Threads/@simplifyinai describes forkd as an "e2b killer". It's a fair comparison on a technical level, but the two don't target exactly the same audience.

e2b (and similar platforms like Modal, E2B, Daytona) offer a managed service: no need to manage the KVM infrastructure, networking, or VM garbage collection. You call an API, you get a sandbox. The price is the loss of control and the recurring cost.

forkd is self-hosted. You control the infrastructure, you pay for the server (a VPS at Hostinger for a few euros a month is enough for testing), and you have no API call limits. In return, you manage the hypervisor security, monitoring, and resilience yourself.

For teams looking to understand how to choose the best LLMs for AI agents, the logic is the same: either you pay for convenience (proprietary API), or you self-host for control (forkd + local model). forkd firmly falls into the second category.

How forkd integrates into a complete agent stack

A modern agent stack with forkd looks like this:

1. Orchestrator: an agent framework that breaks down the task, decides when to fork, and collects the results. The meilleurs-agents-ia integrate this orchestration pattern.
2. LLM: the model that generates the code and commands to execute in each fork. Hosted via API or locally.
3. forkd: the sandboxing runtime that forks micro-VMs, isolates execution, and returns the results (stdout, stderr, modified files).
4. Snapshot manager: the layer that manages the initial snapshots, updates them (for example, after a successful npm install that you want to make available for all subsequent forks), and cleans up terminated children.

The key integration point is the interface between the orchestrator and forkd. The orchestrator must know when to fork (before a risky execution), when to branch (to save an intermediate state that is expensive to rebuild), and when to destroy the children (as soon as the result is collected).

This is where the Agent Skills framework becomes relevant: by standardizing the workflows of coding agents, it creates natural insertion points for primitives like fork() and branch(). A "test variant" workflow becomes a fork() + execution + collection + destroy call.

❌ Common mistakes

Mistake 1: Confusing VM fork with process fork

forkd does not perform a classic Unix fork(). It clones a complete KVM virtual machine with its own virtual address space. Isolation is at the hardware level, not the process level. Using forkd as if it were a simple multiprocessor is a mistake that leads to unnecessarily complex architectures for tasks that do not require KVM isolation.

Mistake 2: Forking from a snapshot that is too large

If the initial snapshot contains an entire development environment with Node.js, Python, hundreds of packages, and gigabytes of data, the benefit of CoW collapses. The fork time remains low (~0.8 ms), but as soon as the children start touching different pages, memory explodes. Best practice: minimal snapshots, progressively augmented via branch().

Mistake 3: Ignoring the cost of the first snapshot

forkd is ultra-fast to fork from an existing snapshot. But creating that initial snapshot takes time: starting the VM, installing dependencies, serializing the state. If your workflow forks a different snapshot on every call (instead of reusing the same one), you lose all the benefit. The correct pattern is "create once, fork N times".

Mistake 4: Neglecting child cleanup

A fork consumes at least 265 KB, but this figure increases as soon as the child writes. Hundreds of undestroyed forks can saturate RAM without you noticing immediately. A simple garbage collector (timeout or active fork counter) is essential in production.

❓ Frequently Asked Questions

Does forkd replace Docker for agent deployment?

No. forkd specializes in the rapid forking of micro-VMs for short, isolated executions. Docker remains suited for deploying long-running services. The two can coexist: Docker for infrastructure, forkd for agent sandboxes.

Can forkd be used with a local LLM?

Yes. forkd is LLM-agnostic. You can combine it with a self-hosted model like Kimi K2.6 or GLM-5 via Ollama for a 100% local stack. The agent calls the local LLM, then sends the generated commands to forkd for isolated execution.

What is the difference with e2b?

e2b is a managed sandbox service with a REST API, billed on a pay-as-you-go basis. forkd is a self-hosted open-source runtime based on Firecracker with CoW forking. forkd is faster at forking (~0.8 ms vs ~100 ms for a new e2b sandbox) but requires you to manage the infrastructure yourself.

Is branch() safe for sensitive data?

branch() snapshots the complete state of the VM on the fly, including memory. If the snapshot contains secrets (API keys, tokens), they are present in the snapshot file. You must encrypt snapshots or ensure that no secrets are loaded into memory before the branch.

How many forks can be made in parallel?

Theoretically, the limit is the available RAM (265 KB per fork at a minimum) and the number of vCPUs the Linux scheduler can handle. In practice, benchmarks show 100 forks in ~100 ms. Beyond a few thousand, KVM overhead becomes the limiting factor.

✅ Conclusion

forkd solves a specific problem that the AI agent industry was only just beginning to formally identify: the need for sandboxing that is as fast as a process fork but as secure as a VM. By using the Linux kernel's copy-on-write applied to KVM micro-VMs, the project reaches a sweet spot that changes the math of deploying code agents. If you are building autonomous AI agents that execute code in a loop, forkd deserves a place in your stack.