Five crates. None reachesinto another's internals.

The core is a Rust workspace kept deliberately modular: the daemon can change without touching the guest agent, and the guest agent ships as its own static binary, independent of everything that talks to it.

workspace

Five crates, and exactlywhat each one owns.

cratewhat it ownsdepends on

sandkiln-protocolThe wire format shared by host and guest — length-prefixed JSON, kept dependency-light so neither side reaches into the other.nothing

sandkiln-guest-agentRuns inside the microVM as a systemd service. Listens on vsock and answers exec, read, write and list. A static musl binary.protocol

sandkiln-vmmDrives Firecracker directly: boot, snapshot and resume, network leasing, drives, the vsock client. A hand-rolled HTTP client talks to Firecracker's API socket.protocol

sandkiln-storeA small sqlite-backed crate for durable sandbox history — the record of every sandbox that ever existed and how it ended, surviving a daemon restart the live sandbox map never could.nothing

sandkiln-daemonThe axum + tokio HTTP API wrapping the lifecycle — create, exec, list, stop, snapshot, images, drives, pools — with auth, tags and tracing built in from the start.protocol, vmm, store

lifecycle

What actually happensinside a create.

Lease

A tap device and IP are leased from the pool and attached to the bridge — concurrently with the rootfs clone, not after it.

Boot

Firecracker starts; boot-source, drive, machine-config and vsock are configured over its API socket.

Agent up

The guest kernel boots, systemd starts the guest agent, and it binds its vsock port.

Ready

The host's vsock client connects. The sandbox can now run anything you send it.

rationale

Why it's built this way,and what broke before.

The full essays live in the docs, next to the API they explain — four below, and ten more covering everything from SQLite to token-bucket rate limiting underInternals in the sidebar.

Jailer & privilege modelChroot, cgroups, setuid, and a root that stays out of the hot path Wire protocolvsock, a length-prefixed JSON frame, and a client that doesn't reach for a full HTTP stack Snapshot, resume, forkWhy a snapshot points at paths instead of carrying values, and the rootfs bug that taught us that Bug huntThe vsock timeout that could hang a stop forever