Forkd

forkd is a microVM sandbox runtime for AI agent fan-out. A parent VM boots once, imports a runtime — Python with its dependencies, a JIT-warmed JVM, an already-loaded ML model — and is paused to disk. Each child is a separate Firecracker process that maps the parent's memory image with MAP_PRIVATE, so the kernel applies copy-on-write per page and children share the parent's resident memory until they diverge. The result is per-child KVM isolation with a spawn cost closer to fork(2) than to a cold-booted VM.

BRANCH pauses a running sandbox, snapshots its in-flight state, and resumes it in about 150 ms, so an agent can fork mid-task rather than only at warm-up. The v0.4 live mode shortens the source pause to 56 ms p50 / 64 ms p90 on a 1.5 GiB source, and with wait: false the caller returns in about 70 ms while the memory copy completes in the background; it requires Linux 5.7 or later, vm.unprivilegeduserfaultfd=1, and a vendored Firecracker fork. v0.5 adds diff-snapshot chains: each layer records a parenttag and content-hash edge to the layer below, the daemon assembles the memory image at spawn time, and snapshot-info, rmi --cascade, snapshot-compact, and pack/unpack manage the chain.

Spawning 100 sandboxes that each run import numpy; numpy.zeros(5).tolist() on one host (Ubuntu 24.04, Linux 6.14, 20 vCPU, KVM):

Backend	Wall-clock at N=100	Memory delta per sandbox
forkd (fork-from-warm)	101 ms	0.12 MiB
CubeSandbox (cold-boot, pool fast path)	1.06 s	5 MiB
Firecracker cold-boot	759 ms	84 MiB
BoxLite	113.2 s	—
OpenSandbox (Docker runtime)	122.0 s	—
gVisor (runsc)	288.6 s	—
Docker (runc)	335.3 s	4 MiB

The forkd row measures fork-from-warm while the other rows measure cold start, which the project notes are different operating points. Each child runs a full Linux kernel with multiple vCPUs, TCP networking, apt package management, and outbound HTTPS, inside its own network namespace and cgroup v2 memory limit with /dev/urandom re-seeded via vmgenid. A daemon owns state and exposes a REST API over Unix or TCP with bearer-token auth and rustls, Prometheus /metrics, an append-only JSON audit log, and a systemd unit; a Kubernetes manifest hosts N children in one Pod.

Clients reach the daemon over REST, a Python SDK whose Sandbox is a drop-in for E2B's, a TypeScript SDK, or an MCP server (forkd-mcp) for Claude Desktop, Claude Code, Cursor, and Cline; LangGraph, AutoGen, and CrewAI use the Python SDK directly. Snapshot packs are pulled from a hub or built from a Docker image with forkd from-image, forkd doctor runs 17 host checks, and forkd bench reports spawn, exec, branch, and fan-out latency on your hardware. It runs on x86_64 Linux with KVM and ships a fixed guest kernel (vmlinux-6.1.141).

Features

• Copy-on-write fork: children mmap a warmed parent snapshot instead of booting their own kernel
• Live BRANCH: snapshot a running sandbox mid-task with a sub-100 ms source pause and optional background copy
• Diff-snapshot chains: stacked layers such as +numpy, +pandas with parent hashes verified at spawn
• Hardware isolation: one Firecracker microVM backed by KVM per child
• Multi-tenant limits: per-child network namespace, cgroup v2 memory cap, and independent random seeding
• Daemon and API: REST with bearer auth, Prometheus metrics, JSON audit log, systemd and Kubernetes packaging
• SDKs: Python (E2B-compatible Sandbox), TypeScript, and an MCP server
• Snapshot hub: forkd pull fetches sha256-verified packs; forkd from-image builds one from a Docker image
• Host diagnostics: forkd doctor probes KVM, cgroup v2, networking, Firecracker version, and the live-fork prerequisites
• Recipes: LangGraph branch-and-fan-out, coding-agent fork, E2B code interpreter, and fork-per-test Postgres fixtures