Gantry

Gantry runs OCI images in lightweight Linux microVMs. It is a standalone Go VMM and CLI; Docker, containerd, QEMU, and libkrun are not required.

It uses KVM on Linux, Hypervisor.framework on Apple silicon, and WHPX on Windows.

Gantry is experimental. Linux and Apple silicon macOS are supported. Windows support is experimental.

Watch the HD video · 24-second demo recorded on Linux/KVM.

Install

Download the binary for your host from the latest release.

Linux

# Use amd64 or arm64 as appropriate.
curl -L https://github.com/ejpir/gantry/releases/latest/download/gantry-linux-amd64 -o gantry
chmod +x gantry

macOS (Apple silicon)

curl -L https://github.com/ejpir/gantry/releases/latest/download/gantry-darwin-arm64 -o gantry
chmod +x gantry
xattr -d com.apple.quarantine gantry

Windows (x86-64)

Invoke-WebRequest https://github.com/ejpir/gantry/releases/latest/download/gantry-windows-amd64.exe -OutFile gantry.exe

The first sandbox start downloads and verifies the matching guest kernel, root filesystem, and default image.

Quick start

Run a disposable container in a fresh VM:

./gantry exec -image alpine:latest -- /bin/sh

Create and reuse a named sandbox:

./gantry start dev -image debian:bookworm-slim
./gantry exec dev -- /bin/bash
./gantry stop dev
./gantry resume dev
./gantry delete dev

Or define and reconcile it with strict, versioned YAML:

gantry manifest validate gantry.yaml
gantry apply --check -f gantry.yaml
gantry apply -f gantry.yaml

See Sandbox manifests for the schema and redacted export workflow.

Open the terminal dashboard:

./gantry tui

An experimental native desktop dashboard with read/write controls is also available from source:

cargo run --locked --manifest-path desktop/Cargo.toml -- --demo

See Gantry Desktop for prerequisites and connecting it to a local or remote manager. The desktop build is optional and separate from the Go CLI.

Remote sandboxes and organization policy

A standalone remote manager needs HTTPS and its own bearer token; organization login is not required:

gantry remote add team https://gantry.example.com:8443 --ca manager-ca.pem
gantry image pull alpine:latest -remote team
gantry start dev -image alpine:latest -remote team
gantry exec dev -remote team -- uname -a

See Remote access to configure the manager, TLS trust, SSH, and the dashboard flow.

Apply a signed organization policy when starting a sandbox:

gantry start governed -image alpine:latest \
  -org-policy bundle.tar.gz -org-policy-key public.pem \
  -policy-profile developer

Or sign in with a trusted organization configuration, discover approved remotes, and apply its policy to an existing sandbox:

gantry org login -config organization.json
gantry org remotes example-company
gantry org apply example-company dev

Organization discovery never supplies the separate remote-manager token. A long-running manager can also receive generations of signed policy through an outbound mTLS channel with gantry serve -policy-feed organization-feed.json. Each generation applies to all saved sandboxes, updates running guests live, and is inherited by later manager-created sandboxes. See Organization login and Organization policy.

Highlights

• OCI registry images, layouts, archives, Docker saves, and EROFS images
• Persistent sandboxes with configurable CPU, memory, disk, and runtime
• crun by default, with optional in-VM gVisor (-runtime runsc)
• Host shares, egress policy, proxy routing, traffic inspection, and ports
• Local SSH and an optional in-VM IDE container for VS Code Dev Containers
• In-memory secrets, OAuth custody, and a credential-injecting MCP gateway
• Signed organization policy, mTLS update feeds, and optional OIDC discovery
• Standalone remote sandboxes over an authenticated HTTPS manager
• Terminal dashboard and local HTTP/JSON manager API

See the Gantry manual for usage, configuration, networking, credentials, architecture, and the security model. Run gantry --help for the complete CLI reference.

Platforms

Host	Backend	Status
Linux arm64	KVM	Supported; requires /dev/kvm
Linux x86-64	KVM	Supported; verified on EC2 c5.metal
macOS arm64	Hypervisor.framework	Supported on macOS 13+
Windows x86-64	WHPX	Experimental; verified on EC2 m6i.metal

Startup performance

Measured cold-guest startup to RPC readiness with warm host file caches:

Host	Backend	Configuration	Observed startup
Linux arm64	KVM	1 vCPU, 512 MiB, network off	72.9 ms median CLI-to-ready
macOS arm64	Hypervisor.framework	1 vCPU, 512 MiB, network off	94.1 ms median CLI-to-ready
Linux x86-64	KVM	1 vCPU, 512 MiB, network off	177.8 ms median CLI-to-ready
Windows x86-64	WHPX	1 vCPU, 512 MiB, split VMM worker	approximately 400 ms daemon-to-ready (371–446 ms observed)

Linux and macOS report full CLI latency. The experimental Windows result is a native WHPX daemon-to-ready range. See scripts/bench-boot-scaling.sh and scripts/aws-whpx to reproduce these measurements.

Isolation and limitations

Each sandbox runs in its own VM. The trusted supervisor runs as the user who launched Gantry. In the default auto mode, guest-facing work is split into confined workers where the host supports it:

• Linux uses namespaces, capability removal, Landlock, and seccomp.
• macOS uses role-specific Seatbelt profiles.
• Windows uses one-process Jobs and AppContainers: VMM device emulation and MCP run without network capabilities, while networking uses a separate worker with an exact capability set. A narrow Job-confined broker owns the WHPX partition because WHPX cannot run inside the zero-capability AppContainer.

Workers actively verify their filesystem, network, and process restrictions. Use -process-isolation=required to fail startup unless the full required boundary is established. On Windows, required mode rejects host-loopback access and published ports rather than weakening AppContainer isolation.

Gantry is not yet a hardened boundary for hostile public multi-tenancy. Snapshots and rollback are not supported; use gantry export on a stopped sandbox for a portable OCI archive. Writable layers are mutable and may be attached to only one running VM at a time.

See Security for the complete threat model and platform-specific limits.

Updates

Tagged builds check for stable releases in the background. Update explicitly with:

./gantry update

Release binaries and guest assets are SHA-256 verified. Release artifacts also include Sigstore build provenance.

Build from source

Go 1.26.6 or newer is required.

go install github.com/ejpir/gantry/cmd/gantry@latest

# Or from a checkout:
./scripts/build.sh
./scripts/mkimage.sh alpine:latest artifacts/alpine.erofs
./scripts/mkkernel.sh
go test ./...

Set GANTRY_ARTIFACTS to use an explicit guest-asset directory.

Security

Report vulnerabilities privately as described in SECURITY.md. Do not open public issues for sandbox-boundary vulnerabilities.

Acknowledgements

containerd/nerdbox · gvisor-tap-vsock · go-erofs · go-fuse · gVisor

Gantry is licensed under Apache-2.0. Vendored code in third_party/ retains its original license.