Show HN: Era – Open-source local sandbox for AI agents

Just watched this video by ThePrimeagen (https://www.youtube.com/watch?v=efwDZw7l2Nk) about attackers jailbreaking Claude to run cyber attacks. The core issue: AI agents need isolation.

We built ERA to fix this – local microVM-based sandboxing for AI-generated code with hardware-level security. Think containers, but safer. Such attacks wouldn't touch your host if running in ERA.

GitHub: https://github.com/BinSquare/ERA

Quick start: https://github.com/BinSquare/ERA/tree/main/era-agent/tutoria...

Would love your thoughts and feedback!

▲

sschueller 2 hours ago | parent | next [-]

I am a bit confused how I would use this (maybe because I may not be your target audience?).

For example if I am coding with Kilocode and phpstorm. How would I use these microVms and what is the cloudflare worker for? I currently run a regular set of docker containers to run my code, how does this compare?

	▲	binsquare 18 minutes ago \| parent [-]
		Co-builder on this project, To answer your questions :) - How would I use these microVms and what is the cloudflare worker for? This is unlikely the right solution for you, it's more geared towards people building kilocode (because they have an agent that independently writes code + executes that code). The microvm's are for developers running locally wanting to execute untrusted code written by an ai - example is running codex or gemini-cli. Cloudflare workers are for users who want their own "sandbox infra" so they can execute untrusted code written by ai with their production app (not local hopefully)! - I currently run a regular set of docker containers to run my code, how does this compare? Very little difference for your use case unless you expect to do more hostile coding. But I'll try to explain why VM's are different than containers in the security area: Containers are not considered as production-level security boundary. One of the main reason is because containers share the kernel with the host machine running the container. Security penetration engineers do not consider exploiting `some` linux kernels to be high effort because depending on the version, libraries, etc there are CVE's to exploit: https://www.cisa.gov/known-exploited-vulnerabilities-catalog... However, virtual machines are battle tested sandbox tech designed to have strong protection by having host and the VM have individual operating systems AND dedicated virtualized hardware. This is also the main environment you can rent from big providers. Some more info here: https://www.wiz.io/academy/containers-vs-vms So this product is a microVM which combines security of VM's + a layer to make it easy and fast like containers to get the best of both worlds.

▲

0123456789ABCDE 2 hours ago | parent | prev | next [-]

can you include a component diagram overview to give folks a quick idea of "what runs where?" before making the decision to try this out.

you wrote that this is local but what's up with the cloudflare subdir? do we need a cf account to run this?

	▲	binsquare 3 minutes ago \| parent [-]
		Will do! The microvm's are our local solution so devs can use it. But we thought people might to do some production work to not run local stuff - so we added a compatibility layer with cloudflare :D. Good note, didn't even think about that being kind of confusing. No CF account needed to run this!

▲

blutoot 2 hours ago | parent | prev [-]

I hate to speak negatively about someone's hard work but I am genuinely confused as to why this needs to be a separate product/service. Could I not spin up a container or a VM and run my agents in it? What is this sandbox letting the agent do safely that neither the current container or VM solutions are able to offer?

▲

binsquare 7 minutes ago | parent [-]

Co-builder of proj here:

You absolutely can spin up a container or a vm and run your agents in it - but you make trade offs. Containers are easy and fast. Vm's use more resources but are more secure. Most people in production run containers in vm's to get benefits of both!

This is a product that tries to get the best parts of both containers (devX + speed) and vm's (security). The innovation here is using micro-vm's which are really really lightweight and fast to start compared to traditional vm's. Props to libkrun team for creating that: https://github.com/containers/libkrun

	▲	imiric a minute ago \| parent [-]
		Alright, but why couldn't I use `krunvm` directly then? What does your wrapper provide that I can't easily do already? Is it essentially a set of "recipes" and "skills"?