What is a vpod?
Avpod is a lightweight, portable sandbox that gives an untrusted process an instant Linux environment. It uses a RISC‑V architecture and runs entirely inside WebAssembly.
Fast startup
A vpod boots from a snapshot — a saved state with libraries already installed — in under a second.
Portable
The entire machine is a WASM component, so it runs on any OS and architecture, including CI pipelines and containers where virtualization isn’t available.
Isolated
CPU, memory and filesystem live entirely inside the sandbox. The host is only reachable through access you explicitly grant.
How it works
Avpod runs a RISC‑V virtual machine compiled to WebAssembly, implementing the RV64GC specification. When you start a vpod, it boots from a snapshot, a saved state, in under a second.
Pure instruction-by-instruction emulation is slow, and WebAssembly rules out a runtime JIT. So at snapshot build time, the hottest guest code paths are translated ahead of time from RISC‑V into native code that gets compiled into the WASM module itself. Translated code goes through the same MMU and memory checks as emulated code, so isolation is unchanged; CPU-bound work runs roughly 5× faster than pure emulation.
The WASM component communicates with the host through WASI 0.2, providing controlled access to filesystem, networking, and standard I/O while keeping all execution state (CPU registers, memory, filesystem) isolated inside the sandbox.
RV64GC specification
G — general-purpose extensions
C — compressed instructions
Reduces code size by 30%, improving instruction fetch speed and memory efficiency. This matters when running a full Linux userspace inside a memory-constrained WASM environment.
The V (vector) extension is not implemented. RVV instructions would execute as emulated RISC-V; there is no SIMD passthrough to the host CPU. Adding V would increase emulation overhead without any performance benefit for vectorized workloads.
Next steps
Quickstart
Install the CLI or either SDK and boot your first sandbox.
Python SDK
Run commands and Python code in an isolated sandbox from your own code.
TypeScript SDK
The same sandbox from Node, or from a browser tab with no server at all.