Skip to main content
Import note: SecurityOptions is exported at the top level; AdvancedBoxOptions lives in the boxlite.boxlite submodule.
Two independent lines of defense separate guest from host: a hardware-level microVM and a process-level jailer. Defaults differ by layer: the Rust runtime applies a full jailer when you pass no SecurityOptions at all, but constructing SecurityOptions() in Python with no fields turns every switch off. For untrusted code, always pass SecurityOptions.standard() or .maximum() rather than relying on any default.

​
The Isolation Model: two independent lines of defense

BoxLite uses defense in depth: even if one layer is breached, the others still hold. BoxLite isolation boundaries: a trusted host process spawns a jailed shim process, which runs the microVM containing the guest agent and untrusted code

​
Line of defense one: hardware virtualization (the microVM)

Each box is a separate lightweight virtual machine, with the guest kernel physically isolated from the host kernel.
Limitation: a vulnerability in the hypervisor itself could in theory let the guest escape — which is exactly why a second line of defense is needed.

​
Line of defense two: the process-level jailer (constraining the shim process)

Even if the guest escapes the VM, it lands in a jailer-constrained shim process, not on the bare host. The jailer enables different mechanisms per platform:
macOS isolation is weaker than Linux: no privilege drop, no cgroups, no network namespace. For running untrusted code in production, prefer Linux. To debug macOS sandbox errors, see macos-sandbox-debugging.

​
What each switch turns off

SecurityOptions fields map onto the two lines of defense above. For the types, defaults, presets, and how to attach them to a box, see Inject secrets and harden a box. Errors you hit while configuring these — the AdvancedBoxOptions import, the top-level security= keyword, the absent minimum() preset — are answered on Inject secrets and harden a box.