protoc matters only when building the Rust core from source.
Prerequisites
Platform and virtualization requirements (common to all SDKs)
Platform support source: the platform table in the repository rootNetwork: the first run of any image pulls it from the registry, so outbound network access is required once per image. Later runs use the local layer cache. Without hardware virtualization the box fails to start — see Troubleshooting below.README.md. macOS arm64 runs without/dev/kvm(it uses Hypervisor.framework).
Language runtime versions
Required only when building from source: protoc
The prebuilt pip / npm packages do not needprotoc. But when you build the Rust core from source (this includes cargo build for the Rust SDK, the C SDK, and the CLI), the build script src/shared/build.rs calls protoc to compile the Protocol Buffers and requires protoc >= 3.12 (for proto3 optional fields).
The repository provides make setup:build, which installs the build dependencies (including protoc) per platform. Run it before building from source.
Quick Example
Python (shortest path, runnable as-is)
Node.js (optional, shortest path)
CLI (no code required)
sh.boxlite.ai is a thin Cloudflare Worker that serves the same install.sh published on every GitHub Release. The long form https://github.com/boxlite-ai/boxlite/releases/latest/download/install.sh is the verifiable upstream, and it is what the gh attestation verify commands below cover. If you want to verify before running, see Verifying the installer and artifacts.
Parameters and Returns
Install artifacts and entry points
Note: the Node package name is@boxlite-ai/boxlite, notboxliteand not@boxlite/sdk. It is pure ESM ("type": "module").
Python optional extras
CLI install methods
Pinning a version and overriding the install directory
The one-line script reads three environment variables. The env-var prefix has to sit on thesh side of the pipe — variables placed before curl only decorate the curl process and never reach the installer.
When you pin a non-latest version, the installer falls back to the remote
.sha256 sidecar in that release for the expected digest. That anchor shares its trust root with the tarball, so for a guarantee independent of the release page, look up the digest in the release’s attested SHA256SUMS and pass it in explicitly:
Verifying the installer and artifacts
Each release publishes raw tarballs (boxlite-cli-vX.Y.Z-<target>.tar.gz), matching .sha256 sidecars, a combined SHA256SUMS, and sigstore-backed build provenance attestations. Verifying these is the recommended path before running anything in production or untrusted environments.
To verify a manually downloaded tarball:
curl … | sh shortcut cannot self-verify, since the script runs as it is piped in. To verify install.sh before running it — it is also covered by SHA256SUMS, an install.sh.sha256 sidecar, and the same sigstore attestation:
Node prebuilt native targets
The native binaries bundled with the npm package coveraarch64-apple-darwin, x86_64-unknown-linux-gnu, and aarch64-unknown-linux-gnu. There is no Windows artifact (use WSL2). playwright-core is an optional peer dependency (used only by BrowserBox).
Troubleshooting
The following collects common errors and platform-specific issues.Linux: KVM unavailable / permission denied
Error: Box fails to start, reporting it cannot access/dev/kvm or Permission denied.
try/except (Python) or try/catch (Node).
macOS: Intel machine or an old system
What you see: Python raisesRuntimeError, Node throws a bare Error, and the C SDK returns UnsupportedEngine (code 19) — or the process segfaults.
- Only Apple Silicon (ARM64) is supported. Intel Macs are not supported.
- macOS 12+ is required. Hypervisor.framework is built into the system, needs no manual setup, and does not require
/dev/kvm.
macOS: the box starts but is immediately denied by the sandbox
On Apple Silicon the box runs under a Seatbelt policy, which can reject a path or operation your image needs. The symptom is a start that fails with asandbox or deny message rather than a virtualization error. See Debug macOS Seatbelt denials for how to read the denial and loosen the policy.
Windows: a direct install does not run
BoxLite has no native Windows artifact. Install inside WSL2 and configure KVM per the Linux steps above (WSL2 requires the user in thekvm group).
Building from source: protoc not found or too old
Error: the build stops, reporting thatprotoc is missing, or that proto3 optional fields fail to compile.
pip install boxlite / npm install @boxlite-ai/boxlite do not invoke protoc; only the cargo build path needs it. When building from source, run make setup:build first to gather dependencies.
Building from source: forgot to init submodules
Error: the build is missing the vendored dependency sources undersrc/deps/ (libkrun, libkrunfw, e2fsprogs, and bubblewrap are all git submodules).
Node: native extension not found / unsupported engine
Error:BoxLite native extension not found or Unsupported engine.
- Confirm Node >= 18:
node --version. - Confirm the platform is on the prebuilt target list (macOS arm64 / Linux x64 / Linux arm64). Intel Mac and native Windows are not supported.
- The package is pure ESM; use
import(or.mjs). CommonJSrequire()fails.
Image pull failure raises RuntimeError (not BoxliteError)
A missing command or an image pull failure raises a standardRuntimeError (Python) / bare Error (Node), not BoxliteError. See Error Handling.
Verifying the install prints an unexpected version
boxlite.__version__ reads importlib.metadata.version("boxlite"), i.e. the actually installed package version. A mismatch usually means an old version is installed in the environment:
Enabling debug logs
Any SDK or the CLI can control the underlying runtime logs withRUST_LOG to diagnose a stalled start or a pull problem:

