ignite — dami.projects

Overview

Ignite is an ultra-secure microVM sandboxing framework for JS/TS services, AI-generated code, and untrusted scripts.

Rather than relying on traditional containers, Ignite runs JavaScript/TypeScript code inside hardware-virtualized microVMs. It supports native Firecracker on Linux and Apple’s Virtualization.framework on macOS out of the box, with zero external VM dependencies.

It is designed for systems that execute code you do not fully trust:

AI agent generated code
Plugin or extension ecosystems
User submissions and sandboxed automation
Security-sensitive CI checks

Key Features

Dual-Hypervisor Core — Uses KVM-backed Firecracker on Linux, and native Virtualization.framework on macOS.
Host-Reliant Disk Mounts — The guest microVM has no shell, utilities, or libraries. Service code and language runtimes (Bun, Node, Deno, QuickJS) are compiled on the host and attached as read-only virtual block devices (/dev/vdb and /dev/vdc).
VSOCK Multiplexing — Low-latency communication handshakes stream stdout/stderr and exit codes directly back to the host via virtual sockets, bypassing network interfaces.
Preflight & Metric Timelines — Sub-millisecond logging of all VM lifecycle transitions (disk format, boot connect, execution, cleanup).

Runtime Support

Runtime	Supported Versions	Default
Bun	1.0, 1.1, 1.2, 1.3	1.3
Node	18, 20, 22	20
Deno	1.40, 1.41, 1.42, 2.0	2.0
QuickJS	2024-01-13, 2023-12-09, latest	latest

Getting Started

Prerequisites

Linux — KVM enabled (/dev/kvm accessible) and e2fsprogs installed.
macOS — macOS 13 or later.

Build and Install

git clone https://github.com/dev-dami/ignite.git
cd ignite
cargo build --release

Release binaries are compiled under target/release/ignite-cli and can be installed as ignite.

Running a Service

Initialize a new service:
```
ignite init hello-world
cd hello-world
```
Run the VM sandbox:
```
ignite run .
```
Run with verbose trace timelines of startup transitions:
```
ignite run . --verbose
```