Start with one box. Raise it.

Tiny Linux microVMs that start in about a second, on a host you own. Create one over SSH; it gets its own HTTPS address behind your team's login.

Install on your host Read the code on GitHub

“Ready” means the VM's SSH server answers, timed by boxe from the moment the command arrives. On our test host that takes 0.7 to 1.0 s; with a cold cache or a busy host, up to 2.5 s.

$ ssh boxe newquick-fox ready in 0.8 s   ssh quick-fox.boxe   IP 10.42.0.17, 2 CPU, 2G RAM

A whole machine per command

Fork it, memory and all

The copy keeps the programs that were running.

Share one port

A link for anyone, no login. unshare ends it.

A full Linux machine

Ubuntu with sudo, Docker and a disk that stays. Not a container: its own kernel, in its own microVM.

Its own HTTPS address

Port 8000 at quick-fox.boxe.example.com, any port from 3000 to 9999 at quick-fox--3000…. Your team logs in first.

A coding agent in every VM

Shelley, with your own model keys. Set them up once in one VM, then copy it with a task: the copy starts working on it.

Sleep, if you turn it on

An unused VM saves its memory to disk and frees its RAM. The next SSH or web request wakes it where it was, in about half a second.

A desktop with Chrome

In your browser, for the owner only. Agents can use it while you watch.

Gone when you are done

Give a VM a time to live and it deletes itself.

Everything is ssh

Nothing to install on your computer: the SSH keys you already have on GitHub let you in, and every answer is plain text.

Example output. Times are from our test host and vary.

$ ssh boxe new
quick-fox ready in 0.8 s

  ssh quick-fox.boxe

  IP 10.42.0.17, 2 CPU, 2G RAM

$ ssh quick-fox.boxe

You are on quick-fox. The disk is persistent. You have 'sudo'.

Port 8000 is at https://quick-fox.boxe.example.com (team login),
ports 3000-9999 at https://quick-fox--<port>.boxe.example.com.
Shelley, the agent, is at https://quick-fox--agent.boxe.example.com (yours only),
a desktop with a browser at https://quick-fox--desktop.boxe.example.com (DISPLAY=:1).
Docker works: docker run --rm alpine echo hello
Manage your VMs from your computer: ssh boxe help

exedev@quick-fox:~$

$ ssh boxe ls
NAME        IP          CPU  RAM  STATE     CPU%  RAM USED  DISK USED  OWNER  CREATED           EXPIRES   IMAGE
quick-fox   10.42.0.17  2    2G   running   4%    618M      1.4G       ada    2026-10-30 09:12  -         boxeuntu-20261029
calm-otter  10.42.0.9   2    4G   sleeping  -     -         3.2G       ada    2026-10-29 17:40  in 5h12m  laravel-20261029

$ ssh boxe fork quick-fox quick-fox-2
quick-fox-2 ready in 1.1 s

  ssh quick-fox-2.boxe

  IP 10.42.0.18, 2 CPU, 2G RAM

# Same memory, same running programs. New name, keys, MAC and IP.

$ ssh boxe share quick-fox 3000
Anyone with this link sees port 3000 of quick-fox, without logging in (ssh boxe unshare quick-fox to stop it):

  https://quick-fox--3000.boxe.example.com/__boxe/share/kZ3vQ8rT1mXwP0aLcY7nBg

$ ssh boxe sleep quick-fox
quick-fox is asleep: it wakes up when you connect to it

$ ssh quick-fox.boxe
# About half a second later you are back where you left it.

# base: a VM where you set up Shelley's models once
$ ssh boxe "cp base task1 --agent fix the login bug, don't touch the API"
task1 ready in 0.9 s

  ssh task1.boxe

  IP 10.42.0.21, 2 CPU, 2G RAM

  Agent at work: https://task1--agent.boxe.example.com/c/fix-the-login-bug

How it works

vm: quick-fox
disk: none yet
process: none yet
state: requested

First, one Go daemon takes the command.

boxed is the SSH server, the VM manager and the web front end, with its state in SQLite.

vm: quick-fox
disk: zfs clone of the base image
process: none yet
state: disk ready

Then ZFS clones a disk, instantly.

Name, SSH keys and host certificate travel on a small read-only second disk. The host never mounts the VM's disk.

vm: quick-fox
disk: zfs clone of the base image
process: cloud-hypervisor, unprivileged
state: booting

Then Cloud Hypervisor boots it.

The kernel starts directly, with no firmware and no bootloader, in its own sandboxed process with no capabilities.

vm: quick-fox
disk: zfs clone of the base image
process: cloud-hypervisor, unprivileged
state: running · 0.8 s

Then it answers on SSH and HTTPS.

SSH goes through boxed as a jump host. HTTPS comes from your TLS proxy to boxed, which logs people in with OIDC.

The VM commands

Run them as ssh boxe <command>, or type ssh boxe alone for a prompt where tab completes commands and your VM names. VM commands support --json, for output a program can read. Put --agent and a prompt last on cp, fork or new to hand the new VM a task; the agent needs models, so copy a VM where you set them up in Shelley.

Once per computer, so ssh <vm>.boxe works and you trust every VM with one CA entry:

ssh boxe ssh-config >> ~/.ssh/config
ssh boxe known-hosts >> ~/.ssh/known_hosts

Commands of ssh boxe
`new [name]`	Create a VM. Options: `--cpu 2 --mem 2G --ttl 2h --image <name>`
`cp <name> [new-name]`	Copy a VM, even a running one
`fork <name> [new-name]`	Copy a running VM with its memory
`images`	The images new VMs can start from
`ls [-a]`	Your VMs and what they use (`-a`: everyone's)
`restart <name>`	Power a VM off and on again
`ttl <name> <2h\|3d\|off>`	Delete a VM by itself after a while
`rm <name>`	Delete a VM
`sleep <name>`	Put a VM to sleep now (if the host has sleep on)
`wake <name>`	Wake a VM up (connecting does too)
`keep-awake <name> on\|off`	Never put this VM to sleep
`share <name> [port]`	A link to the VM for anyone (port 8000)
`unshare <name>`	Make the VM's links stop working

Runs on one Linux host

One machine with KVM and ZFS runs the whole thing. Bare metal is simplest and fastest, for example a Hetzner dedicated server. We test on Ubuntu 26.04 inside a Proxmox VM with nested virtualization. Cloud VMs work only where nested virtualization is offered: GCP, Azure, AWS C8i, M8i and R8i.

/dev/kvm and a ZFS pool
Cloud Hypervisor v54 or later
A guest kernel from cloud-hypervisor/linux
Docker, to build the image
nftables and iptables
For the web: an OIDC provider, a wildcard DNS record and certificate, a TLS proxy such as Caddy
Optional: Tailscale for ssh boxe on your tailnet, restic for nightly backups

Make the pool

Replace /dev/... with your disk, and keep boxe/sleep for sleep and fork.

zpool create boxe /dev/...
zfs create boxe/vms
zfs create boxe/images
zfs create boxe/sleep

Build the base image

exe.dev's exeuntu with a thin layer of ours. Tag it with today's date, here 20261030.
```
docker build -t boxeuntu:20261030 image/
sudo scripts/build-base.sh boxeuntu:20261030 boxeuntu-20261030
```
Set up the host

An unprivileged boxe-vm user, the network script, the team's GitHub usernames in /etc/boxe/users, the systemd units and /etc/boxe/boxed.env, with -base boxe/images/boxeuntu-20261030@base.

Sleep and fork are off until you set -sleep-dir /boxe/sleep; add -sleep-after 30m to put unused VMs to sleep.
Deploy

From your computer, with your host's SSH address in place of me@my-host: it builds boxed, installs it as a new version and rolls back if it does not come up.
```
scripts/deploy.sh me@my-host
```

Every step, with the settings and the backups: the install guide in the README

Made for one team, on one host

A VM reaches the internet. It cannot reach:

other VMs
the host
private networks
the tailnet
cloud metadata

VMs are untrusted

Each runs in its own Cloud Hypervisor process, as an unprivileged user with no capabilities, memory and CPU limits, and only its own disks. Each may send only with its own MAC and IP.

Members trust each other on the web

Any logged-in member can open any VM over HTTPS, and apps get the member's email in X-Box-Email, a header they can trust. Share-link visitors are anonymous: no header. Apps still need CSRF protection against other VMs' pages. SSH, the agent and the desktop are for the VM's owner only.

The rest is yours

You secure the identity provider and the TLS proxy. One host, no high availability, not a multi-tenant cloud.

Read the security model

Open source, Apache 2.0

A small internal tool, made public. Read it, run it, change it.

git clone https://github.com/16bitsrl/boxe

boxe is a self-hosted take on exe.dev. Its base image builds on exeuntu and ships Shelley, both by Bold Software under the Apache License 2.0. The desktop is KasmVNC (GPL 2.0); the VMs run on Cloud Hypervisor.