Tarit

Tarit

**A KVM microVM platform for AI agents and isolated execution.**

Tarit is a microVM platform for secure, fast, ephemeral sandboxes, built for AI agent workloads. It boots a real hardware-virtualized VM in milliseconds, runs a task inside it, and tears it down. Each sandbox has a guest kernel rather than sharing the host kernel; production containment also depends on the host-side controls described in [SECURITY.md](SECURITY.md). Jailed orchestrated VMMs support dedicated PID and process network namespaces; the host-owned TAP queue is passed by descriptor so host routing and traffic policy remain outside the VMM namespace.

It has two parts, developed together in this monorepo:

• vmm/ - the Tarit VMM, a minimal rust-vmm based microVM monitor (the hypervisor layer). One process runs one microVM. Usable on its own or under any orchestrator.
• orch/ - taritd, a multi-node orchestrator and PaaS control plane that launches and manages microVMs across a fleet, with placement, warm pools, networking, snapshots, SSH/PTY access, per-key usage stats, and an audit trail.

They talk over a Unix-domain-socket protocol whose types live in one shared, dependency-light crate, **`proto/`** (`tarit-proto`). That crate is the wire contract, so you can drive the VMM from `taritd` or from your own control plane without hand-copying types.

Why microVMs

• Hardware virtualization. Each sandbox is a KVM guest with its own kernel, not a shared-kernel container. Host confinement, resource limits, networking, and the VMM device boundary remain part of the security model.
• Fast and cheap. Minimal device model (MMIO virtio only, no PCI, no BIOS), demand-paged guest RAM, and snapshot/restore for sub-second starts.
• Ephemeral by design. Create, run, discard. Snapshots and copy-on-write overlays make many identical sandboxes cheap to spin up.
• Built for agents. vsock-based exec and interactive PTY, per-ke