dorianzheng

# Specify what skills the agent has - like importing modules async with boxlite.SkillBox(skills=["anthropics/skills"]) as agent:

    # Skills loaded: pdf, docx, pptx, xlsx handling
    await agent.call("Read quarterly_report.pdf and summarize key metrics")
    await agent.call("Export that to a PowerPoint with charts")  # remembers context

The same skill works across Claude Code, OpenAI Codex CLI, and Gemini CLI. It's becoming the package manager for agent capabilities.

# Install skills dynamically - like pip install at runtime await agent.install_skill("anthropics/skills") # PDF, Word, Excel, PowerPoint await agent.install_skill("example/web-scraper") # Custom scraping skill await agent.install_skill("your-company/internal") # Your private skills

Orchestrating multiple agents:

async with boxlite.SkillBox(skills=["anthropics/skills"]) as doc_agent:

async with boxlite.SkillBox(skills=["example/web-research"]) as research_agent:

    research = await research_agent.call("Find Q3 earnings for top 5 tech companies")

    analysis = await doc_agent.call(f"Analyze this data: {research}")

The fun demo - Starbucks: One function call, Claude navigates the website, handles popups, adds coffee to cart. You watch via noVNC at localhost:3000.

Yeah, it runs in a micro-VM (hardware isolation). But that's a feature, not the point. The point is the programming model.

  The problem:

  AI agents are most useful when they have freedom—freedom to write code, install packages, run scripts, explore solutions. But that freedom is dangerous. One hallucinated rm -rf / or a malicious package install, and your host system pays the price.

  So we restrict them. Limit file access. Disable network. Whitelist commands. The agent becomes safer but also dumber—unable to iterate, experiment, or recover from mistakes like a human developer would.

  I wanted to give AI agents a full computer they could break without breaking mine.

  Why not existing tools?

  When I started sandboxing AI-generated code, nothing quite fit:

  - Docker shares the host kernel—container escapes are a real attack surface, and that makes me nervous
  - QEMU/libvirt is powerful but heavyweight—XML configs, daemon processes, steep learning curve
  - Cloud sandboxes (E2B, Modal, etc.) work, but you're locked into their platform with limited customization
  - Kata Containers is designed for Kubernetes orchestration, not for embedding in a Python script

  The SQLite idea:

  I've been thinking about why SQLite works so well. Before SQLite, databases meant running a server—PostgreSQL, MySQL, managing daemons, configuring connections. SQLite asked: what if it was just a library? No server. Just import sqlite3.

  I wanted the same thing for VMs.

  So I started building BoxLite—an attempt to make VMs embeddable like SQLite. A library call that gives you a real micro-VM with its own kernel. No daemon. No root.

  import asyncio
  import boxlite

  async def main():
      async with boxlite.SimpleBox(image="python:slim") as box:
          result = await box.exec("python", "-c", "print('Hello from VM!')")
          print(result.stdout)

  asyncio.run(main())

  To be clear: this is early.

  It works on macOS Apple Silicon and Linux. You can pull OCI images, mount volumes, forward ports. There are some higher-level abstractions (BrowserBox for Playwright, ComputerBox for desktop automation).

  But there are bugs. Boot time is 200ms for hot runs (I want it under 100ms). Documentation is thin. Error messages could be better. macOS Intel and Windows aren't supported. I haven't battle-tested it at scale.

  I'm sharing it now because I'd rather build this with feedback than in isolation.

  What I'd love to hear:
  - Does the SQLite-for-VMs idea make sense, or am I stretching the analogy?
  - What would you actually use this for?
  - What's broken or confusing when you try it?

  GitHub: https://github.com/boxlite-labs/boxlite
  PyPI: https://pypi.org/project/boxlite/