Conch - Agent Sandbox Engine

Conch is a container sandbox engine developed based on Go, designed to meet the requirements of Agents for high startup performance, high elasticity, high I/O performance, and high-density deployment of sandboxes. The project is developed around the following new sandbox requirements of Agents:

New Ecosystem: Compared with traditional command-line and K8s cloud-native ecosystems, it provides Agent-native sandbox management APIs and SDKs;
New Image Format: Compared with the traditional OCI v1 container image format, it supports the EROFS image format to unify the management of container images and snapshots;
New Hardware (Super Node): Unlike traditional single-machine container image management, it leverages the high-speed interconnection capability of super nodes to provide cross-level image sharing and management mechanisms.

Core Features

Lightweight and Secure Isolation -- Supports virtual sandboxes to securely isolate Agent tasks. It also supports full lifecycle management, including creation, suspension, resumption, and deletion operations.
Snapshot Boot Acceleration -- Supports snapshot functionality for virtual machine memory and root file systems. Through snapshot mechanisms, it enables second-level sandbox startup, significantly improving resource utilization efficiency in large-scale deployment scenarios. Snapshots adopt Copy-on-Write technology to minimize storage overhead.
Streamlined Container Networking -- Uses CNI plugins for the outer sandbox network namespace while Conch keeps ownership of reusable slots, sandbox netns lifecycle, guest tap setup, and VM-side NAT. This keeps the fast network pool model with a clear outer network boundary.

Documentation

For other documentation, see the Conch documentation index.

License

Mulan Permissive Software License, Version 2 (Mulan PSL v2)

Contribution Guide

Community contributions to code and documentation are warmly welcome.