Pullrun is a next-gen container runtime that allows running OCI images as Linux containers, Firecracker microVMs, or Apple Silicon VMs without requiring a daemon or overlayfs. It utilizes zero-copy DAG storage for layer management and supports peer-to-peer image synchronization.

Matchlock is a CLI tool that runs AI agents in ephemeral microVMs, providing a secure environment with network allowlisting and secret injection via a MITM proxy. It ensures that secrets never enter the VM and offers a full Linux environment that boots in under a second, isolating and locking down the agent by default.