hyperbutler
New v0.2.0: a sandbox for AI coding agents

Docker on Windows.
Less RAM. Less disk. No WSL.

hyperbutler is a lightweight, Docker‑compatible engine. It boots a minimal Linux VM through the Windows Host Compute Service, runs dockerd inside it, and lets the stock docker CLI talk to it.

Download for Windows GitHub

Windows 11 Home, Pro, Enterprise · x64 · MSI or zip · Apache-2.0

The hyperbutler mascot, a robot butler in a bow tie, holding up a tray with a glowing stack of layers 
PS C:\Users\you> hyperbutler start
hyperbutler is running: the Docker API answered after 1.5 s (engine pid 7412).
PS C:\Users\you> docker run --rm hello-world
Unable to find image 'hello-world:latest' locally
latest: Pulling from library/hello-world
Status: Downloaded newer image for hello-world:latest

Hello from Docker!
This message shows that your installation appears to be working correctly.
PS C:\Users\you>
A PowerShell session: hyperbutler start reports that the Docker API answered after 1.5 seconds, then docker run hello-world prints Hello from Docker.

Benchmarks

Lighter where it counts.

hyperbutler against Docker Desktop 4.97 (WSL 2), on one laptop, each with its default settings. Shorter bars are better.

Start until a container runs

hyperbutler
2.5 s
Docker Desktop
5.6 s

Idle memory, VM running

hyperbutler
319 MiB
Docker Desktop
1.7–2.7 GB

Docker Desktop varied over the first 6 minutes; the faded part of its bar is that range.

Disk, 5 min after deleting ~5 GB of images

hyperbutler
1.5 GiB
Docker Desktop
6.8 GiB

Download

hyperbutler
126 MB
Docker Desktop
592 MB +351 MB WSL

The faded part is the WSL download, needed if WSL is missing.

Bind mount: read 2000 small files from C:\

hyperbutler
0.4 s
Docker Desktop
3.4 s

Measured on one laptop (Windows 11 Home, Core Ultra 7 155H, 32 GB), one engine at a time, same script. Docker Desktop’s Resource Saver stops its VM after about 7 idle minutes; its processes then use 404 MiB. One machine is not a general result. Method and raw data

Features

Works well by default.

No tuning, no extra subsystem to keep updated. Install it, start it, run containers.

  • No WSL

    The VM runs directly on the Windows Host Compute Service, the same API WSL 2 uses. WSL is not required, can stay disabled, and its updates do not affect hyperbutler.

    3 resident processes at idle

  • Works on Windows 11 Home

    Home is first-class; Pro and Enterprise work too. You need an x64 PC with virtualization enabled in the firmware.

  • Disk space given back automatically

    Delete images and the data disk shrinks on its own. No manual compaction, no admin step.

  • Fast bind mounts from C:\

    Mount a Windows folder with -v C:\src:/src. Reading 2000 small files took 0.4 s; large files move at about 500 MB/s written and 900 MB/s read.

  • Stock docker CLI + Compose

    The docker CLI and the compose plugin are bundled and set up through a hyperbutler docker context. Compose builds, healthchecks, service names, volumes and bind mounts are tested.

  • No telemetry

    hyperbutler sends no usage data. The app only checks GitHub for updates once a day, and you can turn that off.

  • Open source, Apache-2.0

    The source is on GitHub. Free to use at any company size.

New in v0.2.0

A sandbox for AI coding agents.

hyperbutler sandbox run gives a coding agent, or any command, a Linux VM of its own with a copy of your project. Nothing it does reaches your files until you read the changes and apply them. 

# a shell in the copy: start your agent there
> hyperbutler sandbox run --name work C:\src\myapp
# every change, against your files now
> hyperbutler sandbox diff work
# only then do they reach C:\src\myapp
> hyperbutler sandbox apply work --all

  • Your files stay yours

    The agent sees none of your disk. A change that could run code later, such as a Makefile, a CI workflow or a package manifest, is never applied without you naming it. Files named like secrets stay out of the copy.

  • A network you choose

    dev reaches package registries, git hosts and model providers' APIs by exact name; locked only what you allow; open everything. sandbox blocked lists what it asked for and did not get.

  • Browsers work

    Headless Chromium runs in a session, so an agent can drive it with Playwright. Ctrl+] leaves the terminal and the agent keeps going; sandbox attach comes back.

The session image is a separate download of about 270 MB, on first use. How the sandbox works · v0.2.0

How it works

Three small parts, no WSL in between.

Your tools talk to a process of your own, which talks to a small Linux VM over Hyper‑V sockets. A tiny Windows service is the only privileged part: it starts and stops that VM, and nothing else.

Your tools talk over a named pipe to the hyperbutler engine, which runs as you. The engine talks over Hyper-V sockets to a Linux VM running dockerd. The broker service starts and stops that VM through the Windows Host Compute Service. WINDOWS · YOUR ACCOUNT LINUX VM · HYPER-V · NO WSL UNCHANGED Your tools docker CLI Compose SDKs · VS Code RUNS AS YOU · NO ADMIN hyperbutler engine Docker API relay User-mode network: NAT, DNS, ports Fast file server for bind mounts from C:\ Disk-space guard · status · window GUEST dockerd + containerd Minimal Alpine userland Read-only disk, hash-pinned Data disk gives space back Answers only your engine WINDOWS SERVICE · SYSTEM · SINCE v0.1.0 hyperbutler broker The only part that calls HCS · 7 typed requests pipe Hyper-V sockets start · stop HCS: create · start · stop

Design decisions, threat model and review results: Architecture in the README

Install

Three steps to hello-world.

You need Windows 11 (Home, Pro or Enterprise) on x64, with virtualization enabled in the firmware.

  1. Run the MSI

    Download it from the latest release. One UAC prompt, then it:

    • adds hyperbutler and its docker CLI to the PATH;
    • installs the broker service, the small privileged part that starts your VM, so daily use needs no admin rights;
    • turns on Virtual Machine Platform if it is missing.

  2. Restart if asked

    Only when Virtual Machine Platform was just turned on. Otherwise open a new terminal so it sees the new PATH.

  3. Run a container

    > hyperbutler start
> docker run hello-world

Unsigned builds

Builds are not code-signed yet, so SmartScreen says “Windows protected your PC”: choose More info, then Run anyway. Check the file against SHA256SUMS from the release first: 

Get-FileHash .\hyperbutler-*-windows-amd64.msi -Algorithm SHA256

Prefer no installer?

The zip works without installing anything, but it has no broker service, so your account needs Hyper-V Administrators membership. That group lets every program you run control the Hyper-V VMs on this PC: treat it as close to admin rights. See the install guide.

v0.2.0

Released. Still early.

v0.2.0 adds the agent sandbox, BuildKit builds and ports published on 127.0.0.1. Its release candidate ran a 24-hour soak (283,947 docker commands, none failed), and the one slow leak it found is fixed. It works end to end on Windows 11 Home. Some things are still open. Among them:

  • The installer has not run on a clean PC yet, and sleep and resume are tested in unit tests only.
  • Bind mounts from Windows paths work, but are not yet fast for write-heavy trees: use a named volume for node_modules.
  • Builds are not code-signed, and the installer is English only.

Current status and known gaps