k7 is self-hosted infra for secure VM sandboxes — orchestrated with Kubernetes, driven by a CLI, REST API, and Python SDK. Pick a backend per sandbox: Firecracker via Kata (kfd), QEMU + Longhorn (kql), k7d for warm CoW forks in milliseconds, or k7d-fc — the same k7d daemon driving jailed Firecracker. Run docker build inside any of them with --docker; sandboxes are locked away from the platform by default and reachable only through the ports you open.
Get running in minutes: install, trust the API’s CA, create your first sandbox.
All k7 commands with examples.
kfd, kql, k7d, k7d-fc — pick per sandbox; what forks, what persists, what is jailed.
k7 create --docker: pinned dockerd, overlay2 on a block disk, forkable on k7d.
Sync and async clients with complete examples.
Endpoint overview, request/response formats, and errors.
Build a ReAct agent that executes inside a sandbox.