How-to guides assume you already installed grain and created at least one sandbox. Each page solves a specific job.
If you are brand new, start with the quick start .
Popular workloads bash
Copy
grain act -- -j test
grain new --preset k3s -n lab -p --wait userdata Everyday use Guide When you need it Images & golden boots Pull, import, bake, choose ubuntu/alpine/golden Guest agent Exec, shell, cp, fs without living in SSH Networking & ports Publish ports, live forwards, SLIRP limits Overlay network Guest↔guest L2 on one host (network: overlay) Guest architecture arm64 / amd64 guests (TCG cross-arch) Virtio GPU virtio-gpu-pci for guestsMounts & shares Share host directories into the guest Profiles & presets Named defaults and docker / k3s / act presets Pause, suspend, restore Free CPU or RAM while keeping work
Security & ops More recipes Egress proxy — Default-deny HTTP(S) proxy with allow rules and secrets.Firecracker on Linux — Experimental Firecracker hypervisor backend.GitHub Actions with act — Run nektos/act inside a grain microVM — isolated GitHub Actions without polluting host Docker.Guest agent — Use grain-agent for exec, shell, files, and health.Guest architecture — Run arm64 or amd64 Linux guests, including x86_64 on Apple Silicon via QEMU TCG.Images and golden boots — Pull, import, bake, and choose base images.k3s lab — Spin up a disposable or persistent single-node k3s cluster with grain’s k3s preset.MCP server — Connect Claude Code, Codex, OpenCode, Grok Build, and other MCP hosts to grain sandboxes.Mounts and host shares — virtio-9p and virtiofs directory sharing.Networking and ports — SLIRP, publish, live forwards, and limits.Overlay network between VMs — Share an L2 segment across grain VMs with network overlay mode.Pause, suspend, and restore — Free guest CPUs or host RAM without losing a persistent lab.Profiles and presets — Named create defaults and docker / k3s / act presets.Recipe: coding agent sandbox — How-to recipe from the grain documentation set.Recipe: Docker in the VM + socket forward pattern — How-to recipe from the grain documentation set.Recipe: ephemeral CI — create → exec tests → rm — How-to recipe from the grain documentation set.Remote sandbox host (team box) — Run grain as a service on a shared machine; connect with the CLI over HTTP, SSH tunnels, or SDKs — with firewall and token rules.Secrets — Store secrets on the host and materialize them into a guest VM without baking them into images.Troubleshooting — Diagnose boot, agent, and QEMU issues.Virtio GPU — Attach a virtio-gpu device to grain QEMU guests.