A container is not a wall
- Agents write code now. When an agent does something twice, it writes a script for it and runs it. That script was reviewed by nobody.
- A container is not a wall. It shares the host kernel. Code that can find the kernel version can look for a way out.
- A VM per task is too slow. A thousand agents running five commands each is five thousand machines to boot.
- Containers on your workstation are as secure as you made them. If you mount the filesystem in them, they are not containers any more.
Cut from a template, kept warm, claimed in seconds
Describe the machine once: base image, the few tools the task needs, the isolation runtime, network policy and storage. One template per kind of task, not one image with everything in it.
Keep a number of sandboxes from each template booted and waiting. Size the pool to your traffic, from one to hundreds.
A task claims a ready sandbox and starts in seconds instead of waiting for a cold boot. If none is free, a new one is cut from the template. Claim it from the SDK, the CLI, over MCP or through the SDLC Runner.
The sandbox has a stable identity and its own storage for as long as the task needs it, can be paused and resumed, and is deleted on schedule.
It reaches what you allow, and nothing else
Its tools
Run the tools in its template.
Its allow-list
Reach the endpoints you allow-listed: the model gateway, a package mirror, one API.
Its files
Keep files for the length of its session.
Cannot see the cluster
It does not know what it runs on. It is a black box with only the tools it needs.
Cannot reach anything not on its allow-list
Egress is denied by default.
Cannot be reached from outside
Except through the sandbox router, with an approved identity.
Cannot outlive its job
Gone when the job ends.
We hold the management plane; your nodes hold the sandboxes
Sandboxes run on ordinary CPU nodes. No GPU needed.
Management plane, ours
The control plane, templates as code, policies and quotas, signed sandbox images, identity, short-lived secrets and observability.
Your nodes, yours
Warm pools, sandboxes isolated by a microVM, and deny-by-default network policy.
Connections
Model calls from inside a sandbox go to the AI gateway, to local or hosted models; tool calls run inside the sandbox; metrics, logs and session audit flow out to observability.
SDLC runners, long-running agents and agentic workflows run here
SDLC runners
Each build, test or pipeline job gets a fresh sandbox, claimed through the SDLC Runner and gone when the job ends.
Long-running agents
An agent that works for hours keeps its sandbox, identity and storage for as long as the task needs, and can be paused and resumed.
Agentic workflows
Each step of a multi-agent workflow runs in its own sandbox, so one agent’s tools and files never reach the next.
Untrusted code
Scripts an agent wrote, a skill’s bundled scripts, code a customer uploaded.
Every session is recorded, outside the sandbox
Every session is recorded: which sandbox, from which template, for which agent, which commands ran, what it reached on the network, and when it ended. That record goes to observability, not into the sandbox that might be compromised.
The ones people actually ask
Why not just containers?
A container shares the host’s kernel. For code you wrote, that is fine. For code nobody reviewed, it is the one wall you cannot afford to share.
Which isolation do you use?
Each sandbox runs in its own microVM.
Can a sandbox be escaped?
Any isolation can have flaws. Ours are layered: an isolated runtime, no cluster access, deny-by-default network and an audit trail outside the sandbox. We do not claim escape is impossible.
Where do they run?
On your nodes, as part of your workload. Any machine that can join the cluster can host them.
Do they need GPUs?
No. Models are called through the gateway; sandboxes run on CPU nodes.
What does it cost?
You pay for the cluster control plane. There is no limit on how many sandboxes you run.
Watch an agent claim a sandbox, run code and let it go
- A template and a warm pool on a live cluster
- A blocked network call, and what the audit shows
- What your first template would contain