Code sandboxes for AI agents
An agent’s code runs in a fresh Firecracker microVM per task, isolated by its own kernel, with outputs saved to S3.
Click any box to open its page. Open it in the playground to rewire it, change the traffic or take parts down.
AI agents write and run code you haven’t reviewed, on behalf of many different customers. Running that in a shared container is risky, because containers share the host’s kernel. Here every task gets its own Firecracker microVM: hardware-isolated like a full VM, but booting in under 125 ms, so it can be created per task and thrown away afterwards.
How it flows
- 1
The API admits the task
An agent submits code plus limits (CPU, memory, time). The API authenticates the caller and enforces per-customer quotas before anything is started.
AI agentsSandbox API - 2
The scheduler picks a host
Hosts are bare-metal machines (or VMs with nested virtualisation) because Firecracker needs KVM. The scheduler places the task on one with spare capacity.
Scheduler - 3
A fresh microVM runs the code
Firecracker boots a minimal kernel and root filesystem, or restores a pre-booted snapshot, in a fraction of a second. The code runs with its own kernel, a jailed process around the VM, and no route to other customers.
- 4
Outputs are saved, the VM is destroyed
Files the code produced are uploaded to S3 and the result returns to the agent. The microVM is then thrown away, so nothing leaks into the next task.
Why this shape works
- Hardware isolation per task: an exploit inside one sandbox doesn’t reach the host kernel others share
- Fast enough to create per task, so no state carries over between customers
- High density: thousands of small microVMs per host
- Snapshots make start-up even faster and let long sessions pause and resume
Where it strains
- Needs KVM: bare-metal instances or nested virtualisation, which limits where you can run it
- You build the orchestration yourself (networking, images, snapshots), or buy a platform that has
- GPU and device support is limited compared with containers
- Network egress from sandboxes needs strict rules, or agents can be used to attack other systems
Common swaps
Don’t want to run hosts? Hosted sandbox platforms and AWS Lambda run code in microVMs for you. Cloudflare Workers use lighter V8 isolates instead, which share one process rather than each having a kernel.
If the code is your own and trusted, plain containers on Kubernetes are simpler.
Built from
FirecrackerOpen sourceMicroVMsThe open-source microVM monitor AWS built for Lambda: a full VM boundary that boots in under 125 ms.
Amazon S3AWSObject storageAWS’s object storage, and the de facto API most object stores copy.API gatewaysAny product will doThe front door for your APIs: auth, limits and routing in one place.