open-source microvm sandboxes for ai agents and untrusted code. a kernel per sandbox. run locally on your own hardware, or request access to our managed cloud.
talk to a founderChoose the interface you already use, copy one command, and run it on your machine.
open the full quickstart
npx microsandbox run ubuntu:latest
agent / ubuntu:latestone command gives untrusted code its own kernel on your machine. no daemon, no root, no account. when the code goes rogue, it trashes its computer, not yours.
agent / ubuntu:latestthe sandbox you built locally runs unchanged in our cloud. orgs, sso, audit logs, quotas, invoicing. local or cloud is a config change, not a rewrite.
agent / ubuntu:latestregulated, or just careful? the exact same runtime is apache 2.0 open source. run it in your own vpc or on your own metal. contact us to evaluate.
agent / ubuntu:latestEach sandbox carries its own kernel behind a hardware boundary.
A separate kernel boundary for every workload.
03 / open by default
read the security model. reproduce the benchmarks. run the runtime on your own machine before you put it in your fleet.
book a demokeep credentials host-side, let the sandbox work with placeholders, and choose which destinations can receive the real value.
protect api keys in an ai agent sandboxone sdk. one api. local or cloud is a config change, not a rewrite. private beta. access is by request.
ordinary Docker Engine containers share a kernel. microsandbox runs each sandbox in its own microVM and keeps the OCI-image workflow. Docker Sandboxes is a separate microVM product; see the comparison for its licensing and deployment differences.
The local runtime runs on your machine. For managed deployments, we review data handling, residency, audit, and secrets requirements with your team before rollout.
macOS · Linux · Windows. byoc brings the runtime to your own cloud or metal. contact us to evaluate.
Rust, TypeScript/Node, Python, Go, and a CLI today. MCP workflows are also part of the developer surface.
by default, sandboxes can reach the public internet. private, host-local, link-local, and metadata destinations are blocked. egress can be reduced to an allowlist or disabled entirely. in the cloud, the non-public block cannot be lifted, even by you. credentials are destination-bound. the sandbox works with a placeholder; the real value is substituted host-side into supported intercepted outbound requests, only for destinations on your allow-list. an approved destination still receives the real credential and could reflect or misuse it, so scope your allow-lists accordingly.
microsandbox runs untrusted code in hardware-isolated microVMs with their own kernel. It is open source under Apache 2.0.
running the apache 2.0 runtime locally is free. private beta. access is by request. private beta pricing is published at /pricing; rates need owner confirmation before promotion.
