Sandboxes
Securely run untrusted sandboxes in milliseconds; scale them to zero, branch or checkpoint them as needed.
Snapshot a fully initialised environment (runtime, deps, warm caches) into a template and boot each sandbox from it. Idle ones cost nothing. Scale to zero and restore statefully in ms.
Every sandbox is a hardware-isolated microVM with its own kernel, not a container sharing the host's. Its traffic leaves through a shield microVM that filters egress and holds your credentials, so untrusted code can use an API without ever seeing the key.
One hardware-isolated microVM per task: branch a live sandbox to launch sub-agents from its exact state, or checkpoint it and rewind when a path goes wrong.
A (scale to zero) microVM every packet must pass through: filters traffic, injects secrets
Third-party APIs, package registries
Watch the video to see a sandbox boot in under 10 ms, scale to zero while idle, and resume with its state intact.
Create a sandbox from your own code
The JavaScript SDK wraps the sandbox plugin in a Sandbox class, so a microVM is a few lines:
Code
Commands, standard input, signals and the filesystem are all covered. The Python and Go SDKs drive the instances themselves.
Under the hood
The platform features this use case is built on.
A separate microVM that all network traffic is routed through. It can filter traffic and inject secrets.
An authenticated channel over which command execution and filesystem access services are provided.
Clones a running sandbox, memory and volume state included, in milliseconds, so a sub-agent can start from the parent's exact state instead of setting itself up again.
Capture the full state of a sandbox and keep a history, so you can rewind to the last good point when a run goes wrong.
Optionally terminates long-running sandboxes so a stuck or hostile workload can't run indefinitely.
Give large, heavy sandbox environments millisecond startup, and cost nothing while idle.
Sign up to Unikraft Cloud, then follow the guide on creating your first sandbox