The AI agent sandbox that boots
before your model finishes a token.

An AI agent sandbox is an isolated, disposable execution environment where an AI agent runs the code, shell commands and tool calls a model generated, without access to your host, its credentials or other users' data. On PandaStack each sandbox is a Firecracker microVM with its own Linux kernel. It is created from a snapshot in 49ms p50 (server-measured) and deleted when the task is done.

For trusted first-party code, often yes. For code a model wrote, a container is a packaging boundary rather than a security boundary: it shares the host kernel, so a kernel exploit or a runtime misconfiguration becomes a container escape. A microVM runs its own guest kernel behind hardware virtualization, so untrusted code would have to escape through KVM and Firecracker's small device model instead.

gVisor intercepts system calls in a user-space application kernel, which is a real improvement over plain containers. Its own documentation notes reduced application compatibility and higher per-syscall overhead, and the host kernel is still underneath. A Firecracker microVM gives each sandbox a full Linux guest kernel on KVM with a minimal device model. The usual cost of a VM is boot time; PandaStack restores every sandbox from a snapshot, so create is 49ms p50 (server-measured).

Yes. Outbound access is on by default so agents can install packages, call APIs and clone repositories, and there is no outbound allowlist today. Each VM egresses through its own network namespace and NAT, so traffic is attributable to one sandbox and workspace. VM-to-VM traffic, the link-local range that serves cloud metadata, and the standard Stratum mining-pool ports are dropped at the host firewall. Keep long-lived secrets out of the sandbox and pass short-lived, scoped tokens instead.

Within a sandbox, yes: files, installed packages and running processes stay until you delete it or its TTL expires. For longer gaps, snapshot() captures memory and disk, and hibernate() writes state to disk and stops compute billing; the next request wakes the sandbox. On the Free plan a sandbox is deleted one hour after it is created. On paid plans the TTL is an idle timeout, up to 7 days on Pro and 30 days on Team.

On the live API, server-measured create to ready is 49ms p50 across 50 consecutive creates of the base template (June 17, 2026). Concurrent creates take longer per request, and your client adds its own network round-trip; the method and raw numbers are at pandastack.ai/benchmarks. fork_tree() snapshots the parent once, then restores every child with the parent's memory and disk in a few hundred milliseconds. A plain fork() copies only the disk and cold-boots the child.

Yes. PandaStack is open source under Apache-2.0 at github.com/pandastack-io/pandastack-ai. A self-hosted deployment is a control plane (API + Postgres), an agent on each Linux host with /dev/kvm, and the Firecracker microVMs they manage. There are guides for GCP, AWS bare metal, on-prem hardware, a single Linux box and Apple Silicon via Lima, and the same Python and TypeScript SDKs point at your own API endpoint.

Yes. Every sandbox exposes an MCP endpoint with shell, read_file, write_file and list_dir tools, and a hosted workspace MCP server (Pro, Team and Enterprise) can create sandboxes, run commands and manage databases and apps. The docs have guides for LangChain, LangGraph, CrewAI, AutoGen, the OpenAI Agents SDK, the Vercel AI SDK, LlamaIndex, Pydantic AI, smolagents, Mastra and Claude Managed Agents.

Per second, at $0.054 per active vCPU-hour and $0.0162 per working-set GiB-hour. CPU counts the seconds your code actually burns, not the 8 vCPUs a sandbox can burst to, and memory counts what stays resident. A hibernated sandbox bills no compute. The Free plan includes $5.40 of usage credit a month, 5 concurrent sandboxes and 60 creates an hour.