sandboxes

Compute that boots before
your model finishes a token.

Every sandbox is a real Linux microVM with its own kernel, restored from a baked snapshot — no warm pool, no cold-start roulette. Run untrusted code, agent tool calls, and full dev environments behind hardware virtualization.

49ms
p50 boot
~400ms
fork a running VM
1 kernel
per sandbox — never shared
sandbox.create() — snapshot restore
boot

Snapshot restore on every create.

There is no pool of idle VMs waiting for you. A create allocates a pre-built network slot, reflinks the root filesystem (copy-on-write, metadata only), and restores the template's memory snapshot — the guest wakes mid-thought with its runtime already warm.

Why restore beats warm pools

Warm pools bill someone for idle capacity and still miss under load. A snapshot restore is O(page-in): memory streams on demand, so the 49ms p50 holds whether you create one sandbox or a burst of hundreds — and p99 stays within ~25ms of p50.

alloc slot ~msreflink rootfsrestore + resume
python — pip install pandastack
from pandastack import Sandbox

sb = Sandbox.create(template="code-interpreter")   # ~49ms
out = sb.exec("python -c 'print(2**64)'")
print(out.stdout)

snap = sb.snapshot()      # point-in-time memory + disk
sb.kill()
fork

Branch the whole computer, keep the winner.

fork() clones a running sandbox — filesystem shared copy-on-write — in about 400ms on the same host. Give an agent N parallel attempts at a problem, promote the branch that worked, throw the rest away.

fork & forkTree

Clone one sandbox or fan out a tree of attempts from the SDK. Each child diverges copy-on-write; the parent never notices.

Snapshots

Capture memory + disk at any instant. Restore later, restore elsewhere, or bake it into a reusable template.

Hibernate & wake

Idle sandboxes write their state and stop billing active compute. They wake on demand with state intact.

isolation

A dedicated kernel is the boundary.

Containers share the host kernel; a kernel exploit is a tenant-escape. Every PandaStack sandbox runs its own Linux kernel on KVM — the same virtualization boundary clouds use to separate customers.

PandaStack sandboxshared-kernel container
Kerneldedicated per sandboxshared with every tenant
Escape blast radiusone microVMthe host and its tenants
Untrusted codedesigned for itneeds seccomp/AppArmor patchwork
Boot49ms p50 snapshot restorefast, but cold runtimes
Fork a running machine~400ms copy-on-writenot a primitive
exec

Every way an agent wants to talk to a machine.

One-shot REST exec for tools and CI, an interactive PTY for terminals and human handoff, and a multiplexed WebSocket for high-frequency agent loops that can't pay per-request handshake tax.

REST · PTY · WS exec

POST a command, open a resizable shell, or multiplex tagged commands over one socket.

Files in & out

Stream source trees, artifacts, and prompt bundles into a running microVM.

Preview URLs

Any port is reachable at a stable per-sandbox URL for demos and webhooks.

Durable volumes

Attach named volumes for caches, repos, model shards, and user state.

go deeper

The internals are public.

The whole substrate is open source — read exactly how boot, fork, and isolation work.

Ship on the millisecond cloud.

Free tier with $5.40/mo usage credit. No card. Apache-2.0.