Compute that boots before
your model finishes a token.
Every sandbox is a real Linux microVM with its own kernel, restored from a baked snapshot — no warm pool, no cold-start roulette. Run untrusted code, agent tool calls, and full dev environments behind hardware virtualization.
Snapshot restore on every create.
There is no pool of idle VMs waiting for you. A create allocates a pre-built network slot, reflinks the root filesystem (copy-on-write, metadata only), and restores the template's memory snapshot — the guest wakes mid-thought with its runtime already warm.
Why restore beats warm pools
Warm pools bill someone for idle capacity and still miss under load. A snapshot restore is O(page-in): memory streams on demand, so the 49ms p50 holds whether you create one sandbox or a burst of hundreds — and p99 stays within ~25ms of p50.
from pandastack import Sandbox
sb = Sandbox.create(template="code-interpreter") # ~49ms
out = sb.exec("python -c 'print(2**64)'")
print(out.stdout)
snap = sb.snapshot() # point-in-time memory + disk
sb.kill()Branch the whole computer, keep the winner.
fork() clones a running sandbox — filesystem shared copy-on-write — in about 400ms on the same host. Give an agent N parallel attempts at a problem, promote the branch that worked, throw the rest away.
fork & forkTree
Clone one sandbox or fan out a tree of attempts from the SDK. Each child diverges copy-on-write; the parent never notices.
Snapshots
Capture memory + disk at any instant. Restore later, restore elsewhere, or bake it into a reusable template.
Hibernate & wake
Idle sandboxes write their state and stop billing active compute. They wake on demand with state intact.
A dedicated kernel is the boundary.
Containers share the host kernel; a kernel exploit is a tenant-escape. Every PandaStack sandbox runs its own Linux kernel on KVM — the same virtualization boundary clouds use to separate customers.
| PandaStack sandbox | shared-kernel container | |
|---|---|---|
| Kernel | dedicated per sandbox | shared with every tenant |
| Escape blast radius | one microVM | the host and its tenants |
| Untrusted code | designed for it | needs seccomp/AppArmor patchwork |
| Boot | 49ms p50 snapshot restore | fast, but cold runtimes |
| Fork a running machine | ~400ms copy-on-write | not a primitive |
Every way an agent wants to talk to a machine.
One-shot REST exec for tools and CI, an interactive PTY for terminals and human handoff, and a multiplexed WebSocket for high-frequency agent loops that can't pay per-request handshake tax.
REST · PTY · WS exec
POST a command, open a resizable shell, or multiplex tagged commands over one socket.
Files in & out
Stream source trees, artifacts, and prompt bundles into a running microVM.
Preview URLs
Any port is reachable at a stable per-sandbox URL for demos and webhooks.
Durable volumes
Attach named volumes for caches, repos, model shards, and user state.
The internals are public.
The whole substrate is open source — read exactly how boot, fork, and isolation work.
Ship on the millisecond cloud.
Free tier with $5.40/mo usage credit. No card. Apache-2.0.