Give your agent
a real computer.
An agent that can only eval a string isn't doing real work. Each session gets a full Linux microVM — filesystem, shell, packages, long-lived state — behind hardware virtualization, so a misbehaving model can't touch your host or exfiltrate credentials.
More than a code-eval endpoint.
Real agent plans mutate filesystems, install dependencies, run test suites, and keep state across tool calls. That takes a machine, not a stateless function — and it takes isolation you can hand untrusted model output without flinching.
A shell, not a string eval
Run any command, stream stdout/stderr back as the tool result, and let the model iterate — pip install, git, pytest, whatever the plan needs.
A filesystem that persists
Upload a workspace, let the agent edit files across many tool calls in one session, and download the result when the turn ends.
Hardware isolation by default
Every sandbox is its own Firecracker microVM with its own kernel. Egress is NAT'd in a private network namespace; inter-sandbox traffic is blocked.
Fork the machine N ways, keep the winner.
Agents are tree search. When yours hits a fork in the road — which fix, which library, which algorithm — explore() forks the sandbox once per candidate, runs each approach in parallel real execution, scores the outcomes, promotes the winner, and reaps the losers automatically.
Best-of-N over real execution
Forks are copy-on-write — ~400ms on the same host, sharing the parent's memory until a branch writes. 10 forks of a 500 MiB Python session cost ~5 MiB extra RSS until they diverge. Cold-booting N containers for the same search would be 10× slower and 10× the RAM.
Each branch reports exit code, output tails, files changed, and duration — a structured outcome the model can reason over. Up to 16 branches per experiment; losers never leak.
from pandastack import Sandbox
sb = Sandbox.create(template="code-interpreter",
ttl_seconds=3600)
# every tool call runs behind hardware isolation
out = sb.run_code(tool_call["code"], language="python")
# the agent hits a fork in the road — try all three
result = sb.explore(
["python solve.py --strategy greedy",
"python solve.py --strategy dp",
"python solve.py --strategy beam"],
score_fn=lambda b, o: 1.0 if o.ok
and "PASS" in o.stdout_tail else 0.0,
)
winner = result.winner # promoted; losers reapedIdle agents should cost nothing.
Most of an agent's wall-clock is the model thinking, or the user away. Hibernate the sandbox between turns and it stops billing active compute — then wakes with its state intact when the next tool call lands.
Hibernate & wake
Park a session while the model reasons or the human sleeps. State — files, processes, memory — comes back exactly where it left off.
Postgres for agent memory
Attach a managed PostgreSQL database for durable agent memory and state that outlives any single sandbox or session.
Tagged for audit
Tag every agent sandbox with metadata at create time, so cleanup, audit, and per-agent accounting stay one query away.
Two primitives, one agent runtime.
This solution is composed from the platform's building blocks — isolated compute for the agent's hands, a managed database for its memory.
Ship on the millisecond cloud.
Free tier with $5.40/mo usage credit. No card. Apache-2.0.