A code interpreter
you actually control.
Point your agent's Python at a real Linux microVM — on your own infrastructure or our managed cloud, not a black box you rent by the message. Every session gets a fresh machine, every conversation keeps a persistent kernel, and prompt-injected code has nothing to reach but itself.
A fresh machine for every conversation.
Prompt-injected code is a when, not an if. Each interpreter session runs in its own Firecracker microVM with its own Linux kernel — whatever the model writes, it lands inside a VM that holds nothing else: no other tenants, no shared runtime, no path back to your infrastructure.
Hardware isolation
KVM virtualization, not a container profile. A dedicated kernel per session is the same boundary clouds use to separate customers.
Nothing shared, nothing leaks
Sessions never share a machine. Subprocesses, sockets, files — everything the generated code creates dies with its VM.
Self-hosted or managed
Run the whole stack on your own hardware, or use the managed cloud. Either way the substrate is open source — Apache-2.0, inspectable end to end.
State survives the gap between turns.
create_code_context() starts a long-lived, Jupyter-style kernel: variables, imports, and installed packages persist across run_code calls, exactly like notebook cells. Between conversation turns, snapshot the whole VM — memory, filesystem, packages — and the session resumes instantly when the user comes back.
Results your app can use
Every execution hands back typed objects, not stdout you have to parse: a DataFrame arrives as an HTML table, a matplotlib chart as a base64 PNG ready to send straight back to the model. stdout, stderr, and formatted tracebacks ride along on the same object.
from pandastack import Sandbox
sandbox = Sandbox.create(template="code-interpreter")
ctx = sandbox.create_code_context() # persistent kernel
# State persists across cells, exactly like a notebook.
ctx.run_code("import pandas as pd")
ctx.run_code("df = pd.read_csv('/workspace/sales.csv')")
# A DataFrame comes back as an HTML table.
ex = ctx.run_code("df.describe()")
print(ex.results[0].html) # "<table>...</table>"
# A chart comes back as a base64 PNG.
ex = ctx.run_code("""
import matplotlib.pyplot as plt
df['revenue'].plot()
plt.show()
""")
png_b64 = ex.png # straight back to the modelDatasets in, charts out, streams in between.
An interpreter is only useful wired into your app. Upload the user's CSV before the model touches it, watch stdout and stderr as the code runs, and pull artifacts back out when the session ends.
File uploads
filesystem.upload() drops a dataset at /workspace; download() pulls the notebook or results back out before cleanup.
stdout & stderr
Both streams are captured on every execution — relay them to your UI so users watch the code run, not a spinner.
One-shot exec
No kernel needed? run_code() and exec() spawn Python fresh per call, with timeouts — or run shell snippets with language="shell".
Batteries baked in
The code-interpreter template ships IPython, pandas, matplotlib, and plotly; rich output capture is automatic.
Open where hosted interpreters are closed.
Closed interpreters run on someone else's servers, on someone else's terms, with isolation you have to take on faith. This one is a product of open primitives you can read, self-host, and audit.
| PandaStack interpreter | closed hosted interpreter | |
|---|---|---|
| Where it runs | your infra or managed cloud | the vendor's cloud only |
| Source | open — Apache-2.0 | closed |
| Isolation | one microVM, one kernel per session | opaque |
| State between turns | persistent kernel + VM snapshots | vendor-defined resets |
| Session start | 49ms snapshot restore | varies |
Two primitives, one interpreter.
The interpreter is not a separate product — it composes the platform's building blocks. Sandboxes hold the session VM and its kernel; functions cover one-shot invocations when you don't need a session at all.
Ship on the millisecond cloud.
Free tier with $5.40/mo usage credit. No card. Apache-2.0.