Skip to main content
A sandbox is a Firecracker microVM with its own kernel — not a container. Spawn one in well under a second, run whatever you like inside it, snapshot the filesystem, and destroy it. You are billed per second of runtime against the resources you reserved, plus any CPU you consume above the reservation. Use them to:
  • run untrusted or agent-generated code with a real isolation boundary;
  • give a coding agent a disposable machine it can break;
  • run builds and tests in parallel without contending for one CI box;
  • snapshot an expensive setup step once and restore it many times.
Start with Run a sandbox. For reusing a prepared filesystem, see Snapshots.

​
Defaults and sizing

A sandbox with no resources specified reserves 0.125 vCPU and 128 MiB — enough for a shell, a small script, or an idle agent waiting for work. CPU is a floor, not a ceiling: every sandbox auto-scales above its reservation, so short compute spikes are fast without reserving headroom you rarely use — see Auto-scaling CPU for how that bills. Memory is a hard limit — a VM cannot exceed the RAM it booted with, so anything memory-hungry must ask for more up front. Ask for the exact resources you need with cpu in fractional cores and memory in MiB. The maximum is 32 vCPUs and 112 GiB RAM.

​
Auto-scaling CPU

Your reserved vCPU is the billing floor and is always charged while the sandbox runs. CPU actually consumed above the floor bills as a separate CPU (burst) invoice line at the same rate as reserved CPU — auto-scaling is not a premium, and there is nothing to turn on. Consumption is measured per second from the VM’s cgroup. Memory is unaffected: it bills on the reservation, which is also the VM’s hard ceiling. For example, a default 0.125 vCPU sandbox that compiles at a full 1 vCPU for 10 minutes costs about 0.0005forthefloor(75vCPU−seconds)plusabout0.0005 for the floor (75 vCPU-seconds) plus about 0.0034 for the burst (525 vCPU-seconds) — roughly $0.004 total. The monthly free grant applies to burst like any other usage.

​
Limits

Each organization may hold 100 concurrent sandboxes until your account is upgraded. Reach out to [email protected] and we’ll assist you promptly. The count is of sandboxes you have not destroyed, whatever state they are in — a paused sandbox still counts. Destroy the ones you are finished with to free capacity. Creating a sandbox is refused with 402 when the organization is over its credit limit or past its payment grace period. See Access Control and Metering.