Sandboxes in
milliseconds.
The fastest, safest, and cheapest runtime for AI agents. Spawn a real Linux VM from any Docker image in 10 ms.
Billed per second at $0.04/hour for 1 vCPU + 1 GiB. Typical agent execution costs < $0.001.
$50 free credit · No card required
first-party adaptersClaude Managed AgentsOpenAI AgentsLangChainLangGraphMCPcoming soonCrewAI
One runtime. Six primitives.
Everything an agent needs to run real code safely, at the speed of a function call.
Hardware isolation
Every sandbox its own guest kernel. No neighbours.
Any image
Pull from Docker Hub, ghcr, your registry.
Fork running VMs
Clone an in-flight sandbox. Branch live state in place.
Persistent shells
Long-lived bash. Signals, scrollback, detach.
Public URLs
Expose a port. Get HTTPS. WS, SSE, H2, H3.
Hibernate / resume
Pause to disk. Restore in 21 ms, where you left.
Your secrets never enter the sandbox.
API keys are injected at the network boundary. A memory dump of the guest, an /proc/*/environ walk, and a full process listing all yield nothing. The blast radius of an isolation failure is bounded by the in-flight request, not the credentials you hold.
Guest VM
Host proxy
Upstream
Egress policy, before the packet leaves.
Pick a profile or author a rule set. Enforcement lives in the host kernel. Code inside the guest can't turn it off.
from isorun import Sandbox with Sandbox( "python", deny=["0.0.0.0/0"], # block everything allow=["api.openai.com", "pypi.org"], # …except these ) as sb: sb.exec("pip install openai") # works sb.exec("curl https://api.openai.com/v1/models") # works out = sb.exec("curl -m 2 https://example.com") assert out.exit_code != 0 # blocked
Bring your image. Expose any port.
No base-image restrictions, no runtime lock-in. If it runs on Linux, it runs on isorun, and if it listens on a port, it’s one call away from a public URL.
Pull any image. Pinned tags, digests, private registries.
Pass any OCI reference to Sandbox(). First use builds an optimized cache; every boot after is a standard cold-start. latest/lts/stable rejected at create, we won’t let a silent upstream republish invalidate your cache.
Every port, one TLS hop from the internet.
Call sb.url(port) and get a signed HTTPS URL that proxies to whatever you’re listening on: vite, jupyter, gradio, anything. End-to-end WebSocket, streaming SSE, every HTTP method. ~120 ms warm, ~180 ms cold.
Give Claude a real computer.
In under 20 ms, less time than a single model round‑trip.
Under 20 ms cold start
Multi-tool agent rounds fit under a single 600 ms frame budget.
Parallel by default
Spin up 30 siblings from one prompt. Each isolated.
Hibernate, resume in 21 ms
Pause a session, come back with scrollback, FDs, and processes intact.
Three constraints. Seven properties.
Agent workloads are simultaneously price-sensitive, latency-sensitive, and security-sensitive. Adjacent workloads stress at most two. That’s the whole design brief.
Low marginal cost
Cheap enough that invoking a sandbox isn't a budget decision. Breaks above roughly five cents an hour.
Low cold-start latency
Fast enough to vanish into a single tool-call. Boot has to sit an order of magnitude below inference latency.
Isolation against hostile code
The boundary has to sit below the untrusted code, hardware-assisted, not namespace-based, not syscall-filtered.
Per second. No minimums.
The advertised price is the price. Egress, storage, and platform fees are included.
- Per-second billing
- Unmetered egress
- Any OCI image
- TLS, WS, HTTP/3
- Public HTTPS URLs
- Hibernate / resume
- Hardware isolation
- Default-deny egress