Operate Sandboxes at Fleet Scale, on Your Infrastructure
The open-source core confines one process. The Sandbox HTTP API and Sandbox Scheduler run thousands, fitting a thousand agent sessions into the memory a reservation model spends on twenty. Both deploy inside your trust boundary.
Open Source at the Core, Commercial at the Fleet Layer
Everything that confines a process is Apache-2.0. Everything that operates a fleet is licensed. No paywalled flags, nothing that phones home.
Sandlock
Apache-2.0The sandbox, the supervisor, copy-on-write, HTTP ACLs, credential injection, handlers, and every interface: CLI, SDKs, OCI runtime, MCP server. Free at any scale.
Sandbox HTTP API
CommercialSandboxes as remote infrastructure: create from an image, run, move files, checkpoint, reconnect from anywhere, behind keys with scopes.
Sandbox Scheduler
CommercialPlaces sessions across a fleet from a checkpoint store, so a node holds memory only while a session is executing.
Teams Running Sandboxes as a Fleet
One sandbox on one host? The open-source project is the whole answer. This layer starts when sandboxes outnumber machines.
AI agent platforms
A sandbox per session, and a memory bill dominated by sessions doing nothing.
Code execution products
Notebooks, interpreters, and eval harnesses that need tenancy, quotas, and per-key accounting.
Developer platforms
CI and build services where per-job VMs are the line item you want gone.
Security engineering
Approving untrusted execution on shared hosts, with evidence to hand an auditor.
A Sandbox Service Running on Your Own Servers
The core is a function call. The API makes a sandbox a resource: an ID, a lifetime, any language, and keys with scopes.
Any language, scoped keys
REST, so callers need no Linux and no FFI. Keys carry scopes and per-key usage accounting.
Sandboxes that outlive the call
Stable IDs, reconnect from another machine, named checkpoints to stop and restore.
Container images as the rootfs
Name an image; the server extracts, caches, chroots, and applies copy-on-write.
Long-running services
Start a server in a sandbox, query its ports, tail its output, stop it.
Remote MCP
Point Claude Desktop, Cursor, or any MCP client at the API. Each tool call gets its own sandbox.
Evidence for your auditor
Posture reports and tamper-evident audit trails, generated on your infrastructure.
Provision for Execution, Not for Idle Sessions
An agent session spends nearly all of its life waiting on the model. The Scheduler keeps it in a checkpoint store and gives it node memory only while it runs.
Sessions
At 2 GB each, reservation holds 2 TB whether or not anything runs.
Actual footprint
About ten execute at any instant. Provision for p99.9 concurrency and the same thousand fit.
More sessions per host
Approaching 91× at a hundred thousand sessions, as concurrency averages out.
Modelled from the duty cycle. We size the deployment against your own session count, concurrency, and idle profile.
Your Infrastructure, Not a Shared Cloud
Licensed software, not a hosted service. Your workloads never cross a vendor boundary.
Your account or your data center
AWS, GCP, Azure, or bare metal. Nothing needs KVM, so ordinary cloud VMs are fine.
No dependency on us
No hosted control plane, no license server, no telemetry. Our outage cannot become yours.
An open-source exit
Drop the commercial layers and the complete Apache-2.0 core remains yours.
The Questions Every Evaluation Raises
Sandlock shares the host kernel. Is that acceptable for untrusted code?
It is a kernel-enforced allowlist, not a VM. If your threat model includes a kernel exploit, run Sandlock inside the VM boundary you already trust; the Scheduler packs density inside it.
Why not Firecracker, or a hosted sandbox cloud?
Firecracker needs KVM and holds memory for every idle microVM. Hosted clouds run your customers' code on someone else's kernel. Sandlock runs unprivileged in your account and assigns memory only while a session executes.
Our fleet is not on Linux 6.12 yet.
The strict default refuses to start when a protection is missing. Each one can be waived explicitly and shows up in the posture evidence. Bring the kernel mix to the call.
What happens if we stop paying?
The API and Scheduler stop being licensed. The sandbox, SDKs, CLI, OCI runtime, and MCP server are Apache-2.0 and keep working. There is no license server to cut you off.
What Is Free, What Is Licensed, and How It Is Priced
Sandlock
Apache-2.0- Includes
- Core, CLI, Python, Rust, and Go SDKs, OCI runtime, MCP server.
- Limits
- None. No caps, no telemetry, no registration.
Sandbox HTTP API
Commercial- Includes
- API server and client SDKs. Unlimited sandboxes and keys per deployment.
- Priced by
- Fleet size.
Sandbox Scheduler
Commercial- Includes
- Placement, checkpoint store, and routers.
- Priced by
- Node count.
- Self-hosted only. No hosted or shared-tenant offering.
- Pilot first. On your infrastructure, against real traffic, before anything is signed.
- Support included. Engineering support and a response SLA with every license.
Evaluate It Against Your Workload
A thirty-minute engineering call with the CEO, sized against your numbers, then a pilot on your infrastructure. Bring the workload.