Sandboxes
that fork.
Every AI agent gets its own microVM. Set one up once, then fork it mid-task into as many copies as you need.
Forks share pages
until they write.
A fork maps its parent's memory instead of copying it. Each hollow page is still shared. A page turns gold when the fork writes to it, and only then is it copied.
Identical blocks,
stored once.
Every disk is made of blocks named by their content. In this example, four sandboxes reference 24 disk blocks. Only 9 are different, so the store keeps 9.
A wall around
every agent.
Each agent runs in its own microVM, with private memory, files and network. DNS and firewall rules control outbound access. Agents can read the shared base, but cannot change it or reach neighbouring sandboxes.
Fork it from Python.
Prepare a repository once, then try one candidate fix per fork and keep whichever passes.
import os
from upstream import Upstream
REPO = "https://github.com/you/app"
SETUP = f"git clone {REPO} app && cd app && uv sync"
TEST = "cd app && git apply fix.patch && uv run pytest -q"
client = Upstream(api_key=os.environ["UPSTREAM_API_KEY"])
def try_fixes(patches):
with client.sandbox(template="python") as base:
base.exec(["sh", "-c", SETUP])
# one prepared machine, one fork per candidate fix
forks = [base.fork() for _ in patches]
for sb, patch in zip(forks, patches):
sb.write_file("/workspace/app/fix.patch", patch)
r = sb.exec(["sh", "-c", TEST])
print(sb.sandbox_id, "pass" if r.exit_code == 0 else "fail")
sb.destroy()Capture the whole machine
Memory, CPU state and disk are captured together, so a fork resumes mid-flight instead of booting cold.
The original keeps going
The parent pauses only while its state is captured, then carries on.
Each fork stands alone
It has its own ID, token and network. You can keep it, fork it again or destroy it.
Anywhere an agent needs a real computer.
Coding agents
Run Claude Code, Codex or your own agent with a full shell and no risk to your laptop or production.
Code interpreter
Give an assistant its own Python machine to analyse uploaded files, run code and hand back results.
Evals & training
Start every rollout from the same machine state, so any difference in results comes from the model.
CI runners
Build and test every change, including agent-written ones, in a fresh VM restored from a warm template.
Live previews
Expose a port from inside a sandbox so a person or an agent can open the running app in a browser.
Debug from failure
Fork the machine the moment a test fails, then dig into the copy without re-running any setup.
Checkpoint & resume
Snapshot a long-running agent's machine and restore it later where it left off.
Untrusted code
Execute code from users, models or pull requests behind a VM boundary with controlled egress.
From the page fault to the browser.
Written mostly in Rust, on top of Firecracker and Kubernetes. It runs on dedicated bare-metal servers, and the same stack can run on your own hardware.
| compute | Firecracker microVMs on KVM · Rust guest agent as PID 1 · warm pool of restored VMs per template |
|---|---|
| memory | userfaultfd copy-on-write across fork chains · per-page reverse index · lz4 spill for diverged pages |
| storage | content-addressed block store · copy-on-write NBD overlays per sandbox · snapshot prefetch |
| network | namespace + TAP per VM · nftables egress policy · per-sandbox DNS |
| security | no inbound ports · OIDC at the edge, the proxy and the gateway · HMAC-scoped sandbox tokens · per-tenant rate limits |
| platform | Kubernetes on Talos Linux · bare metal · ingress only through an outbound Cloudflare tunnel |
| interfaces | ConnectRPC + REST API · WebSocket terminal · Python SDK · React console · metered per compute-second |
Snapshot once.
Fork many times.
Capture a running machine, then branch it as often as you like through the API or the Python SDK.