Every AI agent gets its own microVM: a real Linux machine behind a hardware boundary. Set one up once, then fork it mid-task to try many approaches in parallel. Forks share their parent's memory and disk, so each stores only what it changes.
Cloning, installing and warming caches takes minutes. Do it once, then fork the running machine as often as you like. Each fork wakes with the same memory, files and processes, then goes its own way. Try several fixes at once and keep the one that passes.
import os
from upstream import Upstream
client = Upstream(api_key=os.environ["UPSTREAM_API_KEY"])
with client.sandbox(template="python") as base:
base.exec(["sh", "-c", f"git clone {REPO} app && cd app && uv sync"])
# one prepared machine, one fork per candidate fix
forks = [base.fork() for _ in patches]
for sb, patch in zip(forks, patches):
sb.write_file("/workspace/app/fix.patch", patch)
r = sb.exec(["sh", "-c", "cd app && git apply fix.patch && uv run pytest -q"])
print(sb.sandbox_id, "pass" if r.exit_code == 0 else "fail")Memory, CPU state and disk are captured together, so a fork resumes mid-flight instead of booting cold.
The parent pauses only while its state is captured, then carries on. Forking never costs you the machine you forked.
Its own ID, token and network. Keep it, fork it again or throw it away without touching its siblings.
Most of a sandbox is identical to the one next to it: the same OS, runtimes and packages. upstream keeps one copy of the common parts and gives each sandbox a private layer on top. That is what makes a fork cheap, and it fits more sandboxes on every server.
Agents run whatever the model writes, so sharing must never weaken the boundary. Shared pages and blocks are read-only, and every write lands in a sandbox's private layer. Each sandbox is a Firecracker microVM, the technology behind AWS Lambda, with its own kernel, network and disk. A container would share the host's kernel.
Hardware virtualisation separates each sandbox from its neighbours and the host. An agent can be root inside and still reach nothing outside.
Sandboxes cannot reach each other, and outbound traffic goes only where policy allows it.
There is no open port on our servers to attack. Every request is checked three times before it reaches a sandbox, and its token opens that sandbox alone.
Run Claude Code, Codex or your own agent with a full shell and no risk to your laptop or production.
Give an assistant its own Python machine to analyse uploaded files, run code and hand back results.
Start every rollout from an identical machine state, so differences come from the model, not the setup.
Build and test every change, including agent-written ones, in a fresh VM restored from a warm template.
Expose a port from inside a sandbox so a person or an agent can open the running app in a browser.
Fork the machine the moment a test fails, then dig into the copy without re-running any setup.
Snapshot a long-running agent's machine and restore it later, exactly where it left off.
Execute code from users, models or pull requests behind a VM boundary with controlled egress.
Built in-house, mostly in Rust, on open foundations like Firecracker and Kubernetes. It runs on dedicated bare-metal servers rather than inside someone else's cloud, and the same stack can run on your hardware.
| compute | Firecracker microVMs on KVM · Rust guest agent as PID 1 · warm pool of restored VMs per template |
|---|---|
| memory | userfaultfd copy-on-write across fork chains · per-page reverse index · lz4 spill for diverged pages |
| storage | content-addressed block store · copy-on-write NBD overlays per sandbox · snapshot prefetch |
| network | namespace + TAP per VM · nftables egress policy · per-sandbox DNS |
| security | no inbound ports · OIDC at the edge, the proxy and the gateway · HMAC-scoped sandbox tokens · per-tenant rate limits |
| platform | Kubernetes on Talos Linux · bare metal · ingress only through an outbound Cloudflare tunnel |
| interfaces | ConnectRPC + REST API · WebSocket terminal · Python SDK · React console · metered per compute-second |
One API, a Python SDK, and a browser console with a live terminal.