Sandbox explainers
How a sandbox runs your code
A scroll-driven walkthrough of the journey agent code takes: one API call, a microVM that boots in ~150ms, isolated execution behind a kernel boundary, the result streaming back, snapshot, and teardown.
Open the explainer → AImicroVM vs container vs isolate
A scroll-driven look at the three sandbox isolation models, plus gVisor: where each draws the security boundary, what the stronger wall costs in start-up time, and which to use for untrusted or AI-generated code.
Open the explainer → AIHow snapshots and forking work
A scroll-driven walkthrough of how sandboxes keep and branch state: snapshotting the whole machine, restoring it far faster than a cold start, forking one state into many with copy-on-write, pausing to stop the bill, and rewinding an agent to the moment before it failed.
Open the explainer →What moved in the sandbox world, every Friday.
Pricing changes, new entrants, benchmark refreshes and one sharp take from Eve Harper. Read by engineers choosing where their agents and apps run. No fluff. Read the archive.