Somewhere safe to run code nobody has read
An agent writes code and needs to run it immediately, in a place where the worst outcome is a machine you throw away. A real virtual machine gives you that boundary. Restoring one from a snapshot instead of booting it is what makes the boundary affordable.
A machine that was never off
Booting a Linux guest costs whatever the operating system costs, every time, which is why sandbox products either make you wait or keep idle machines burning money. pilots restores a memory snapshot of an already-running guest and pages memory in as the guest touches it.
These are the thresholds Phase 3 had to clear before it could close, timed on a laptop. Every number on this site carries its source. Hover one to see it. Fleet numbers replace these when there is a fleet to measure.
Checkpoint before the risky step, restore after it
An agent about to run a migration, an upgrade, or a command it just invented is one step away from a machine that no longer works. A checkpoint makes that step cheap to undo, and the restore puts the state back without putting a new machine in its place.
$ pilot checkpoint bold-otter --name pre-upgradecheckpoint pre-upgrade$ pilot exec bold-otter -- ./upgrade.shSegmentation fault$ pilot restore bold-otter pre-upgraderestored in placesame machine, same URL, same agent tokenIn place, on the same machine
Restoring does not spawn a fresh machine from a template and hand you a new address. It is the same row in the database, the same URL, and the same credential the agent is already holding. Anything else would force every client to re-discover where its work went.
Named and chained
Checkpoints have names and can be taken from a restored state, so an agent can walk back to a known-good point and try a different branch.
Durable in the background
The machine resumes as soon as the blocks it changed are copied, and the upload happens behind it. Durability is reported separately, so a client that genuinely needs the bytes in object storage can wait for exactly that.
Streaming exec, because agents produce output for minutes
Running a command and collecting its output at the end is fine for a script and useless for a model that emits tokens for several minutes. Both shapes exist in the guest agent and in the typed clients: buffered when you want a result, streamed over a socket when you want to watch. The streamed form does not answer on the public API yet, so the clients and the command line are written against a route the engine still refuses.
Working directory and environment
Every exec takes a directory, an environment, and a user, in both the buffered and the streaming form. A tool that only accepts them in one of the two forces its callers to pick between watching the output and running in the right place.
Optional stdin
A stream can be opened with no input side at all, which is what a long-running agent process wants: it never reads, and holding a half-open pipe for it is a way to lose the connection.
Typed JavaScript and Go clients cover every route, and each carries a test that parses the server's own source and fails when the wire types drift. The clients (opens in a new tab).
Exec counts as activity. A machine running a build with no HTTP traffic at all is not idle, and the idle monitor knows that, which is the difference between a 60s timer that is useful and one that suspends an agent mid-task.
The boundary is a whole virtual machine
Containers share a kernel, so a kernel bug is a tenant boundary failure. These are Firecracker microVMs with their own kernels, which is the isolation model the code you are about to run has not read.
Jailed and bounded
Each microVM runs under the jailer inside a cgroup slice that caps CPU, memory, and process count. A fork bomb inside is a fork bomb inside.
Egress firewalled
Traffic to private ranges, loopback, and link-local is dropped inside the guest’s own namespace, so a sandbox cannot reach the host or its neighbours.
Per-machine credentials
The token the guest agent accepts is minted per machine and never reused, so a leaked token is scoped to the machine that leaked it.
Disposable by design
The expected end state of a sandbox is destruction. Nothing about the platform assumes a machine is precious.
Owned by an org
Every machine, service, and volume carries the org that created it, and a key sees only what its org owns. A foreign id answers as not found rather than as forbidden, so existence does not leak across tenants.
Capped per org
Quotas bound what one org can hold: machines, cores, memory, volume space, and concurrent builds. A refusal names the ceiling it hit.
One address, whatever happens to the machine behind it
A sandbox that changes address when it sleeps is a sandbox every client has to poll for. Drive one through its lifecycle and watch the address hold.
- state
- running
- autoStop
- suspend
- minRunning
- 0
- replicas
- one
- checkpoints
- 0
A simulation of the state machine, not a live machine. The states, knobs, and transitions are the real ones.
- create machine created from template, URL assigned
Arbitrary ports are reachable too, at a prefixed name on the same address, so a dev server the agent started on some port is browsable without any tunnel to set up.
What a restore promises, and what it does not
Worth saying plainly, because the interesting case is the one where the fast path is unavailable and most platforms would simply fail.
A restore never fails because a memory image is gone. Memory snapshots carry raw CPUID, so one is portable within a CPU vendor pool and never across it. When no host of the image's pool is live, the machine cold-boots from its own disk instead.
What survives that: the id, the name, the URL, the volume, the agent token, and every byte the machine had written. What does not: the processes that were running and the memory they held. The machine reports last_start: cold_boot, so a client can tell the difference rather than discovering it from behaviour.
A request that arrives while a machine is asleep is held, not bounced, for up to 120s. That window is one number for a machine on the host you reached and for a machine one host over, so nothing a client can measure tells it where its sandbox lives.
The sandbox becomes the service
When something an agent built turns out to matter, it does not get rebuilt somewhere else. It gets promoted, keeps its address at pilotrun.app, and starts being health-checked.