Skip to main content
TL;DR — One Podflare sandbox is a real Linux box. Root filesystem, 1–16 GB RAM, full internet, pip install anything, persistent Python REPL, sub-100 ms fork(), freeze-to-disk for later resume. Not a container. Not a serverless function. A real VM your agent owns.

The shape of one sandbox

Real capabilities, real code

Every snippet below runs, end-to-end, today.

1. Install any package you want

No allowlist. No proxy. Real pip with real internet.
Same deal for npm, cargo, apt, whatever the base image has.

2. Call any external API

Outbound IP seen by the API is the sandbox’s region IP (MASQUERADE via the host).

3. Persistent Python REPL

State carries across run_code calls. This is the feature that makes agent loops actually cheap — no re-parsing CSVs, no re-loading models, no re-importing pandas on every tool call.
Under the hood each exec hits the same running Python process over a vsock control channel. globals() persists.

4. Full filesystem — write files, run commands, keep artifacts

upload / download go over the control channel (fast, no egress billing). git clone goes out to the internet directly.

5. fork() — tree-search without state hell

Snapshot the parent sandbox mid-flight, spawn N children each starting from the parent’s exact state. Copy-on-write memory + reflinked rootfs means a fork costs ~80 ms end-to-end with near-zero per-child memory overhead.
This is the primitive that agent tree-search, hypothesis testing, and “try 5 refactors and take the one that compiles” workflows are built on.

6. Persistent Spaces — freeze now, resume later

A sandbox created with persistent=True is frozen into a Space when its idle timeout fires — memory, running processes, Python REPL state, filesystem, all preserved on disk. Resume it later and pick up exactly where you left off.
Single-shot resume: each Space is consumed by one resume, then gone. Re-freeze by creating the resumed sandbox with persistent=True.

7. Multi-region, automatically routed

api.podflare.ai is a Cloudflare Worker that geo-routes your requests to the nearest region, with automatic failover on 5xx. SDK 0.0.20 defaults here. Or pin explicitly:
Measured from California residential wifi, 100 iter, SDK 0.0.20: edge-routed p99 = 221 ms, direct-to-usw1 p99 = 483 ms. The “extra hop” through Cloudflare is shorter wall-clock than the public-internet route to the origin. Direct is reserved for in-cloud callers that are already co-located with a specific region.

What a sandbox is not

  • Not a container. Each sandbox is its own kernel, its own page tables, its own virtualized hardware. Container escapes don’t apply.
  • Not a serverless function. No 15-second timeout, no cold-start penalty per invocation. State persists across run_code calls; the VM stays alive for the idle / max-lifetime window you pick.
  • Not a shared REPL service. Each sandbox belongs to exactly one caller. Cross-tenant visibility at the network, memory, or filesystem layer is not possible by construction.

Tier caps (silent clamps, no errors)

If your API key’s tier doesn’t allow the value you requested, we silently clamp instead of erroring — your code still runs, just with the tier-appropriate ceiling. See pricing.

The minimum program

If all you want is to prove to yourself that the whole thing works:
That’s the whole onboarding. Real compute, real network, real state, in one with block.

Fork

Tree-search branching in ~80 ms

Persistent REPL

Why your variables survive across calls

Warm pool

How create() returns in 7 ms

Pricing

What tier unlocks what