Baponi
Call-per-execution code sandbox built on a hardened nsjail, with sub-20 ms setup, persistent thread state and bring-your-own-bucket storage. A fast, stateless-by-default execution API with bucket-backed state, best for interpreter-style bursts rather than long-lived agent workspaces.
Overview
Baponi is a hosted code-execution service whose tagline is "Run code, not containers": each API call spins up a fresh isolated environment, runs the code and tears it down, so there is no container lifecycle to manage and no idle billing. Isolation is OS-level, built on a hardened build of Google's nsjail with namespaces, seccomp-bpf, cgroups v2 and zero capabilities, with the orchestration layer written in Rust; Baponi says it contributes to nsjail. Python 3.14, Node.js 25 and Bash are available by default and custom OCI images can be imported. Access is via a REST endpoint, a Python SDK or an MCP server for Claude Desktop, Cursor and similar clients, with connectors for databases, Git hosts and Slack.
State persists through a thread_id, which saves the home-directory diff between calls, and through /data mounts that can point at your own S3, GCS or Azure bucket (read-only and sub-path scoping supported) or Baponi-managed volumes. Pricing is credit-based rather than per second: Free with 1,000 credits a month, Pro at $97/month, and an Enterprise tier that deploys the whole platform into your Kubernetes cluster or VPC with a Helm chart, including air-gapped installs. SOC 2 Type 1 preparation is scheduled for Q4 2026; no certification is held yet.
Notable
- Docs: sandbox setup "typically 12–18ms"; the website advertises "<20ms" on every call.
- Trust centre (dated June 2026) lists SOC 2 Type 1 preparation starting Q4 2026 and a penetration test due within 90 days of first production deployment.
- Enterprise self-hosting uses a single Helm chart on any Kubernetes cluster, with bring-your-own OIDC, PostgreSQL and storage.
Baponi specifications
| Attribute | Details |
|---|---|
| Isolation | Hardened nsjail (Linux namespaces, seccomp-bpf syscall filtering, cgroups v2, zero capabilities) sharing the host kernel; no hypervisor |
| Deployment | Hosted platform · BYOC available · Self-hostable |
| Open source | No |
| SDKs and interfaces | Python, REST API, MCP server |
| Cold start (vendor claim) | Docs: "typically 12–18ms for sandbox setup"; website claims "<20ms" cold-start overhead on every call |
| Max session length | Per execution: 60 seconds on Free, 1 hour on Pro, unlimited on Enterprise (timeout range 1–3600 s); nothing runs between calls |
| Persistence | With a thread_id, the diff of /home/baponi is saved to cloud storage after each call and restored on the next (retention 24 hours, 7 days, 30 days or forever); /data mounts (your own S3, GCS or Azure bucket, or managed volumes) are always persistent; /tmp is ephemeral |
| GPU | Not documented |
| Networking | Blocked by default (no network interface, no DNS); unrestricted mode allows outbound internet with private IPs and cloud metadata endpoints always blocked, 200 Mbps per core; API keys can only downgrade a policy |
| Pricing | Credits: 1 credit = 60 seconds at 1 CPU/1 GiB, scaling with resources. Free $0 with 1,000 credits/month; Pro $97/month with 10,000 credits and $1.00 per 1,000 extra, up to 4 CPU/4 GiB, 100 concurrent runs; Enterprise custom (self-hosted). Extra managed storage $0.10/GB/month |
| Free tier | Free plan: 1,000 credits/month, 5 concurrent runs, 60 s max execution, 1 CPU/1 GiB, 10 GB managed storage, no card required |
| Compliance | No certifications held; trust centre lists SOC 2 Type 1 preparation "kickoff Q4 2026" and a DPA on request |
| Regions | Not documented |
Facts from Baponi’s public documentation, verified November 9, 2026. Performance numbers are vendor claims.
Strengths and trade-offs
Strengths
- You want very fast per-call execution with no sandbox lifecycle to manage.
- You need the sandbox to read and write your own cloud bucket as a local directory.
- You run agents through MCP clients and want a hosted MCP endpoint.
- You are an enterprise that must self-host on Kubernetes, including air-gapped.
Trade-offs
- OS-level isolation (nsjail) shares the host kernel; there is no microVM option.
- Executions are capped at 60 s on Free and 1 hour on Pro; no long-lived processes.
- No compliance certification yet; SOC 2 Type 1 work starts Q4 2026.
- Only a Python SDK is documented; no TypeScript SDK.
Good fit for: High-volume, short code executions from agents and MCP clients where state is kept in your own bucket.
How Baponi compares
| Sandbox | Isolation | Open source | Self-host / BYOC | Cold start (vendor) | Max session | Snapshots / pause | GPU | SDKs |
|---|---|---|---|---|---|---|---|---|
| Baponi | nsjail (OS-level) | No | Yes / Yes | <20 ms (claim) | 60 s / 1 h (Pro) | Not documented / No | Not documented | Python, REST API, MCP server |
| E2B | Firecracker microVM | Yes | Yes / Yes | Not documented | 1 h / 24 h (Pro) | Yes / Yes | No | Python, JavaScript/TypeScript |
| Codapi | Locked-down Docker container | Yes | Yes / No | 1-3 s per run (claim) | 5 s default | No / No | No | REST API, JavaScript/TypeScript |
| Judge0 | isolate (namespaces/cgroups) | Yes | Yes / No | Not documented | 5 s wall (max 20 s) | No / No | No | REST API, Python, JavaScript/TypeScript |
| HopX | Firecracker microVM | No | No / No | ~100 ms (claim) | No cap | Not documented / Yes | Not documented | Python, JavaScript/TypeScript, CLI, REST API, MCP server |
| Modal Sandboxes | gVisor or VM | No | No / Not documented | <1 s | Up to 24 h | Yes / Yes | Yes | Python, JavaScript/TypeScript, Go |
| Upstash Box | Docker container | No | No / No | Not documented | No cap (idle pause 1 h / 6 h) | Yes / Yes | No | JavaScript/TypeScript, Python, CLI, MCP server |
Frequently asked questions
What is Baponi?
How does Baponi isolate code?
Is Baponi open source?
How much does Baponi cost?
What are the alternatives to Baponi?
Sources
Cite this page
Agent Sandboxes. (2026). Baponi. agentsandboxes.org. Last reviewed November 9, 2026. https://agentsandboxes.org/sandboxes/baponi/
Found an error or a missing sandbox? Submit a correction — every entry links to the sources it relies on.