Depot Sandboxes
MicroVM sandboxes on the bare-metal compute behind Depot CI, with a TypeScript SDK, Tailscale networking and a Managed Agents service that hosts Claude Code, Codex, Devin and Amp sessions. A sensible add-on for Depot CI customers, less compelling as a standalone sandbox given the file-only snapshots and limited SDK coverage.
Overview
Depot, the container-build and CI acceleration company, exposes the compute behind Depot CI as sandboxes: microVMs on bare-metal hosts with NVMe storage, on x86-64 or ARM64, with Docker and nested virtualisation. Two surfaces exist. The Sandbox SDK (@depot/sandbox, Node.js, announced as a private beta on 18 June 2026) creates sandboxes, streams commands and exposes a node:fs/promises-style filesystem. Managed Agents hosts sessions from Amp, Claude Code, Claude Managed Agents, Devin and OpenAI in Depot sandboxes of 2-16 vCPUs, replacing the earlier depot claude remote agent product, with automatic workspace snapshots, Tailscale access to private services and a depot-mcp bridge.
Snapshots capture files only and stopped sandboxes cannot restart, so this is an ephemeral-run model rather than a persistent computer. Pricing is per second against a monthly minute pool shared with CI, which suits existing Depot customers more than standalone use; the Business tier offers deployment in your own AWS account. The hypervisor, regions and compliance are not documented on the sandbox pages, and the SDK's current status beyond the June private-beta note is not stated.
Notable
- Sandbox SDK announced in private beta on 18 June 2026; Managed Agents replaced the earlier Claude Code remote agent product
- Sizes from 2 to 64 vCPUs on Intel or Arm; Managed Agents at 2, 4, 8 or 16 vCPUs
- Business plan offers dedicated infrastructure deployed in your own AWS account
Depot Sandboxes specifications
| Attribute | Details |
|---|---|
| Isolation | MicroVM per sandbox on bare-metal hosts ("Real microVMs, not containers") with a full Linux syscall interface, Docker and nested VMs; hypervisor not named |
| Deployment | Hosted platform · BYOC available |
| Open source | No |
| SDKs and interfaces | JavaScript/TypeScript, CLI |
| Cold start (vendor claim) | Blog: "fast boot from a pre-cached base image"; no figure |
| Max session length | Runs until stopped or the configured timeout expires; the SDK launch post gives a default timeout of two hours with extensions; no maximum stated; a stopped sandbox cannot be restarted |
| Persistence | Snapshots save the home and /workspace directories (not processes or memory) and seed new sandboxes; Managed Agents snapshot the workspace automatically between runs, excluding node_modules, .venv and target; stopped sandboxes cannot be resumed; persistent disk was listed as planned |
| GPU | Not mentioned |
| Networking | Sandboxes can join your organisation's Tailscale tailnet to reach private services; Depot Cache credentials are injected by default; run secrets are scoped to up to 16 hosts each; no egress allow-list documented |
| Pricing | Developer $20/month with 2,000 included minutes, Startup $200/month with 20,000, Business custom (dedicated infrastructure, deployment in your own AWS account); minutes are shared across Depot CI, Sandboxes and Managed Agents and measured at 2 vCPU, so the default 4 vCPU sandbox uses 2 minutes per minute; overage $0.00005 per vCPU-second, billed per second with no minimum; storage 25 GB / 250 GB included then $0.20/GB-month |
| Free tier | 7-day trial on Developer and Startup plans; no permanent free tier |
| Compliance | Not documented |
| Regions | Not documented |
Facts from Depot Sandboxes’s public documentation, verified November 9, 2026. Performance numbers are vendor claims.
Strengths and trade-offs
Strengths
- You use Depot CI and want sandbox and agent minutes from the same pool with shared caches
- You want hosted Claude Code, Codex, Devin or Amp sessions that survive closing your laptop
- You need sandboxes on your Tailscale tailnet to reach private services
- You want Arm as well as x86 microVMs
Trade-offs
- Snapshots save files only; no memory snapshots, pause or restart of stopped sandboxes
- TypeScript-only SDK, and it was private beta at announcement
- Hypervisor, regions and compliance not documented
- No free tier beyond a 7-day trial
Good fit for: Teams on Depot CI who want agent sandboxes and hosted coding-agent sessions billed from the same minute pool.
How Depot Sandboxes compares
| Sandbox | Isolation | Open source | Self-host / BYOC | Cold start (vendor) | Max session | Snapshots / pause | GPU | SDKs |
|---|---|---|---|---|---|---|---|---|
| Depot Sandboxes | MicroVM on bare metal | No | No / Yes | Not documented | 2 h default timeout | Yes / No | Not documented | JavaScript/TypeScript, CLI |
| Namespace | KVM virtual machine | No | No / No | Not documented | Deadline-based; Devbox 3-24 h | Yes / Yes | Not documented | JavaScript/TypeScript, Go, CLI, MCP server, gRPC/Connect API |
| Railway Sandboxes | Linux VM | No | No / No | Not documented | No cap (idle 30 min default) | Yes / No | Not documented | JavaScript/TypeScript, CLI, GraphQL API |
| Docker Cloud Sandboxes | MicroVM, own kernel | No | No / No | ~100s of ms (claim) | 1 h default TTL | Yes / Yes | No | CLI, JavaScript/TypeScript, REST API |
| E2B | Firecracker microVM | Yes | Yes / Yes | Not documented | 1 h / 24 h (Pro) | Yes / Yes | No | Python, JavaScript/TypeScript |
| Blaxel | MicroVM | No | No / Yes | <25 ms resume | Unlimited (standby) | Yes / Yes | Not documented | TypeScript, Python, Go |
| Modal Sandboxes | gVisor or VM | No | No / Not documented | <1 s | Up to 24 h | Yes / Yes | Yes | Python, JavaScript/TypeScript, Go |
Frequently asked questions
What is Depot Sandboxes?
How does Depot Sandboxes isolate code?
Is Depot Sandboxes open source?
How much does Depot Sandboxes cost?
What are the alternatives to Depot Sandboxes?
Sources
Cite this page
Agent Sandboxes. (2026). Depot Sandboxes. agentsandboxes.org. Last reviewed November 9, 2026. https://agentsandboxes.org/sandboxes/depot-sandboxes/
Found an error or a missing sandbox? Submit a correction — every entry links to the sources it relies on.