InstaVM
Firecracker-based Linux microVMs for agents with sub-200 ms claimed boots, snapshots, clones, persistent volumes, a desktop runtime and SSH access, with a local Apple-container companion (CodeRunner). A broad, fast microVM platform for agent builders; confirm regions and session limits with the vendor before committing production workloads.
Overview
InstaVM is a hosted platform that boots a full Linux microVM per sandbox, based on Firecracker, with a dedicated kernel, filesystem and network stack. You reach it through Python and TypeScript SDKs, an instavm CLI, a REST API or plain ssh instavm.dev, and an agent skill exists for Claude Code, Codex, Gemini CLI and others. Sandboxes default to 2 vCPU and 512 MB (1–8 vCPU, 256–8,192 MB) and run Python 3.11+ and Node.js 18+ with common tools. A desktop runtime with browser, terminal, sudo and noVNC live takeover supports computer-use agents, and instavm deploy (marked experimental) can publish an app from a VM with a share URL.
Persistence comes from named volumes with checkpoints, pause/snapshot/resume/clone of VMs and always-on VMs for deployed apps or MCP servers. Billing is per second for vCPU and RAM with no idle charges, on a Free plan ($50 starting credit) or Pro at $100/month plus usage; Enterprise adds dedicated infrastructure and SOC 2 Type II. Outbound traffic is default-deny with allowlists. The companion CodeRunner project (Apache-2.0, 901 GitHub stars) runs agent code locally on Apple Silicon inside Apple's container VMs. Regions, GPU support and maximum session length are not documented.
Notable
- Website: "185ms" P95 cold start and "Provision a fresh VM in ~147ms" (vendor figures).
- Site badge claims "#1 on Hacker News" with 1,143 votes; the Enterprise plan lists SOC 2 Type II and a 99.99% SLA.
- CodeRunner, the local Mac companion, is Apache-2.0 with 901 GitHub stars; Linux support via Firecracker is on its roadmap.
InstaVM specifications
| Attribute | Details |
|---|---|
| Isolation | Firecracker microVM with its own kernel, filesystem and network stack per sandbox |
| Deployment | Hosted platform |
| Open source | No |
| SDKs and interfaces | Python, JavaScript/TypeScript, CLI, REST API |
| Cold start (vendor claim) | Website: "185ms" P95 cold start, "Provision a fresh VM in ~147ms" over SSH, snapshot restore "typically under 500ms" (vendor claims) |
| Max session length | Session lifetime is configurable; no maximum documented; always-on VMs are offered |
| Persistence | State persists across execute() calls within a session and is destroyed when it ends; named volumes persist across VM lifecycles with mid-task checkpoints; VMs can be paused, snapshotted, resumed or cloned; snapshots built from OCI images |
| GPU | Not documented |
| Networking | Default-deny outbound with domain/CIDR allowlists and package-manager controls (Free plan egress limited to known package managers and AI APIs; Pro unrestricted or allowlists); proxy-based secret injection; shares expose any port publicly or privately with custom domains |
| Pricing | Per second: $0.000014 per vCPU (about $0.05/hour) and $0.0000045 per GB of RAM (about $0.02/hour); 10 GB volume storage included, then $0.0002 per GB-hour. Free plan $0 base plus usage (5 concurrent VMs); Pro $100/month plus usage (100 concurrent VMs, 99.9% SLA); Enterprise custom |
| Free tier | $50 in starting credits with a card on file; 5 concurrent VMs and 100 browser sessions a month |
| Compliance | "SOC 2 Type II compliance" listed as an Enterprise plan feature; no report details published |
| Regions | Not documented |
Facts from InstaVM’s public documentation, verified November 9, 2026. Performance numbers are vendor claims.
Strengths and trade-offs
Strengths
- You want fast microVM boots with per-second billing and a $50 trial.
- You need desktop and browser automation with live noVNC takeover.
- You want to clone a running VM or checkpoint a volume mid-task.
- You prefer SSH-first access without installing an SDK.
Trade-offs
- Free plan egress is restricted to known package managers and AI APIs.
- Regions, GPU support and maximum session length are not documented.
- SOC 2 Type II is listed only as an Enterprise feature with no report details.
- A card must be on file even for the free tier.
Good fit for: Agent builders who want fast-booting microVMs with desktop, SSH and snapshot-clone workflows under per-second billing.
How InstaVM compares
| Sandbox | Isolation | Open source | Self-host / BYOC | Cold start (vendor) | Max session | Snapshots / pause | GPU | SDKs |
|---|---|---|---|---|---|---|---|---|
| InstaVM | Firecracker microVM | No | No / No | <200 ms (claim) | Configurable | Yes / Yes | Not documented | Python, JavaScript/TypeScript, CLI, REST API |
| E2B | Firecracker microVM | Yes | Yes / Yes | Not documented | 1 h / 24 h (Pro) | Yes / Yes | No | Python, JavaScript/TypeScript |
| Leap0 | Firecracker microVM | No | No / Yes | ~100 ms (claim) | 8 h max | Yes / Yes | Not documented | Python, JavaScript/TypeScript, Go, MCP server |
| Superserve | Firecracker microVM | No | No / Yes | Not documented | Unlimited | Yes / Yes | Not documented | Python, JavaScript/TypeScript, CLI, REST API, MCP server |
| Runtime | Firecracker microVM | No | No / No | Not documented | No limit documented | Yes / Yes | Not documented | JavaScript/TypeScript, Python, Go, Ruby, Java, CLI, REST API, MCP server |
| Scrapybara | Not documented | No | No / No | <1 s (claimed) | 1 h default, configurable | No / Yes | No | Python, JavaScript/TypeScript, REST API, MCP server, CLI |
| Cua | gVisor container or VM | Yes | Yes / No | Not documented | Until destroyed | Yes / Yes | Not documented | Python, JavaScript/TypeScript, Rust, CLI, MCP server |
Frequently asked questions
What is InstaVM?
How does InstaVM isolate code?
Is InstaVM open source?
How much does InstaVM cost?
What are the alternatives to InstaVM?
Sources
Cite this page
Agent Sandboxes. (2026). InstaVM. agentsandboxes.org. Last reviewed November 9, 2026. https://agentsandboxes.org/sandboxes/instavm/
Found an error or a missing sandbox? Submit a correction — every entry links to the sources it relies on.