Agent Sandboxesagentsandboxes.org
Sandbox profile · Hosted platform

Kernel

Answer in brief

Browsers for agents where each Chromium runs in its own Unikraft unikernel VM, with standby that stops billing, profiles, and open-source images under Apache-2.0. Hypervisor-isolated browsers with standby billing and open images, the most transparent isolation story among the closed clouds.

By the Agent Sandboxes editors · Updated

Overview

Kernel is browser infrastructure for web agents from the San Francisco company of the same name (YC S25). Every browser session runs inside a dedicated Unikraft-based unikernel virtual machine, so sessions are isolated at the hypervisor level rather than sharing a host kernel. You drive the Chromium over CDP or WebDriver BiDi with Playwright, through computer-use controls, or from the TypeScript, Python and Go SDKs, the kernel CLI and a hosted MCP server. The browser images (kernel-images, Apache-2.0) and the VM runtime (hypeman, MIT) are on GitHub and can be run locally with Docker.

Five seconds after the last client disconnects a browser enters standby, keeping its state without accruing usage; the deletion timeout (60 seconds by default, up to 72 hours) only starts then. Profiles persist the user data directory between browsers. Billing is per second of active browser time, with headful and GPU-accelerated tiers costing more, plus a monthly plan fee from $0 to $200. SOC 2 Type II and HIPAA are listed, and the company raised $22M in seed and Series A funding led by Accel in October 2025.

Notable

  • $22M seed and Series A led by Accel, announced 15 October 2025; Y Combinator Summer 2025 batch
  • Browser images open source under Apache-2.0 (kernel-images, 1.1k stars); VM runtime hypeman under MIT
  • Docs claim ~30 ms p50 browser creation; homepage benchmark claims 794 ms average cold start versus competitors

Kernel specifications

AttributeDetails
IsolationEach browser runs in a dedicated Unikraft-based unikernel VM, isolated at the hypervisor level with no shared host kernel; hypervisor not named in the docs
DeploymentHosted platform · Self-hostable
Open sourceYes (Apache-2.0)
SDKs and interfacesJavaScript/TypeScript, Python, Go, CLI, REST API, MCP server
Cold start (vendor claim)Docs state a browser is created in about 30 ms at p50 and 105 ms at p99; the unikernels page claims cold starts under 20 ms
Max session lengthTimeout defaults to 60 seconds and starts when the browser enters standby (5 seconds after the last client disconnects); configurable up to 72 hours
PersistenceStandby keeps browser state without billing until a client reconnects; Profiles capture the user data directory (cookies, auth, local storage, tabs) and are saved with save_changes; encrypted per organisation
GPUHeadful browsers with GPU acceleration at $0.0008000016 per second on Start-Up and Enterprise plans
NetworkingManaged residential proxy and captcha solver in stealth mode; configurable and bring-your-own proxies on higher plans; egress allowlists cover browser traffic through the proxy
PricingUsage per second: headless $0.0000166667/s, headful $0.0001333336/s, headful + GPU $0.0008000016/s; standby and idle pool browsers are not billed. Plans: Free $0 + usage ($5 credits, 5 concurrent), Hobbyist $30/month ($10 credits, 10 concurrent), Start-Up $200/month ($50 credits, 150 concurrent, regions, GPU), Enterprise custom
Free tierFree plan: $5 monthly credits, 5 concurrent browsers, 1-day replays; images are free to run yourself
ComplianceSOC 2 Type II (report on request); HIPAA; PCI DSS Level 4 (SAQ A); ISO 27001 and GDPR listed as in progress; zero data retention on Enterprise
Regionsus-east (default), eu-west, ap-southeast; region selection on Start-Up and Enterprise plans

Facts from Kernel’s public documentation, verified November 9, 2026. Performance numbers are vendor claims.

Strengths and trade-offs

Strengths

  • You want each browser in its own VM without paying for idle time
  • You need long-lived browsers (up to 72 hours) that survive client disconnects
  • You want to inspect or run the browser images yourself
  • You need GPU-accelerated headful browsers or regional placement

Trade-offs

  • Hypervisor is not named and the self-hosted unikernel path targets Unikraft Cloud rather than a local setup
  • Region selection, GPU and BYO proxies require the $200/month Start-Up plan
  • The documented cold-start figures vary between pages (under 20 ms, ~30 ms p50, 794 ms benchmark)
  • ISO 27001 and GDPR are still in progress

Good fit for: Agents that need fast, hypervisor-isolated browsers with pay-only-while-active billing.

Use cases Kernel fits

  • Computer use: Each browser runs in its own hypervisor-isolated unikernel VM, billed only while active.

How Kernel compares

SandboxIsolationOpen sourceSelf-host / BYOCCold start (vendor)Max sessionSnapshots / pauseGPUSDKs
KernelUnikernel VM per browserYesYes / No~30 ms p50 (claim)Up to 72 hYes / YesYesJavaScript/TypeScript, Python, Go, CLI, REST API, MCP server
Anchor BrowserDedicated VM per browserNoNo / YesNot documented3 h default, configurableNo / NoNoPython, JavaScript/TypeScript, REST API, MCP server
BrowserbaseIsolated Chromium sessionNoNo / No<2 s (claim)6 h (15 min Free)No / NoNoPython, JavaScript/TypeScript, REST API, MCP server
SteelIsolated Chromium sessionYesYes / NoNot documented15 min / 1 h / 24 hNo / NoNoPython, JavaScript/TypeScript, Go, Rust, CLI, REST API, MCP server
HyperbrowserIsolated browser instanceNoNo / No<500 ms (claim)Up to 12 hNo / NoNoPython, JavaScript/TypeScript, CLI, REST API, MCP server
Browser Use CloudIsolated browser per runNoNo / NoNot documented1 h default, 4 h maxNo / NoNoPython, JavaScript/TypeScript, REST API
Unikraft CloudmicroVM (modified Firecracker)NoYes / Yes<10 ms (claimed)Not documentedYes / YesYesJavaScript/TypeScript, Python, Go, CLI, REST API

See all Kernel alternatives →

Frequently asked questions

What is Kernel?
Browsers for agents where each Chromium runs in its own Unikraft unikernel VM, with standby that stops billing, profiles, and open-source images under Apache-2.0. Hypervisor-isolated browsers with standby billing and open images, the most transparent isolation story among the closed clouds.
How does Kernel isolate code?
Kernel documents its isolation as: Each browser runs in a dedicated Unikraft-based unikernel VM, isolated at the hypervisor level with no shared host kernel; hypervisor not named in the docs.
Is Kernel open source?
Yes (Apache-2.0). It can be self-hosted.
How much does Kernel cost?
Usage per second: headless $0.0000166667/s, headful $0.0001333336/s, headful + GPU $0.0008000016/s; standby and idle pool browsers are not billed. Plans: Free $0 + usage ($5 credits, 5 concurrent), Hobbyist $30/month ($10 credits, 10 concurrent), Start-Up $200/month ($50 credits, 150 concurrent, regions, GPU), Enterprise custom Check the official pricing page for current rates.
What are the alternatives to Kernel?
Common alternatives include Anchor Browser, Browserbase, Steel, Hyperbrowser, Browser Use Cloud, Unikraft Cloud. See Kernel alternatives for a full comparison.

Sources

  1. kernel.sh/
  2. kernel.sh/pricing
  3. kernel.sh/docs/introduction
  4. kernel.sh/docs/info/unikernels.md
  5. kernel.sh/docs/info/pricing.md
  6. kernel.sh/docs/security.md
  7. kernel.sh/docs/browsers/termination.md
  8. kernel.sh/docs/browsers/profiles.md
  9. kernel.sh/docs/browsers/regions.md
  10. kernel.sh/blog/series-a-announcement
  11. github.com/onkernel/kernel-images
  12. github.com/onkernel/hypeman

Cite this page

Agent Sandboxes. (2026). Kernel. agentsandboxes.org. Last reviewed November 9, 2026. https://agentsandboxes.org/sandboxes/kernel/

Found an error or a missing sandbox? Submit a correction — every entry links to the sources it relies on.