Sandbox profile · Hosted platform

Tensorlake Sandboxes

Answer in brief

MicroVM sandboxes with memory snapshots, copy-on-the-fly cloning, warm pools and egress policy, alongside hosted Git and a versioned filesystem, with an Apache-2.0 runtime and BYOC on AWS. A feature-rich microVM platform for agent harnesses at scale, with open-source and BYOC options that most hosted peers lack.

By the Agent Sandboxes editors · Updated November 9, 2026

Overview

Tensorlake describes itself as "a serverless runtime for sandboxes and background agentic applications". Sandboxes are microVMs (hardware virtualisation via KVM; hypervisor unnamed) created from Python, TypeScript or Rust SDKs, the tl CLI or HTTP, with SSH, VS Code, Cursor and JetBrains Gateway access. Alongside them sit a versioned POSIX filesystem, managed Git with server-side merges and an orchestration layer for durable workflows. The core runtime is published on GitHub under Apache-2.0, and a self-hosted compute mode runs the executors on bare-metal EC2 in your own AWS account while Tensorlake keeps the control plane.

State handling is the strongest part of the feature set: named sandboxes suspend and resume with memory, checkpoints can be filesystem-only or full memory snapshots, copy clones a running sandbox including processes, and pools pre-warm sandboxes. Egress policy is default-open with allow and deny lists that can be changed live. Pricing bills active CPU, allocated RAM and disk per second, with a free plan, prepaid credit packs and a $250/month Pro plan; H100 GPU sandboxes are available by request on gVisor. The homepage lists SOC 2 Type II and HIPAA and names Redpoint and Amplify Partners as backers, and it integrates with Claude Managed Agents, Cursor Cloud Agents, Devin and Harbor for evals and RL.

Notable

Core runtime open source under Apache-2.0 (github.com/tensorlakeai/tensorlake)
Self-hosted compute / BYOC mode runs sandbox executors on i7i.metal EC2 instances in your AWS account
Vendor benchmark claims an 84 ms cold start and a 1.000 score on terminal-bench 2.1 with the oracle agent

Tensorlake Sandboxes specifications

Attribute	Details
Isolation	MicroVM per sandbox using hardware virtualisation (hosts must expose /dev/kvm); hypervisor not named; GPU sandboxes run on gVisor instead
Deployment	Hosted platform · BYOC available · Self-hostable
Open source	Yes (Apache-2.0)
SDKs and interfaces	Python, JavaScript/TypeScript, Rust, CLI, REST API
Cold start (vendor claim)	Docs: CPU microVMs "boot in hundreds of milliseconds"; homepage cites the vendor's own SQLite benchmark with an 84 ms cold start and about one second to suspend or resume (vendor claims)
Max session length	Idle timeout (default 600 s), not a wall-clock cap; plan maximums are 2 hours (Free), 24 hours (Usage Credits) and unlimited (Pro, Enterprise); named sandboxes suspend on timeout, ephemeral ones terminate
Persistence	Named sandboxes suspend and resume with memory and filesystem intact; filesystem or memory snapshots (checkpoints) persist after termination and can be restored with different resources; `copy` clones a running or suspended sandbox, including memory and processes, into one or many warm-started sandboxes; terminated sandboxes can be restarted under the same ID for 48 hours
GPU	Yes, by request only: H100 GPU sandboxes on gVisor at $3.95 per GPU-hour (reserved), with no live resizing or Tensorlake filesystem mounts
Networking	Outbound open by default; `allow_out` turns the sandbox default-deny (domains, wildcard subdomains, IPv4, CIDRs) and `deny_out` overrides it; policy can be changed at runtime; inbound only to ports listed in `exposed_ports`, authenticated unless explicitly opened; shared NAT egress IPs for allow-listing; SSH over WebSocket PTY and port tunnels
Pricing	Usage Credits / Pro per second: active CPU $0.07 / $0.042 per core-hour (minimum 20% of allocated vCPU), RAM $0.015 / $0.009 per GB-hour, root disk $0.0002 / $0.0001 per GB-hour, snapshot storage $0.07 per GB-month while suspended; egress free. Usage Credits are prepaid packs from $5 (1 CU = $0.01); Pro is $250/month including 25,000 CU with $0.01/CU overage; Enterprise custom
Free tier	Free plan: 1 concurrent sandbox, 1 vCPU/1 GB/10 GB, sessions up to 2 hours
Compliance	Homepage and docs claim SOC 2 Type II and HIPAA; EU data residency and zero data retention are listed on the docs index
Regions	Not listed; the docs mention EU data residency and BYOC into your own AWS account

Facts from Tensorlake Sandboxes’s public documentation, verified November 9, 2026. Performance numbers are vendor claims.

Strengths and trade-offs

Strengths

You need memory snapshots and cloning of running sandboxes for parallel agents or RL rollouts
You want warm pools and queued creation for bursty, high-concurrency workloads
You need to run the sandbox data plane inside your own AWS account
You want hosted Git and a versioned filesystem next to the sandbox

Trade-offs

Hypervisor is not named in the docs
GPU sandboxes are by request only and use gVisor rather than a VM
No published region list
Free plan allows one 1 vCPU sandbox with 2-hour sessions

Good fit for: Agent harnesses, RL rollouts and coding agents that need memory snapshots, cloning and warm pools at scale.

Use cases Tensorlake Sandboxes fits

RL & evals: Memory snapshots, cloning and warm pools at scale for RL rollouts and agent harnesses, on Firecracker and Cloud Hypervisor VMs.
GPU workloads: H100 GPU sandboxes on gVisor by request, at a reserved per-GPU-hour rate, alongside its CPU sandboxes.

How Tensorlake Sandboxes compares

Sandbox	Isolation	Open source	Self-host / BYOC	Cold start (vendor)	Max session	Snapshots / pause	GPU	SDKs
Tensorlake Sandboxes	MicroVM (gVisor for GPU)	Yes	Yes / Yes	~100s of ms (claim)	2 h / 24 h / unlimited (Pro)	Yes / Yes	Yes	Python, JavaScript/TypeScript, Rust, CLI, REST API
E2B	Firecracker microVM	Yes	Yes / Yes	Not documented	1 h / 24 h (Pro)	Yes / Yes	No	Python, JavaScript/TypeScript
Daytona	Containers or VMs	No	Not documented / Yes	<90 ms	Unlimited	Yes / Yes	Yes	Python, TypeScript, Ruby, Go, Java
Modal Sandboxes	gVisor or VM	No	No / Not documented	<1 s	Up to 24 h	Yes / Yes	Yes	Python, JavaScript/TypeScript, Go
Morph Cloud	VM	No	No / Not documented	<250 ms (restore)	Configurable	Yes / Yes	Not documented	Python, TypeScript
Blaxel	MicroVM	No	No / Yes	<25 ms resume	Unlimited (standby)	Yes / Yes	Not documented	TypeScript, Python, Go
Namespace	KVM virtual machine	No	No / No	Not documented	Deadline-based; Devbox 3-24 h	Yes / Yes	Not documented	JavaScript/TypeScript, Go, CLI, MCP server, gRPC/Connect API

See all Tensorlake Sandboxes alternatives →

Frequently asked questions

What is Tensorlake Sandboxes?

How does Tensorlake Sandboxes isolate code?

Tensorlake Sandboxes documents its isolation as: MicroVM per sandbox using hardware virtualisation (hosts must expose /dev/kvm); hypervisor not named; GPU sandboxes run on gVisor instead.

Is Tensorlake Sandboxes open source?

Yes (Apache-2.0). It can be self-hosted.

How much does Tensorlake Sandboxes cost?

Usage Credits / Pro per second: active CPU $0.07 / $0.042 per core-hour (minimum 20% of allocated vCPU), RAM $0.015 / $0.009 per GB-hour, root disk $0.0002 / $0.0001 per GB-hour, snapshot storage $0.07 per GB-month while suspended; egress free. Usage Credits are prepaid packs from $5 (1 CU = $0.01); Pro is $250/month including 25,000 CU with $0.01/CU overage; Enterprise custom Check the official pricing page for current rates.

What are the alternatives to Tensorlake Sandboxes?

Common alternatives include E2B, Daytona, Modal Sandboxes, Morph Cloud, Blaxel, Namespace. See Tensorlake Sandboxes alternatives for a full comparison.

Sources

Cite this page

Agent Sandboxes. (2026). Tensorlake Sandboxes. agentsandboxes.org. Last reviewed November 9, 2026. https://agentsandboxes.org/sandboxes/tensorlake/

Found an error or a missing sandbox? Submit a correction — every entry links to the sources it relies on.