One microVM per sandbox
Every sandbox gets its own kernel behind hardware virtualization — not a shared-kernel container. A container escape in your workload has nowhere to escape to.
Designed assuming the code is hostile
Agent-written code and user-submitted code get the same treatment here: full isolation, nothing shared, nothing implicit.
Deny-by-default egress
Networking starts fully closed. Open it with explicit domain or CIDR allowlists per sandbox, and every connection is logged for audit.
Hard quotas and TTLs
Cap CPU, memory, disk, wall-clock and process count. Runaway agent loops hit a ceiling and get reaped instead of billing you.
Verified snapshots
Paused sandbox memory and disks are encrypted at rest and integrity-checked on resume, so state cannot be tampered with between sessions.
Bring your own cloud
Run the ironbox control plane inside your own AWS, GCP or Azure account. Your credentials, disks and network traffic stay within your infrastructure and policies.
Compliance
SOC 2 Type II report and DPA available on reserved-metal plans. EU and US data residency with regional sandbox pinning.
Read the quickstart