Sandboxes on Northflank

Northflank sandboxes are microVM-backed containers that provide VM-level isolation with container performance. They boot in under 1 second and prevent container escape, making them ideal for running untrusted code at scale.

Traditional containers share the host kernel, which means a container escape vulnerability can compromise the entire system. Sandboxes solve this by running each container in its own microVM with a separate kernel instance.

Use sandboxes when you need to run code you don't control:

• LLM-generated code: Execute code written by AI models without risking your infrastructure
• User-submitted code: Run code playgrounds, online IDEs, or code evaluation platforms
• AI agents: Provide isolated execution environments for autonomous agents
• CI/CD pipelines: Run builds and tests in secure, ephemeral environments
• Multi-tenant platforms: Isolate customer workloads with VM-level security boundaries

Sandboxes use a combination of microVM-based virtualization and user-space kernel isolation to provide strong isolation. Depending on the technology, each container runs either in a lightweight virtual machine with its own kernel or in a dedicated user-space kernel sandbox, preventing breakout attacks while maintaining near-native performance.

Choose where to run your sandboxes based on your requirements.

Automate sandbox provisioning and lifecycle management with the Northflank API and SDK.