# Sandboxer

> Whole Ubuntu microVMs billed per second, sold through monthly plans whose dollars come back as machine time.

Website: https://sandboxer.com  
Guide page: https://botperch.com/providers/sandboxer/  
Checked: 2026-10-28

**Short answer:** One always-on personal agent (2 vCPU / 4 GiB / 20 GiB) costs about $40.00 a month here, the 7th cheapest of the 12 providers that run it as described. The AI model adds about $14.70 a month on top (GLM 5.3, 30 requests a day at 40k tokens each, median zero-retention price; from $6.84 at the cheapest host). Fits well: A microVM with systemd, Docker with BuildKit and Compose, and /dev/kvm.

Sandboxer rents whole Linux virtual machines to agents and to the people running them. Each sandbox is an Ubuntu 24.04 microVM on Cloud Hypervisor with its own kernel, root, systemd, Docker and /dev/kvm, reachable over an HTTP API, a CLI, two SDKs and an MCP server.
Its selling point is that state outlives the session: a stop writes RAM as well as disk, so a resume can bring running processes back, and a fork is a copy-on-write clone.
It launched publicly on 2026-10-18. There are two regions, no GPUs, no SLA, and no independent reviews yet.

**Who it is for:** Solo builders and small agent fleets, products giving every user their own computer, eval farms and teams running coding or computer-use agents in parallel.

**Isolation:** Cloud Hypervisor microVM with its own kernel and a separate copy-on-write root disk. Docker, systemd, /dev/kvm and root all work. The control channel is vsock, not TCP, so code inside cannot reach the host API.

**Sizes and regions:** Four fixed sizes: small 2 vCPU / 4 GB / 12 GB, default 4 vCPU / 8 GB / 50 GB, large 8 vCPU / 16 GB / 125 GB, xlarge 16 vCPU / 32 GB / 251 GB. vCPUs are shared; RAM is reserved. Disk is space for your files, on top of a 6–7 GB OS image.

## How it charges

- model: Monthly plan whose dollars return as machine time, plus optional time packs.
- meter: Per second while running, at a fixed multiplier per size: small 0.5×, default 1×, large 2×, xlarge about 5.56×. One dollar buys 100,000 default-seconds.
- stopped: Nothing for compute. Storage is counted against an included quota but not billed, and going over the quota blocks new sandboxes rather than charging.
- planFee: $20, $100, $500 or $2,000 a month, per seat in an organisation. The plan price comes back as machine time, and unused plan time expires monthly.
- minimum: The $20 plan is the floor: there is no free tier, and the 7-day trial converts into it automatically.

A fixed multiplier per size, per second while running, out of a plan whose dollars come back as machine time.
- Storage counts against an included quota and is not billed; going over blocks new sandboxes.
- Plans are per seat in an organisation.

## Monthly cost for each preset workload

- A personal agent that stays on (Hermes, OpenClaw): $40.00
- A coding agent for one developer: $20.00
- A code interpreter inside your product: $20.00
- A browser agent for a small team: $100.00
- Self-hosted n8n for a small team: $40.00
- A Discord or Slack bot for one server: $20.00
- Claude Code for a team of five: $40.00
- A scraper that runs four times a day: $20.00
- Your own remote MCP server: $20.00
- A: 1,000 short tasks: $20.00
- B: one always-on box: $40.00
- C: three hours a day: $20.00

## Fits well

- A microVM with systemd, Docker with BuildKit and Compose, and /dev/kvm.
- Six agent harnesses in every sandbox and a prompt API that returns an id.
- Stopped time that is free, with the whole disk kept while the sandbox is stopped.

## Fits badly

- A procurement review: no SLA, no SSO, no audit log and no certification.
- A heavy network workload with a third party that rate-limits by IP: outbound shares the node's address.
- A team that wants per-seat pricing to stay flat: plans are per seat.

## Features

- **Isolation** (yes): Cloud Hypervisor; /dev/kvm. A Cloud Hypervisor microVM with its own kernel, systemd, Docker with BuildKit and Compose, and /dev/kvm. [source](https://sandboxer.com/docs/security) [docs](https://sandboxer.com/docs/security)
- **Sizes and regions** (partly): 16 vCPU / 32 GB; 2 regions. Four fixed sizes from 2/4/12 GB to 16/32/251 GB, shared vCPU with reserved RAM. Two regions, no GPU, no ARM. [source](https://sandboxer.com/pricing) [docs](https://sandboxer.com/docs/machines)
- **Lifecycle** (partly): RAM to disk; 2 min window. A stop writes memory and device state to disk, so a resume can restore running processes — but only on a machine of the same CPU type within two minutes, otherwise it cold-boots. [source](https://sandboxer.com/docs/snapshots) [docs](https://sandboxer.com/docs/snapshots)
- **Snapshots and forks** (yes): Disk + RAM on stop. Three snapshot kinds: a stop snapshot with disk and memory, continuous disk snapshots every ten minutes, and named disk snapshots used as templates with share codes. Forks are disk-only. [source](https://sandboxer.com/docs/snapshots) [docs](https://sandboxer.com/docs/snapshots)
- **Storage** (partly): Whole disk; quota, not bill. The whole disk persists while stopped, free within a storage quota, and there is no separate volume or image registry. Going over quota blocks new sandboxes rather than charging. [source](https://sandboxer.com/docs/machines) [docs](https://sandboxer.com/docs/billing)
- **Idle and waking** (partly): 1 s – 30 days, or off. No maximum lifetime, but a hard auto-stop defaults to one hour and idle pause to 15–120 minutes by plan. An always-on box needs ttlSeconds: null and idleStopMinutes: 0. [source](https://sandboxer.com/docs/limits) [docs](https://sandboxer.com/docs/long-running)
- **Reaching it** (yes): Token in URL. A stable HTTPS address per port, private by default with a token in the URL; --public removes it. A public IPv6 with the firewall closed except SSH. No raw-TCP endpoint. [source](https://sandboxer.com/docs/hosting) [docs](https://sandboxer.com/docs/hosting)
- **Custom domains** (partly): CNAME plus your TLS. First-class custom domains are on the roadmap; the documented workaround is a CNAME to the hosted hostname with your own TLS termination. [source](https://sandboxer.com/docs/hosting) [docs](https://sandboxer.com/docs/hosting)
- **Outbound network** (partly): Not billed. Outbound is open by default with no allowlist product. Traffic shares the node's IPv4 and IPv6 with other sandboxes, so external rate limits are shared. [source](https://sandboxer.com/docs/security) [docs](https://sandboxer.com/docs/security)
- **Keys and secrets** (partly): Yes, env + files. An environment injects variables, secret files and repositories into the VM, and removing a secret deletes it from disk. There is no broker or short-lived credential exchange. [source](https://sandboxer.com/docs/security) [docs](https://sandboxer.com/docs/environments)
- **Ways to drive it** (yes): Yes, dashboard. REST, TypeScript and Python SDKs, a static CLI binary, a hosted MCP server, SSH and SCP, a VNC desktop and a browser terminal. [source](https://sandboxer.com/docs/cli) [docs](https://sandboxer.com/docs/api)
- **Built-in agents** (yes): Six harnesses; prompt API. Six harnesses installed in every sandbox, a prompt API that returns a prompt id, steering for Claude Code, Codex and Pi, and a live model catalogue. [source](https://sandboxer.com/docs/agents) [docs](https://sandboxer.com/docs/agents)
- **Teams and accounts** (partly): Per-member caps. An organisation is a shared wallet with owner and member roles, scoped keys and per-member usage caps. Plans are per seat, and no audit log or SSO is published. [source](https://sandboxer.com/docs/organizations) [docs](https://sandboxer.com/docs/organizations)
- **Billing models** (partly): $0.036/h default. A monthly plan whose dollars return as machine time, metered per second at a fixed multiplier per size. Stopped time is free, but the $20 plan is a floor and plan time expires monthly. [source](https://sandboxer.com/pricing) [docs](https://sandboxer.com/docs/billing)
- **Trials and free tiers** (partly): 7 days / 25 h, then a plan. A seven-day trial with 25 hours of machine time, two sandboxes, small and default sizes, and a card up front. It becomes $20 a month on day eight. [source](https://sandboxer.com/pricing) [docs](https://sandboxer.com/pricing)
- **The company** (partly): North Bay Opco I, Inc.; no SLA. North Bay Opco I, Inc., Delaware, Miami mailbox; part of North Bay Ventures, Jon Oringer's studio. Entity incorporated November 2022; product launched 18 October 2026; funding not published. Status reports API 100%, sandboxes 99.45% and website 99.79% over 30 days, but the product is ten days old, so the 90-day columns cannot all be production traffic. No SLA during early access. No SOC 2, ISO or HIPAA. Price changes need 30 days' notice; cancellation runs to month end; closing forfeits remaining credit; data is deleted after termination with no export window. [source](https://sandboxer.com/terms)

## Capabilities

- Its own virtual machine: yes (Cloud Hypervisor microVM) [source](https://sandboxer.com/docs/security)
- Root access: yes (sudo inside) [source](https://sandboxer.com/docs/machines)
- Docker inside: yes (Docker preinstalled) [source](https://sandboxer.com/docs/machines)
- Nested virtualisation: yes (/dev/kvm) [source](https://sandboxer.com/docs/machines)
- Your own image: partly (snapshot templates). You cannot start from your own image; you set a machine up and save its disk as a template. [source](https://sandboxer.com/docs/llms.txt)
- Any size you like: no (4 fixed sizes). There are four fixed sizes and no custom size. [source](https://sandboxer.com/docs/machines)
- Large machines: yes (16 cores / 32 GB). Only on the $100-a-month plan or above. [source](https://sandboxer.com/docs/machines)
- Resize while running: no (stop and recreate). There is no way to change a running machine's size; you create a new one and copy your files across. [source](https://sandboxer.com/docs/machines)
- GPUs: no (no GPU). There are no graphics processors. [source](https://sandboxer.com/docs/llms.txt)
- Choose the region: yes (US East or EU Central) [source](https://sandboxer.com/docs/regions)
- Runs in the EU: yes (Helsinki) [source](https://sandboxer.com/docs/regions)
- Pause keeps memory: partly (2 min window). Memory comes back only if a machine of the same processor type is free within two minutes; otherwise it boots fresh with the files. [source](https://sandboxer.com/docs/snapshots)
- Pre-started pools: partly. The provider keeps machines ready, but you cannot say how many or which setup; a size the region does not keep boots instead. [source](https://sandboxer.com/docs/machines)
- Starts in under a second: yes (0.18 s median) [source](https://sandboxer.com/docs/machines)
- Snapshots of files: yes [source](https://sandboxer.com/docs/snapshots)
- Snapshots with memory: yes [source](https://sandboxer.com/docs/snapshots)
- Copy a running machine: partly. A fork copies the files and boots fresh; the running programs are not copied. [source](https://sandboxer.com/docs/snapshots)
- Pick an older snapshot: partly. The automatic copies keep only the latest two; anything older you have to save yourself under a name. [source](https://sandboxer.com/docs/snapshots)
- Reusable templates: yes [source](https://sandboxer.com/docs/snapshots)
- Automatic backups: partly (Every 10 minutes). These are automatic snapshots kept on the same host as the machine, not an off-site backup, so they do not survive losing that host. [source](https://sandboxer.com/docs/snapshots)
- Files survive a stop: yes [source](https://sandboxer.com/docs/snapshots)
- Separate volumes: no [source](https://sandboxer.com/docs/machines)
- One volume, several machines: no [source](https://sandboxer.com/docs/machines)
- Mount outside storage: no [source](https://sandboxer.com/docs/machines)
- Large disk: yes (251 GB) [source](https://sandboxer.com/docs/machines)
- Can stay on indefinitely: yes [source](https://sandboxer.com/docs/limits)
- Choose the idle timeout: yes (15–120 min, or 0) [source](https://sandboxer.com/docs/long-running)
- Wakes on a request: yes [source](https://sandboxer.com/docs/long-running)
- Scheduled runs: partly. A cron or timer runs inside the machine, so it never fires while the machine is stopped or paused. [source](https://sandboxer.com/guides/run-scheduled-jobs-in-a-sandbox-with-systemd-timers.md)
- Public link to a port: yes (--public) [source](https://sandboxer.com/docs/hosting.md)
- Private link: yes (Token in link) [source](https://sandboxer.com/docs/hosting.md)
- Real SSH: yes (sshEndpoint) [source](https://sandboxer.com/docs/ssh.md)
- Terminal in the browser: yes (Dashboard tab) [source](https://sandboxer.com/docs/ssh.md)
- Tunnel to your computer: yes (sbx forward) [source](https://sandboxer.com/docs/ssh.md)
- Non-web ports: partly (Through SSH only). There is no public non-web port; you reach one by opening a tunnel from your own computer. [source](https://sandboxer.com/docs/security.md)
- Your own domain: partly (CNAME and your certificate). You point a name at the provider's address and supply the security certificate yourself; a native feature is only planned. [source](https://sandboxer.com/docs/hosting.md)
- Automatic HTTPS: no. You point the name and terminate the certificate yourself. [source](https://sandboxer.com/docs/hosting.md)
- Outbound data included: yes (Not billed) [source](https://sandboxer.com/pricing)
- Allow only some sites: no. There is no allowlist or outbound firewall setting; every machine can reach the whole internet. [source](https://sandboxer.com/guides/what-can-reach-a-sandbox-and-what-it-can-reach)
- Turn the internet off: partly (Firewall inside). There is no provider setting; you block traffic with the machine's own firewall, which the agent can undo. [source](https://sandboxer.com/guides/what-can-reach-a-sandbox-and-what-it-can-reach)
- Fixed outgoing IP: no (Shared host address). Outbound traffic shares the host machine's address with every other sandbox on it, so other services see one shared address. [source](https://sandboxer.com/docs/security.md)
- Stored secrets: yes (Variables and files) [source](https://sandboxer.com/docs/environments.md)
- Secrets the agent cannot read: no. Keys are written into the machine as variables and files, so the agent can read them. [source](https://sandboxer.com/docs/environments.md)
- Limited API keys: yes (Action and machine sets) [source](https://sandboxer.com/docs/api-keys.md)
- Create from the website: no [source](https://sandboxer.com/docs/quickstart)
- Command-line tool: yes [source](https://sandboxer.com/docs/cli)
- Python SDK: yes [source](https://sandboxer.com/docs/llms.txt)
- TypeScript SDK: yes [source](https://sandboxer.com/docs/llms.txt)
- Documented HTTP API: yes [source](https://sandboxer.com/docs/api)
- MCP server: yes [source](https://sandboxer.com/docs/mcp)
- Interactive terminal over the API: yes [source](https://sandboxer.com/docs/api)
- Files over the API: yes [source](https://sandboxer.com/docs/mcp)
- Coding agents preinstalled: yes (6 harnesses) [source](https://sandboxer.com/docs/llms.txt)
- Send it a prompt: yes [source](https://sandboxer.com/docs/agents)
- One-click Hermes: no. Its six harnesses do not include Hermes, and there is no template. [source](https://sandboxer.com/docs/llms.txt)
- One-click OpenClaw: no. Its harness list does not include OpenClaw, and there is no template. [source](https://sandboxer.com/docs/llms.txt)
- Browser built in: yes [source](https://sandboxer.com/docs/llms.txt)
- Desktop for computer use: yes [source](https://sandboxer.com/docs/desktop)
- Runs other platforms' agents: no. Its agent pages cover SDKs and frameworks, not another platform's hosted cloud agents. [source](https://sandboxer.com/docs/llms.txt)
- Team workspace: yes [source](https://sandboxer.com/docs/organizations)
- Roles and permissions: partly. Only two roles exist; there is no read-only role or finer permission. [source](https://sandboxer.com/docs/organizations)
- Single sign-on: not-published [source](https://sandboxer.com/docs/organizations)
- Hard spending cap: partly. A member's machine time can be capped, and a zero balance stops new sandboxes, but there is no account-wide dollar cap. [source](https://sandboxer.com/docs/organizations)
- Usage alerts: yes [source](https://sandboxer.com/docs/billing)
- Audit log: not-published [source](https://sandboxer.com/docs/security)
- Billed per second: yes (per second) [source](https://sandboxer.com/docs/billing)
- CPU billed only while working: no (flat rate per size). The price depends on the size you picked, not on how hard it works. [source](https://sandboxer.com/docs/billing)
- Paused costs only storage: yes (nothing while stopped) [source](https://sandboxer.com/docs/billing)
- No monthly fee: no ($20 minimum plan). The smallest plan is $20 a month, and included time does not carry over. [source](https://sandboxer.com/docs/billing)
- Flat monthly price: yes ($26.28 a month default) [source](https://sandboxer.com/pricing.md)
- Ongoing free tier: no (trial only). There is no free tier, only a seven-day trial that becomes a $20 plan. [source](https://sandboxer.com/docs/billing)
- Free starting credit: no (none). There is no credit; the trial is 25 hours of machine time that becomes a paid plan. [source](https://sandboxer.com/pricing.md)
- Try without a card: no (card for the trial). The trial needs a card up front and becomes a paid plan after seven days. [source](https://sandboxer.com/pricing.md)
- Public status page: yes [source](https://sandboxer.com/docs/llms.txt)
- Uptime promise (SLA): no. There is no SLA during early access. [source](https://sandboxer.com/docs/llms.txt)
- SOC 2 report: not-published [source](https://sandboxer.com/docs/security)
- Data processing agreement: partly. You have to write to privacy@ to get a data processing addendum. [source](https://sandboxer.com/terms)
- Open source or self-hostable: no. Sandboxer runs on dedicated servers it operates; no self-hosted edition is published. [source](https://sandboxer.com/docs/llms.txt)

## Usability

- Dashboard: Yes, at sandboxer.com/app: a sandbox list with a stop countdown and an Extend button, an Open desktop button, a browser terminal, billing, environments, agents, API keys, webhooks and alerts.
- Without code: Not really. Every documented workflow is a sbx command, and templates are created from the CLI or API. The one genuinely no-code route is adding its hosted MCP server as a connector in Claude or ChatGPT and asking in chat.
- Signup: GitHub, Google, email code or email and password, plus a card before the first sandbox. The card starts a 7-day trial with 25 hours of machine time, which becomes the $20 plan on day 8.
- Docs: About 30 pages with a Markdown mirror, an OpenAPI file, a 50-term glossary and published benchmark method. Support is email only. The status page is public with 90-day uptime.
- Trips people up: The card comes first: you cannot see a sandbox without payment details.
- Trips people up: The trial becomes a subscription on day 8 unless cancelled.
- Trips people up: Nothing is one-click: hosting a port is a CLI step.
- Trips people up: The default 1-hour auto-stop stops a sandbox you forgot about, and a running job does not hold it off.
- Trips people up: A private preview URL is a password, and anyone with the link is in.
- Trips people up: Resume may not restore your session, which is the promise you will remember.

## Company

- Legal entity: North Bay Opco I, Inc., a Delaware corporation with a Miami mailing address. [source](https://sandboxer.com/terms)
- Ownership: One product of North Bay Ventures, Jon Oringer's venture studio. The same entity contracts for sibling products. [source](https://www.northbayventures.com/)
- History: The product went live on 18 October 2026. [source](https://x.com/jonoringer/status/2111826193578070439)
- Incorporated: The contracting entity was incorporated on 9 November 2022, almost four years before the product launched. [source](https://netstate.co/agents/us-de/corporation-service-company/p/14030)
- Funding: Not published. No round, investor, valuation or accelerator appears anywhere.
- Status and SLA: API 100% and sandboxes 99.45% over 30 days. No SLA during early access, on any plan. [source](https://sandboxer.com/docs/llms.txt)
- Certification: No SOC 2, ISO 27001 or HIPAA claim and no trust centre. A vulnerability policy with a three-day acknowledgement.

## Caveats

- **Its sizes and prices exactly match Boat's** (open): small, default, large and xlarge at $0.018 / $0.036 / $0.072 / $0.20 an hour, and the same $20 / $100 / $500 / $2,000 plan tiers. But the disk sizes differ (12/50/125/251 GB here against 51/51/111/251 GB at Boat), the regions differ (US East and Helsinki here, EU-only at Boat), Boat deletes a stopped sandbox's disk after 14 days while Sandboxer keeps it, and the legal entities are unrelated. No public source explains the relationship. This is an open question, not evidence of a reseller or a copy.
- **Ten days old at the time of research** (open): Launch post 2026-10-18, oldest changelog entry 2026-10-17, no independent reviews or benchmarks, and no company page: the legal entity is a Delaware company at a Miami private mailbox shared with unrelated products.
- **Resume keeps running processes only conditionally** (open): It needs a machine of the same CPU type within two minutes; otherwise the sandbox cold-boots from disk. requireMemory: true makes it strict but cannot be combined with a resize.
- **No SLA, no SSO, no audit log, no compliance certification published** (open): There is a vulnerability policy and a security.txt, but no SOC 2, ISO 27001 or HIPAA statement, and no DPA or sub-processor list.
- **Two regions disagree on where us-east is** (contradiction): The regions page says Ashburn, Virginia; a performance note on the machines page says Leesburg, VA. Same metro, different answer.

## Sources

- [Docs](https://sandboxer.com/docs)
- [Snapshots](https://sandboxer.com/docs/snapshots)
- [Machines and sizes](https://sandboxer.com/docs/machines)
- [Billing](https://sandboxer.com/docs/billing)
- [Hosting and preview URLs](https://sandboxer.com/docs/hosting)
- [Pricing](https://sandboxer.com/pricing)
- [Security](https://sandboxer.com/docs/security)