← All features
FEATURE DEEP DIVE

Sell sandboxes: Firecracker microVMs that boot in seconds

Next to KVM instances, Kubernetes clusters and managed databases, customers can run MicroVMs: Firecracker virtual machines built for AI agent sandboxes, disposable CI runners, preview environments and batch jobs, metered by the second and reachable through an E2B-compatible API.

quickstart.pyPython
pip install e2b

export E2B_API_KEY=<key from the panel>
export E2B_API_URL=https://<your panel host>/api/e2b

from e2b import Sandbox

sbx = Sandbox.create("sandbox-base")
print(sbx.commands.run("echo hi").stdout)
sbx.kill()
01

Images: build once, run anywhere

One artifact, versioned, that runs the same way every time it boots.

Three ways to build

A Dockerfile on top of a platform base image, an existing container image imported from any registry, or a git repository the platform builds for you.

Signed base images

Debian 13, Ubuntu 24.04, Ubuntu 26.04, AlmaLinux 10 and Amazon Linux 2023 are published and signed by VirtConsole and synced into every installation automatically, with Rocky Linux 10 available as an option. No customer or admin ever supplies a kernel or a root filesystem.

Versioned & rollback-ready

A MicroVM always runs a named image version. Rolling forward or back is picking a different version, not rebuilding anything.

02

A MicroVM, in seconds

The create wizard asks for a location, an image and version, a plan and a network. From there, it is running.

Lifetime you choose

Leave it uncapped, or set a maximum of up to 8 hours and decide whether the MicroVM pauses or is killed when time runs out. Extend a running one’s timeout at any point.

Idle pause & always-on

Pause automatically after a period of no activity, or mark a MicroVM always-on so it never idles. A paused MicroVM keeps its memory and disk on the node and resumes exactly where it left off.

Per-second billing

Metered per second of vCPU and memory plus disk per hour, straight from the plan, with the estimate shown in the wizard before anyone commits.

03

Networking, access & security

The same primitives as a KVM instance, sized for compute that lives for minutes instead of months.

Public or VPC networking

A MicroVM gets a public IP, a VPC address, or both. VPC-only MicroVMs leave through the VPC’s NAT gateway, and the same security groups apply.

SSH injected at boot

Pick account SSH keys at create time and they land in authorized_keys before first boot. The show page prints the ssh command for the public IP, or the VPN gateway route for a VPC-only MicroVM.

HTTPS ingress

Expose a port on a wildcard sandbox domain or attach a custom domain; certificates are issued and renewed by the platform.

Web shell, logs, live metrics

A terminal into the running MicroVM from the panel, a streaming console log, and CPU, memory, disk and network charts sampled every 15 seconds on the node.

04

An E2B-compatible API for AI agents

Sell sandboxes to developers building agents, without asking them to learn a new SDK.

Drop-in for existing E2B code

Point the official e2b SDK at your panel with two environment variables, E2B_API_KEY and E2B_API_URL, and existing Python or JavaScript code runs unchanged against your own infrastructure.

Six quick starts

The API keys page ships copy-paste quick starts in Python, JavaScript, the CLI, cURL, the Anthropic SDK and the OpenAI SDK, plus docs for LangChain, the Vercel AI SDK and the Pi coding agent.

A REST API too

Everything the panel does is also a plain REST API under /api/microvm/*, using location_id for the location a resource lives in.

05

Connectors: a fresh MicroVM per CI job

Sell ephemeral CI compute with none of the idle-runner cost.

GitHub App

Install the provider’s GitHub App on an organisation and every CI job gets its own MicroVM, booted from the image and plan you choose.

GitLab runner token

Register a GitLab runner token the same way. No shared runner state between jobs, no idle runner fleet.

Metered to the job

The per-second meter stops the moment the job finishes, so a bursty CI workload never pays for compute it is not using.

06

For admins: turn it on per location

Enabled per hypervisor group, the same switch already used for managed databases and load balancers.

Readiness page

Walks through setup and says what is missing before customers can use the feature: nodes reporting, Firecracker version, the group switch, base image catalog, plans mapped through a plan group, networking, sandbox domain, wildcard certificate and the API mount. Each failing check links to the page that fixes it.

Plans & plan groups

Plans carry vCPU, memory, disk and the three prices; plan groups map plans to locations from the same drawer design used across Cloud Service, managed databases, load balancers, volumes and VPN gateways.

Fleet-wide admin tools

List every customer MicroVM with the node’s live view, force-stop a run, audit API key use, and manage connectors, all from the admin panel.

More of the platform

Try it on your own hardware

Free 30-day trial. Every feature included. No credit card required.

View pricing