# InstaVM vs Sandbox0 (slim)

> Sandbox0 scores 55.4 (C) to InstaVM's 52.1 (D) for code sandboxes. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/instavm-vs-sandbox0.md (~5,300 tokens) · this version ~3,130 tokens · JSON https://www.anchorterminal.com/compare/instavm-vs-sandbox0.json · canonical https://www.anchorterminal.com/compare/instavm-vs-sandbox0
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Sandbox0 scores 55.4 (C) on agent readiness against InstaVM's 52.1 (D), and leads in 4 of 7 scored categories. InstaVM leads on reliability and transparency & trust. Both do code sandboxes.

- InstaVM: D 52.1, rank #994 of 1486 · https://www.anchorterminal.com/tools/instavm.min.md
- Sandbox0: C 55.4, rank #865 of 1486 · https://www.anchorterminal.com/tools/sandbox0.min.md
- InstaVM, good for Hosted microVM sandboxes with browser, desktop, OCI images, clones and public shares. Ahead on Reliability, 77 against 37; Transparency & trust, 57 against 47.
- Sandbox0, good for Products that give each end user a long-lived Linux machine whose installed software and files persist between tasks, paying only for running memory. Ahead on Schema & documentation, 77 against 66; Agent ergonomics, 74 against 51; Security & auth, 58 against 41; Maintenance & community, 76 against 35.

| Category | InstaVM | Sandbox0 |
| --- | --- | --- |
| Reliability (16%) | 77 | 37 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 66 | 77 |
| Agent ergonomics (13%) | 51 | 74 |
| Security & auth (14%) | 41 | 58 |
| Payments & pricing (10%) | 20 | 20 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 35 | 76 |
| Transparency & trust (7%) | 57 | 47 |

| Fact (where they differ) | InstaVM | Sandbox0 |
| --- | --- | --- |
| Vendor | Checksum Labs, Inc. | Lougao, LLC (Sandbox0) |
| Hosted endpoint | `https://api.instavm.io` | `https://api.sandbox0.ai` |
| Licence | none | Proprietary hosted service under Sandbox0's terms of service (Lougao, LLC, Delaware law); the runtime is closed source since 16 October 2026. The `s0` CLI and the Go, Python and TypeScript SDKs are Apache-2.0 on GitHub. The earlier Apache-2.0 runtime is an archived, unmaintained repository |
| Last release | 2026-07-15 | 2026-10-30 |
| Terms last updated | 2026-01-26 | 2026-06-17 |
| Privacy policy last updated | 2026-01-26 | 2026-06-17 |
| Customer content may train models | yes | not found in the text |
| Terms restrict automated access | yes | not found in the text |
| Terms or service can change without notice | yes | not found in the text |
| Arbitration or class-action waiver | yes | not found in the text |
| Popularity | 57 npm/wk, 370 PyPI/wk | 88 stars, 268 npm/wk |
| Agent reviews | none | 3/5 (4) |

Why the edge:
- Maintenance & community, Sandbox0 +41: InstaVM 35 (Closed service lines. The latest dated change found is Python SDK 0.26.1 on 15 July 2026, 114 days before the check, and the site changelog's only entry is 11 July (10). No SDK release in the 90 days to 6 November (0). A public changelog, support email and Discord, with no reply times seen (8 of 15). Official Python and JavaScript SDKs, last released in July and May 2026 (12 of 15). Package health of the SDK repositories was not read (5 of 10). Total 35.); Sandbox0 76 (Read for a closed service with open-source SDKs and CLI, from depth-200 clones on 4 November. sdk-js v0.10.7, sdk-py v0.10.5, sdk-go v0.10.5 and s0 v0.10.5 are tagged on 30 October 2026, 5 days back, each carrying the shared service runtime change (30). In the 90 days from 6 August, sdk-js has 8 tags, sdk-py and sdk-go 6 each and the CLI 7 (v0.9.6-rc.1 and the floating `v0` tag aside) (20). Every issue and pull request in the SDK repositories was opened by the maintainer on 21 October; GitHub's pages weren't re-read on 4 November. Support is by email to contact@sandbox0.ai (5 of 25, kept). Current official SDKs in Go, Python and TypeScript generated from one OpenAPI file (15). sdk-py runs unit tests and mypy in CI on push and pull request, and the Go SDK, TypeScript SDK and CLI workflows only build and release on tags. Two contributors account for the runtime's history (6 of 10, kept). 30 + 20 + 5 + 15 + 6 = 76.)
- Reliability, InstaVM +40: InstaVM 77 (Hosted lines. Better Stack status page with four components, including the public API (20). The incident history shows no incidents for September, October or November 2026 (30). No rate limits with numbers found; Pro promises higher limits without figures (0). The Python SDK has a RateLimitError and an example retry loop with exponential backoff, but no 429 or Retry-After is documented, and there is no idempotency guidance (7 of 15). The terms commit to 99.9% monthly uptime with service credits, and Pro lists 99.9% (10). No beta or preview label on the API (10). Total 77.); Sandbox0 37 (Graded with the hosted lines, on Sandbox0 Cloud only. No status page found. sandbox0.ai/status answers 404, status.sandbox0.ai doesn't resolve, and none is linked from the site, llms.txt or docs (0, re-read 4 November). No readable incident history (5). Default quotas are published with numbers, 20 running sandboxes, unlimited paused sandboxes, 5 claims a second and 100 API requests a second per team, burst 200 (15). Quota failures return 429 with `error.code` `quota_exceeded`, claims carry Retry-After, and the OpenAPI file documents `Idempotency-Key` on pause, resume, restart, fork, snapshot capture and restore, sessions and template creation, with the docs saying to retry the same resize on 503. The core write, `POST /api/v1/sandboxes` (claim), which starts a billed sandbox and is the listing's own example call, takes no key, and the keys on pause and resume apply only to their conditional memory forms. That is safe-retry guidance without idempotency keys on the core write (12; the 21 October 13 isn't a checklist value). The terms provide the service as is and no SLA is published (0). The core sandbox API carries no beta label, but memory checkpoints and live migration are called experimental, the OpenAPI file is version 0.1.0 and the SDKs are 0.10.x (5 of 10, the 21 October partial kept). 0 + 5 + 15 + 12 + 0 + 5 = 37.)
- Agent ergonomics, Sandbox0 +23: InstaVM 51 (30 operations take limit, offset, cursor or page parameters, with no field selection found (12 of 25). Listing endpoints page, with little filtering (10 of 20). The SDK maps failures to typed exceptions such as AuthenticationError, QuotaExceededError and RateLimitError, but the HTTP error bodies are undocumented (8 of 20). One operation takes an idempotency parameter, and snapshots and clones make work repeatable, with no safe-retry guidance (6 of 20). `client.execute(code=..., language=...)` needs two arguments, with Python and JavaScript SDKs (15). Total 51.); Sandbox0 74 (Graded on the REST API and SDKs. Responses can be sized through limits on logs (default 100, max 1,000), streamed command output and file reads by path, though some responses carry long lifecycle detail (15 of 25). Cursors on logs, contexts and sessions, and limits on lists (14 of 20). Errors are a typed envelope with a code and message, with `quota_exceeded`, `feature_not_licensed` and `session_not_found` explained, and 409 for conflicting lifecycle operations (15 of 20). Idempotency keys on several writes, runtime-generation guards on mutations, and repeat-safe resize (17 of 20). SDKs in Go, Python and TypeScript plus the CLI, and claims need only a template name, but `ttl` and `hard_ttl` default to 0 so an idle sandbox keeps billing until told otherwise (13 of 15).)
- Security & auth, Sandbox0 +17: InstaVM 41 (Plain API keys in a header, with API endpoints to create, list and delete them and no scopes found (20 of 30). Egress policies per session or VM can block all outbound traffic or allow named domains and CIDRs, but llms.txt describes full network access as the default (8 of 20). No guidance on untrusted output from executed code or browser sessions (3 of 15). An Audit Logs endpoint group exists in the API reference (10 of 15). No security.txt, disclosure policy, bug bounty or certification found; the privacy policy names none (0 of 20). Total 41.); Sandbox0 58 (Bearer API keys scoped to a team, with roles admin, developer, builder and viewer that can't exceed the caller's, expiry of 30 to 365 days or never, deactivation and an introspection route. No OAuth for API clients found (25 of 30). The viewer role gives a read-only key. Network policy can block all egress, allow and deny by rule, and allow or deny named MCP tool calls, and cloud metadata endpoints are blocked under any policy. No confirmation step for destructive calls (14 of 20). Sandboxes return output of code the agent runs. Credential sources are injected by the egress proxy so raw secrets stay out of the sandbox, but no guidance on treating sandbox output as untrusted was found (8 of 15). Historical logs and runtime metrics per sandbox; the signed audit event ledger needs the enterprise `sandbox_audit` feature, and network audit is optional (8 of 15). No security.txt (404), no security page (404), no bug bounty, no certification and no published advisories (OSV lists none for sandbox0 on 4 November). Security reports go to contact@sandbox0.ai per the archived runtime's SUPPORT.md, and the `s0` install script downloads a release without verifying a checksum (2 of 20).)
- Schema & documentation, Sandbox0 +11: InstaVM 66 (A public OpenAPI 3.1 spec with 229 operations (25). llms.txt at instavm.io (10). Only 93 of 229 operations have a description, and those read as short summaries without when-not-to-use guidance (8 of 20). FastAPI-generated request schemas with typed fields and required lists (10 of 15). Docs carry code examples for each SDK area, but only 422 validation errors appear in the spec and no error-code reference was found (6 of 15). Paths sit under /v1 and an SDK changelog exists, but the site changelog has one entry, of 11 July 2026 (7 of 15). Total 66.); Sandbox0 77 (OpenAPI 3.0.3 file with 106 paths and 145 operations, the same file in each SDK repository and the archived runtime. It isn't linked from the docs or served on sandbox0.ai, so an agent has to find it on GitHub (20 of 25). llms.txt and every docs page as raw Markdown at a .md address (10). Docs say when to use each lifecycle and context type, and 884 descriptions in the spec explain fields, but the pages are long and mix in internal architecture such as ctld, Nomad and PostgreSQL leases (16 of 20). 106 enums and 386 required lists in the spec; the error `details` field is free-form (13 of 15). Examples in Go, Python, TypeScript and CLI on every guide, but only two examples in the spec. Error responses are typed as a `{code, message, details}` envelope per status, with a few codes named in the docs (11 of 15). API paths are /api/v1 and the SDKs and CLI publish GitHub releases with commit lists, but there's no public changelog page; /changelog answers 404 (7 of 15).)
- Transparency & trust, InstaVM +10: InstaVM 57 (Closed service with clear terms (15). The terms and privacy policy agree on keeping code and execution logs up to one year and US storage, and the policy names Stripe, PostHog and Resend, but allows training on anonymised, aggregated data derived from user content with opt-out by email and mentions no DPA (18 of 30). No deprecation policy or notices found (0 of 20). US data location stated and three subprocessors named, cloud providers unnamed (12 of 20). Total 45.); Sandbox0 47 (The hosted service is closed under clear, dated terms naming Lougao, LLC and Delaware law. The SDKs and CLI are Apache-2.0, and the earlier runtime stays Apache-2.0 as an unmaintained archive that no longer matches the service (18 of 30). The privacy policy (effective 17 June 2026, re-read 4 November) says what is collected, that customer content is processed only to run the service and that no advertising cookies are used, but retention is "as long as needed" with no periods, and no DPA was found (12 of 30). No deprecation policy. The terms say parts of the service may be changed or discontinued, and self-hosting ended on 16 October 2026 with no notice found before that day. The deployment page now dates the end clearly (3 of 20). Data location is stated (U.S. infrastructure, one U.S. East region), but service providers are described by kind only and not named (8 of 20).)