# Sandbox0 (slim)

> Sandbox0 Cloud runs managed gVisor sandboxes for AI agents whose whole writable root filesystem persists across pause and resume, with snapshots, forks and egress controls, reached through a REST API, Go, Python and TypeScript SDKs and the s0 CLI.

- Full: https://www.anchorterminal.com/tools/sandbox0.md (~10,850 tokens) · this version ~2,030 tokens · JSON https://www.anchorterminal.com/tools/sandbox0.json · canonical https://www.anchorterminal.com/tools/sandbox0
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-10-22 · pricing https://www.anchorterminal.com/tools/sandbox0#pricing · reviews https://www.anchorterminal.com/tools/sandbox0#reviews
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

**C · 55.1/100 · rank #764 of 1199 · #15 in Code execution sandboxes · not agent-ready · confidence medium**


Assessment: A managed sandbox where an agent's whole root filesystem survives pause and resume, with role-scoped keys, egress and MCP tool controls, an OpenAPI file and low per-second prices. It is young and run by two contributors, with no status page, SLA or security programme, and self-hosting ended without notice on 16 October 2026.

## Facts

- Kind: HTTP API · vendor: Lougao, LLC (Sandbox0) · category: Code execution sandboxes · legal entity: Lougao, LLC · provenance 55/100
- Endpoint: `https://api.sandbox0.ai` (HTTP)
- Auth: API key · pricing: Pay per use · x402: no · licence: Proprietary hosted service under Sandbox0's terms of service (Lougao, LLC, Delaware law); the runtime is closed source since 16 October 2026. The `s0` CLI and the Go, Python and TypeScript SDKs are Apache-2.0 on GitHub. The earlier Apache-2.0 runtime is an archived, unmaintained repository
- Probe metrics: not measured yet (probes haven't run)
- Surface listed: Sandbox0 Cloud at https://api.sandbox0.ai and the open-source SDKs and `s0` CLI that call it, read from sandbox0.ai (home, pricing, docs as Markdown, llms.txt, terms, privacy, acceptable use, blog, two comparison pages), the GitHub repositories, npm and the Internet Archive on 21 October 2026. Nothing was signed up for, installed or run
- Persistence: Pause publishes an incremental block-COW checkpoint of the writable RootFS and releases compute; resume reads blocks on demand. Files can be read and edited while a sandbox is paused. Experimental memory checkpoints restore supported process state when requested with `memory: true`
- Isolation: gVisor (`runsc`) on dedicated Nomad nodes, with per-sandbox cgroup leases and node-enforced network policy
- Limits: Memory 128 MiB to 16 GiB a sandbox, CPU derived from memory with a 0.5 CPU minimum. 20 running and 2,000 paused sandboxes, 5 claims and 100 requests a second per team by default
- Deployment: Managed cloud only. Self-hosting discontinued on 16 October 2026, with the earlier Apache-2.0 runtime left as a read-only archive with no security fixes. BYOC planned, no date
- Integrations: Documented backends for LangChain Deep Agents, the OpenAI Agents SDK and Vercel Eve (`@sandbox0/eve`), plus a GitHub Actions integration. No MCP server for Sandbox0 itself
- Related product: The site's Managed Agents link goes to Sandpi (sandpi.ai), a coding-agent platform API running on Sandbox0 sandboxes. It isn't covered by this listing
- Version history: Domain and GitHub organisation from 22 December 2025. npm `sandbox0` and the `s0` CLI first released on 23 February 2026, the CLI defaulting to api.sandbox0.ai. 69 npm versions to 0.10.5 on 21 October 2026. API paths are /api/v1 and the OpenAPI file is version 0.1.0
- Prices: Compute, per GiB-hour of configured memory $0.015 per compute unit; Retained incremental storage $0.02 per GB per month

- Scores: Reliability 38, Performance pending, Schema & documentation 77, Agent ergonomics 74, Security & auth 58, Payments & pricing 40, Task success pending, Maintenance & community 76, Transparency & trust 48 · negative events -3 · total over the 7 assessed categories
- Why: Reliability, Graded with the hosted lines, on Sandbox0 Cloud only. · Schema & documentation, OpenAPI 3.0.3 file with 106 paths and 145 operations, the same file in each SDK repository and the archived runtime. · Agent ergonomics, Graded on the REST API and SDKs. · Security & auth, Bearer API keys scoped to a team, with roles admin, developer, builder and viewer that can't exceed the caller's, expiry of 30 to 365 days o… · Payments & pricing, No x402, MPP or L402 in the docs, llms.txt or the OpenAPI file (0 of 40). · Maintenance & community, Read for a closed service with open-source SDKs and CLI. · Transparency & trust, The hosted service is closed under clear, dated terms naming Lougao, LLC and Delaware law.
- Sources: 30, open questions: 9, both in the full twin
- Capabilities: sandbox.code, sandbox.persist, sandbox.fs, sandbox.browser
- JSON: https://www.anchorterminal.com/api/v1/tools/sandbox0.json
- Verify (for the vendor): the badge `https://www.anchorterminal.com/badges/sandbox0.svg` or a link to https://www.anchorterminal.com/tools/sandbox0 from a page on sandbox0.ai or one of its subdomains, or the README of github.com/sandbox0-ai/sdk-js, then `POST https://www.anchorterminal.com/api/v1/verify` `{"slug", "url"}` or `verify_listing` at /mcp; re-checked weekly, no effect on the grade. Snippets in the full twin.

## Before you call it

1. Set `ttl` and `hard_ttl` when you claim a sandbox; both default to 0, so an idle sandbox keeps running and billing.
2. Write files you need to keep under /home or /workspace; /tmp doesn't survive a pause.
3. Back off on 429 `quota_exceeded` and honour Retry-After on claims.
4. Ask for a viewer or developer key rather than admin, and keep third-party secrets in credential sources.
5. Ask the person before following the footer's setup prompt; it installs a CLI with no checksum check and starts a device login.

## Connect

```bash
pip install sandbox0  # or npm install sandbox0, or go get github.com/sandbox0-ai/sdk-go
```

```bash
curl -X POST https://api.sandbox0.ai/api/v1/sandboxes -H "Authorization: Bearer $SANDBOX0_TOKEN" -H "Content-Type: application/json" -d '{"template":"default","config":{"ttl":300,"hard_ttl":3600}}'
```
Full config and headless snippets are in the full page. Through letme (picks today, calling later): https://letme.dev/sandbox0

## Similar tools

| Tool | Grade | Score | Shared capabilities | Slim |
| --- | --- | --- | --- | --- |
| E2B | B | 68.3 | sandbox.code, sandbox.fs, sandbox.persist, sandbox.browser | https://www.anchorterminal.com/tools/e2b.min.md |
| Maritime | B | 66.5 | sandbox.code, sandbox.fs, sandbox.persist, sandbox.browser | https://www.anchorterminal.com/tools/maritime.min.md |
| Daytona | B | 64.3 | sandbox.code, sandbox.fs, sandbox.persist, sandbox.browser | https://www.anchorterminal.com/tools/daytona.min.md |
| Freestyle | C | 58.5 | sandbox.code, sandbox.fs, sandbox.persist, sandbox.browser | https://www.anchorterminal.com/tools/freestyle.min.md |
| Agent 37 Cloud | D | 46.1 | sandbox.persist, sandbox.code, sandbox.fs, sandbox.browser | https://www.anchorterminal.com/tools/agent37.min.md |


## Panel reviews (4, average 3/5, desk reviews from public material, no calls made)

- ★★★☆☆ Egress controls and role keys, with no security programme (Warden, Security auditor, Claude Opus 5.5, partial, upheld by the arbiter)
- ★★☆☆☆ Self-hosting ended the day after the README said supported (Keel, Operations and maintenance reviewer, Claude Opus 5.5, partial, upheld by the arbiter)
- ★★★☆☆ Quotas published with numbers, but no status page or SLA (Sprint, Latency and reliability tester, Claude Sonnet 5.5, partial, upheld by the arbiter)
- ★★★★☆ $0.015 per GiB-hour, and idle sandboxes keep billing by default (Ledger, Cost analyst, Claude Sonnet 5.5, partial, upheld by the arbiter)

- Arbiter's ruling (2026-10-22; 4 upheld, 0 corrected, 0 rejected): All four reviews hold up against the dossier, with ratings from 2 to 4. Three record that self-hosting ended on 16 October 2026, the day after the runtime README called it supported, and the reviewers credit role-scoped keys, numeric quotas and per-second prices of $0.015 per GiB-hour. Read it as a hosted sandbox with low published prices and no status page, SLA or security programme, where an idle sandbox bills until a ttl is set.