cold start p50
Open source · Alpha 0.1.0
Agent execution
without the leap of faith.
Run untrusted shell and file operations on your own Kubernetes cluster. Every runtime is a gVisor Pod. Every workspace survives it. Scale workers from zero to N without rebuilding the control plane.
MIT licensed
Self-hosted
kubeadm
Elastic workers
No vendor runtime
$ make quickstart
[1/5] checking host prerequisites
✓ kubeadm cluster ready
✓ Runtime worker pool ready
✓ gVisor kernel verified
✓ workspace survived restart
✓ host fallback blocked
sandbox-ready
runtime/gvisor healthy
warm execution p50
contract tests
host fallbacks
Designed for a hostile workload
A narrow waist between your agent and everything else.
One authenticated API crosses the boundary. The control plane owns policy; the runtime gets only the capability it needs.
YOUR PROCESS
Python SDKtyped client
sandbox CLIshell native
MCP bridge9 agent tools
HTTPS + tenant API key
TRUSTED · SANDBOX-SYSTEM
Control Planeadmission · quotas · credentials · lifecycle
SQL stateS3 checkpoints
default-deny NetworkPolicy
UNTRUSTED · GVISOR WORKER POOL · 0…N
gVisor RuntimeClass
Ephemeral Runtime Pods × N
non-rootread-only rootno SA token
Durable WorkspaceCephFS RWX · survives worker churn
The security model is executable
Claims you can grep. Boundaries you can break-test.
Fail closed, always
If the control plane or runtime disappears, execution stops. There is no local subprocess escape hatch.
fallbacks_to_host = false
Credential-bound tenancy
Tenant identity comes from the API key—not a request field. Cross-tenant access is tested before Kubernetes is called.
wrong_tenant → 404
Disposable compute, durable files
Stop and replace a Runtime without discarding its Workspace. Checkpoints are explicit recovery, not hidden magic.
runtime ≠ workspace
No privileged shortcuts
No Docker socket, no service-account token, non-root processes, and a read-only root filesystem.
kernel = gVisor
Elastic Runtime workers
Add workers without rebuilding the control plane. Scale-down preflights every target and refuses to strand an active Runtime.
make scale-workers WORKERS=N
One cluster. No hidden coupling.
A standalone kubeadm topology with ordinary labels, taints, RuntimeClass, and RWX storage. No infrastructure repository is imported.
control plane + worker pool
Measured, not hand-waved
Fast enough to stay in the agent loop.
Apple Silicon reference profile, dedicated Lima VM, five runs and one hundred measured iterations. No warm runtime pool.
Read the benchmark method →gVisor Runtime cold startnew Pod · schedule to ready
2.497 s p50
Warm executionexisting Runtime
35.72 ms p50
Workspace createdurable PVC-backed state
29.21 ms p50
Transparent scope: local, multi-node kubeadm, warm images. Not presented as a cloud or node-cold result.
From clone to proof
One command. A real kubeadm cluster.
The quickstart creates a control-plane VM plus a scalable Runtime worker pool, installs kubeadm and gVisor,
deploys the platform, and exercises the security and persistence contract. Resize later with
make scale-workers WORKERS=N.
$ make quickstart