Run Untrusted Code Safely.
Self-Hosted or Fully-Managed Sandbox Infrastructure for AI Agents and Ephemeral Workloads.
Documentation · Quick Start · Report Bug · Request Feature
AerolVM is open-source sandbox infrastructure for running isolated code environments - self-host it on your own Linux host, or run it as a managed, multi-tenant service. Each sandbox is a fully isolated compute unit with its own filesystem, network stack, and allocated resources - create latency as low as 4ms server-side (V8 isolate warm path) and supporting OCI containers on containerd (default), gVisor, Firecracker, WASM, and V8-isolate runtimes. Built for AI agent pipelines and ephemeral CI, it ships as a single Go binary backed by Caddy for TLS routing and SQLite for state, with no external dependencies and a one-line installer.
AerolVM provides a complete surface for building sandbox-backed products and agent workflows.
AerolVM beats the two most common alternatives on the axes that matter most for AI workloads: isolation, cost, and operational simplicity.
| AerolVM | e2b | Daytona | |
|---|---|---|---|
| Deployment | ✅ Self-host (single binary, one-line install) or managed multi-tenant SaaS | ✗ Cloud only | ✅ Self-host (complex multi-component setup) |
| Runs locally | ✅ --local flag, no DNS needed |
✗ | ✗ |
| Sandbox startup (server p50) | Isolate ~4ms · WASM ~22ms · Firecracker ~34ms · containerd ~189ms | ~200ms | < 90ms |
| Runtime isolation | ✅ OCI (containerd default) / gVisor / Firecracker / WASM / V8 isolate | Firecracker (microVM) | Docker only |
| Sandbox lifetime | Unlimited | 1 day | Unlimited |
| Serverless / Workers-style sandboxes | ✅ WASM + V8 isolate | ✗ | ✗ |
| TCP + TLS port routing | ✅ | ✗ | ✗ |
| Per-sandbox egress control | ✅ | ✗ | ✗ |
| External storage | ✅ S3 / NFS / SSHFS / rclone | ✗ | ✗ |
| GPU support | ✅ | ✗ | ✗ |
| HA cluster mode | ✅ Raft + SWIM gossip | Managed (opaque) | ✗ |
| Drop-in SDK compat | ✅ /daytona and /e2b facades |
✗ | ✗ |
| Price (100 × 2vCPU/4GB sandboxes/mo) | ~$4,000 on your infra | ~$12,000 | ~$12,000 |
| SDK languages | TS, Python, Go, Rust, Java | TS, Python | TS, Python, Ruby, Go, Java |
| Open source | ✅ MIT | ✗ | ✅ AGPL |
e2b is the fastest managed path if you want zero infrastructure, but it means your code runs on someone else's hardware with no self-hosting option, per-sandbox-hour billing that compounds fast at scale, a hard 1-day sandbox lifetime cap, and a single isolation model. AerolVM covers the same AI execution use case on infrastructure you own — pick OCI on containerd, gVisor, Firecracker, WASM, or V8 isolates — with predictable fixed-cost pricing.
Already on the e2b SDK? AerolVM's
/e2bAPI facade means your existing code keeps working - just pointE2B_API_URLat your AerolVM host.
Daytona targets long-lived developer workspaces, not high-frequency ephemeral agent workloads. It requires multi-component infrastructure that is genuinely difficult to self-host and has no kernel-level isolation, no per-sandbox egress control, and no port allowlist. AerolVM is a single binary you install in 60 seconds.
Already on the Daytona SDK? AerolVM's
/daytonaAPI facade lets you swap the backend without touching your SDK code - just updateDAYTONA_API_URL.
AerolVM is a single Go binary (sandboxd) wired to three components:
- Caddy - handles wildcard TLS via DNS-01, L7 HTTP routing (
<sandbox-id>.<domain>), and L4 TCP SNI routing (<sandbox-id>-<port>.<domain>). The daemon talks to the Caddy admin API; no config files are reloaded at runtime. - Runtimes - OCI containers (
runtime: "docker"on the containerd engine by default; dockerd optional), gVisor (runsc), Firecracker (microVM), WASM (WASI workers / resident host), and V8 isolate (workerd). WASM and isolate are host-mediated and Runtime-only. - SQLite (WAL mode, single-writer) - stores sandbox state, the TCP host-port pool, exposed-port intents, and sealed secrets. Single-writer means no contention; WAL mode means reads never block writes.
For multi-host deployments, sandboxd nodes form a cluster using Raft (FSM-replicated placement state) and SWIM gossip (membership + capacity heartbeats). Nodes take server, worker, or ingress roles. The Raft voter count stays fixed at 3 or 5 regardless of how many workers you add - the same topology Kubernetes uses for control-plane vs. data-plane scaling. See Cluster Setup.
┌─────────────────────────────────────────────────────┐
│ sandboxd │
│ │
│ ┌──────────┐ ┌──────────┐ ┌─────────────────┐ │
│ │ HTTP │ │ Service │ │ SQLite store │ │
│ │ API v1 │──▶│ layer │──▶│ (WAL, 1-writer)│ │
│ └──────────┘ └────┬─────┘ └─────────────────┘ │
│ │ │
│ ┌───────────┼───────────┐ │
│ ▼ ▼ ▼ │
│ containerd/gVisor Caddy SSH gateway │
│ FC/WASM/isolate admin API (Ed25519) │
└─────────────────────────────────────────────────────┘
| Runtime | Status | Install / enable | Use case |
|---|---|---|---|
OCI / docker API (runc via containerd) |
✅ Available | Default engine (SB_CONTAINER_ENGINE=containerd) |
Broadest OCI image compatibility. |
gVisor (runsc) |
✅ Available | --with-gvisor |
User-space kernel for untrusted LLM code. |
| Firecracker | ✅ Available | --with-firecracker (bare metal / KVM) |
MicroVM - dedicated kernel per sandbox. |
| WASM | ✅ Available | Config / cluster wasm workers | WASI modules; resident host ~22ms warm create. |
| Isolate (V8 / workerd) | ✅ Available (off by default) | --with-isolate / SB_ENABLE_ISOLATE |
JS/TS fetch handlers; ~4ms warm server create. |
Server-side create from Server-Timing (excludes client↔cluster WAN). Artifacts under integration-tests/reports/. Production deployments use the containerd engine for OCI sandboxes (runtime: "docker" on the wire).
| Runtime / engine | Server p50 | Server p90 | Server p99 | Topology | Notes |
|---|---|---|---|---|---|
| Isolate | 4ms | 6ms | 19ms | single-node-isolate · t3.medium |
Warm path (same tenant group); API p50 266ms is WAN |
| WASM (resident host) | 22ms | 46ms | 50ms | cluster-3-mixed-wasm · t3.large |
Flag-on resident host; no cold-compile tail |
| Firecracker (warm pool) | 34ms | 36ms | 37ms | single-node-fc · c5.metal |
Post warm-pool path; cold/template builds are higher |
| containerd (OCI default) | 189ms | 225ms | 233ms | cluster-3-mixed-containerd · t3.medium |
Default host engine; API runtime remains docker |
| gVisor | 284ms | 330ms | 346ms | cluster-3-mixed-gvisor · t3.medium |
User-space kernel boot cost |
Reproduce: make integration-benchmark-isolate, integration-benchmark-wasm, integration-benchmark-containerd, integration-benchmark-fc, integration-benchmark-gvisor.
AerolVM ships first-party SDKs for five languages. Install the one that matches your stack:
# TypeScript / Node.js
npm install @aerol-ai/aerolvm-sdk
# Python
pip install aerolvm
# Go
go get github.com/aerol-ai/microvm/sdk/go
# Rust
cargo add aerolvm
# Java (Maven)
# <dependency><groupId>ai.aerol</groupId><artifactId>aerolvm-sdk</artifactId></dependency>TypeScript
import { MicroVM } from '@aerol-ai/aerolvm-sdk'
const client = new MicroVM({
apiUrl: process.env.SB_API_URL,
patToken: process.env.SB_PAT_TOKEN,
})
const sandbox = await client.create({ image: 'ubuntu:22.04' })
// Run a command and stream output
const stream = await sandbox.execStream('python3 -c "print(\'hello\')"')
stream.on('data', chunk => process.stdout.write(chunk))
// Expose a port and get a public URL
const url = await sandbox.exposePort(3000)
console.log(url) // https://<sandbox-id>-3000.sandbox.example.com
await sandbox.destroy()Python
from aerolvm import MicroVM
import os
client = MicroVM(
api_url=os.environ["SB_API_URL"],
pat_token=os.environ["SB_PAT_TOKEN"],
)
sandbox = client.create(image="ubuntu:22.04")
result = sandbox.exec("python3 -c \"print('hello')\"")
print(result.stdout)
url = sandbox.expose_port(3000)
print(url) # https://<sandbox-id>-3000.sandbox.example.com
sandbox.destroy()Go
package main
import (
"context"
"fmt"
"os"
microvm "github.com/aerol-ai/microvm/sdk/go/pkg/microvm"
sdktypes "github.com/aerol-ai/microvm/sdk/go/pkg/types"
)
func main() {
client := microvm.New(microvm.Options{
APIURL: os.Getenv("SB_API_URL"),
PATToken: os.Getenv("SB_PAT_TOKEN"),
})
ctx := context.Background()
sandbox, _ := client.Create(ctx, sdktypes.CreateSandboxOptions{
Image: "ubuntu:22.04",
})
result, _ := sandbox.Exec(ctx, "echo hello")
fmt.Println(result.Stdout)
sandbox.Destroy(ctx)
}Full examples for Rust and Java are in the SDK Setup docs.
If you are already running the e2b or Daytona SDK, AerolVM has API facades that accept their wire format unchanged:
| Existing SDK | AerolVM facade endpoint | Migration |
|---|---|---|
e2b Python / TypeScript |
/e2b/... |
Set E2B_API_URL=https://your-aerolvm-host |
daytona Python / TypeScript |
/daytona/... |
Set DAYTONA_API_URL=https://your-aerolvm-host |
Using the e2b SDK → · Using the Daytona SDK →
See Server Setup for all installation paths: local development, single-node production with wildcard TLS, and multi-node cluster deployment.
| Use Case | Description |
|---|---|
| AI Code Execution | Run LLM-generated code safely in kernel-isolated environments. Handle untrusted Python, JS, and shell from agent workflows without risking the host. |
| Ephemeral CI / Build Agents | Spin up a fresh environment per job, run tests, collect artifacts, destroy. No persistent state, no environment drift. |
| Customer-Facing Products | Ship interactive code runners, coding interview sandboxes, and per-user compute environments backed by AerolVM's isolation and port exposure. |
| Data Processing Pipelines | Attach S3 or NFS storage, run transforms in parallel across sandboxes, extract results - with per-sandbox network quotas to prevent runaway egress. |
| Guide | Description |
|---|---|
| Quick Start | Spin up a sandbox and run a command in under five minutes. |
| Server Setup | Install and configure AerolVM on a Linux host. |
| SDK Setup | Connect an SDK to your AerolVM server. |
| Sandboxes | Lifecycle states, runtimes, resource limits, and configuration. |
| Sessions | Persistent PTY sessions that survive reconnects with output replay. |
| Snapshots | Stop a sandbox, snapshot its state, restart it later exactly where it left off. |
| Cluster Setup | Multi-node deployment with Raft placement and SWIM gossip. |
| Comparison | AerolVM vs e2b vs Daytona - full feature and cost analysis. |
AerolVM is open source under the MIT License. Contributions are welcome - open an issue first for non-trivial changes so we can align on the approach before you invest time in an implementation.
make fmt # format Go code
make test # run tests
make build # build sandboxd + toolboxd into bin/MIT · © Aerol AI, Inc.