Runtime

Agent sandbox glossary

The terms behind agent sandboxes, each answered in one line and then explained.

  • GiB vs GB: what is the difference?A GiB (gibibyte) is 1,073,741,824 bytes, 2 to the 30th; a GB (gigabyte) is 1,000,000,000 bytes, so a GiB is about 7.4% larger.
  • Shared vs reserved CPU: what is the difference?Shared CPU guarantees a machine a small slice of a core and lets it burst; reserved CPU keeps every one of its vCPUs for it alone.
  • What are cgroups?Control groups (cgroups) are a Linux kernel feature that groups processes so their resource use can be limited and measured.
  • What are least-privilege API keys?A least-privilege API key can do only what its one job needs, such as reading without changing, so a leaked key does less harm.
  • What are Linux namespaces?Linux namespaces give a group of processes a private view of a kernel resource, such as process IDs, mounts or the network.
  • What is a code execution tool?A code execution tool is a tool an LLM calls to run the code it writes, returning the output so the model can use it in its answer.
  • What is a code interpreter?A code interpreter lets an AI model run code in a live session that keeps variables between runs and returns charts and tables.
  • What is a cold start?A cold start is the wait between asking for a new sandbox, VM or function and the moment it can run your first command.
  • What is a container escape?A container escape is when code inside a container breaks its isolation and reaches the host or other containers on the same machine.
  • What is a CPU floor?A CPU floor is the share of a processor a machine is guaranteed when it shares cores, and the least CPU it is billed for while idle.
  • What is a headless browser?A headless browser is a real web browser run without a window, controlled by code, for tests, scraping, screenshots and AI agents.
  • What is a hypervisor?A hypervisor is software that runs virtual machines, giving each guest its own virtual CPUs and memory isolated by the processor's hardware.
  • What is a memory snapshot?A memory snapshot saves a running virtual machine's RAM and device state to files, so it can later resume from exactly that moment.
  • What is a microVM?A microVM is a small virtual machine with its own kernel and only a few emulated devices, built to start in a fraction of a second.
  • What is a preview URL?A preview URL is a temporary web address for an app running in a development or test environment, so people can open it before it ships.
  • What is a remote development environment?A remote development environment is a machine elsewhere that holds your code, tools and processes, driven from your local editor.
  • What is a sandbox fork?A sandbox fork is a new sandbox copied from a running one, with its files, memory and running processes exactly as they were.
  • What is a sandbox lease?A sandbox lease is the time a sandbox may run before it is paused or stopped for you, enforced by the platform rather than your code.
  • What is a sandbox snapshot?A sandbox snapshot is a saved copy of a sandbox's machine that you can start new sandboxes from later, as many times as you like.
  • What is a spending limit?A spending limit is a cap on how much a key, a job or a machine may cost, enforced before the money is spent rather than billed after.
  • What is a virtual machine monitor (VMM)?A virtual machine monitor (VMM) is the program that creates a VM on a hypervisor, emulates its devices and runs its virtual CPUs.
  • What is a warm pool?A warm pool is a set of machines started ahead of demand, so a request takes one that is already running instead of waiting for a boot.
  • What is an agent loop?An agent loop repeats one cycle: the model picks an action, your code runs it, and the result goes back to the model until the task is done.
  • What is an agent sandbox?An agent sandbox is an isolated computer where an AI agent can run programs, install dependencies and work with files safely.
  • What is an egress proxy?An egress proxy is a server that every outbound connection from a machine must pass through, where rules are applied and traffic is logged.
  • What is an ephemeral environment?An ephemeral environment is an isolated copy of a system created for one task, branch or pull request and deleted when that work ends.
  • What is an idempotency key?An idempotency key is a unique string sent with a write so the server can spot a retry and return the first result instead of acting twice.
  • What is an MCP server?An MCP server is a program that offers tools, data and prompts to AI applications over the Model Context Protocol, locally or over HTTP.
  • What is computer use?Computer use is an AI model operating a desktop the way a person does: it reads screenshots and answers with clicks, key presses and typing.
  • What is copy-on-write?Copy-on-write (CoW) lets copies share one set of data until one of them writes; only the part that changes is then copied.
  • What is egress control?Egress control decides which outbound network connections a machine may make: none, only named hosts, or everything but a deny list.
  • What is Firecracker?Firecracker is an open-source virtual machine monitor from AWS that uses Linux KVM to run lightweight microVMs, each with its own kernel.
  • What is gVisor?gVisor is Google's open-source application kernel, written in Go, that intercepts a container's system calls and handles them in user space.
  • What is idle pause?Idle pause suspends a sandbox or VM after a set time with no activity, keeping its state, so nobody pays compute for a machine left open.
  • What is KVM?KVM (Kernel-based Virtual Machine) is the hypervisor built into Linux; it runs guests on the CPU's virtualization extensions.
  • What is p95 latency?p95 latency is the time within which 95% of requests finish; the slowest 5% take longer, so it shows the slow cases an average hides.
  • What is prompt injection?Prompt injection is text that makes a language model ignore its instructions, typed by a user or hidden in a page, file or tool result.
  • What is seccomp?seccomp is a Linux kernel feature that limits which system calls a process may make, using a fixed list or BPF filters.
  • What is SWE-bench?SWE-bench is a benchmark of real GitHub issues: a model gets a codebase and an issue, writes a patch, and the repository's tests judge it.
  • What is the Firecracker jailer?The jailer is a Firecracker program that chroots, namespaces and cgroups a Firecracker process, drops its privileges, then starts it.
  • What is the Model Context Protocol (MCP)?The Model Context Protocol (MCP) is an open standard for connecting AI applications to external tools, data sources and workflows.
  • What is tool calling?Tool calling lets a language model ask your application to run a named function with arguments it chose, then read the result.
  • What is virtio?virtio is an OASIS standard for virtual devices, such as disks and network cards, that a guest drives through shared-memory queues.
  • What is vsock?vsock (AF_VSOCK) is a Linux socket family for talking between a virtual machine and its host, addressed by a context ID and a port.
  • What is workload identity?Workload identity lets code prove what it is with a short-lived signed token, and trade it for cloud access without holding a stored key.