# SlicerVM (Slicer)

Real Linux, in milliseconds — full Linux microVMs with systemd on your Mac, your servers, or your cloud.

Source: https://wheredoirunthis.com/products/slicervm · JSON: https://wheredoirunthis.com/api/products/slicervm · Read on 2026-07-23

## At a glance

- Type: Sandbox
- Kind: Hosted
- Isolation: Firecracker microVM
- Free tier: No
- Starting price: $25/mo per seat
- GPU: Yes
- Regions: Not disclosed
- Coverage: 17 of 54 assessed capabilities supported · 7 not assessed
- Agent readiness: read 7 of 11 signals, drive 8 of 10 signals

## Links

- Homepage: https://slicervm.com/
- Docs: https://docs.slicervm.com/
- Pricing: https://slicervm.com/pricing/
- Repository: https://github.com/slicervm

## Pricing

- Model: Flat-rate commercial license (subscription) — per-seat (Individual/Team) and per-server (Platform). Self-hosted; zero usage metering.
- Unit: seat (Individual/Team) or server (Platform)
- Free tier: No

| Tier | Price | Includes | Notes |
| --- | --- | --- | --- |
| Individual | $25/mo (14-day free trial) | Full Slicer on your own hardware for personal projects, homelabs, or your day job. 2× concurrent daemons (Linux/WSL2/Mac), unlimited VMs per daemon, REST API + Go/TS SDK + CLI, egress filtering proxy, K3sup Pro, Discord community support. NOT for shared deployments. |  [source](https://slicervm.com/pricing/) |
| Team | $125/mo (5 seats; +$25/mo per extra seat) | 5-seat baseline for teams to run Slicer on work devices; centralised billing. 2× daemons per seat, unlimited VMs per daemon, one seat per named developer. Same automation surface + egress proxy. NOT for shared deployments. |  [source](https://slicervm.com/pricing/) |
| Platform | $250/mo per server | For shared infrastructure, internal systems, and customer-facing products (embed microVM sandboxes in a SaaS). Licensed per server — unlimited daemons + VMs per server. Private Discord channel + email support. | Per-SERVER licensing (not per-seat). Custom/volume terms, SLA, annual billing available on top of Team/Platform. [source](https://slicervm.com/pricing/) |

- Overages: Team: +$25/mo per extra seat beyond the 5-seat baseline. No usage/compute overages (flat license, self-hosted).
- Card required: Yes
- Source: https://slicervm.com/pricing/

## Runtime

- **GPU & accelerators**: Yes [source](https://docs.slicervm.com/reference/vfio/)
- **BYOC (Bring your own cloud)**: self-hosted (runs entirely on customer-owned hardware/cloud) — beyond BYOC; no vendor control plane — "Runs on your Mac, bare-metal servers, mini PCs (NUC/N100/Beelink), Raspberry Pi, or cloud VMs with nested virt (GCE, Azure, OCI, DigitalOcean, AWS EC2). Not a hosted-with-BYOC model — there is no vendor infrastructure at all." [source](https://slicervm.com/microvms/) (confidence: high)
- **Secrets management**: Yes [source](https://slicervm.com/egress/)
- **Storage options**: ZFS-backed VM disks; persistent (Services, `storage: image`) or ephemeral (Sandboxes, cleaned on shutdown); VirtioFS folder sharing from host (Mac) [source](https://docs.slicervm.com/reference/api/)
- **Supported workloads**: AI agent sandboxes / code execution, coding agents (Claude Code, Codex, OpenCode) in an isolated root VM, K3s / HA Kubernetes clusters (dev, test, demos, autoscaling), long-lived dev environments / homelabs, GPU inference & fine-tuning, remote BuildKit / CI, code-review bots [source](https://docs.slicervm.com/examples/)
- **Persistence**: both — "Sandboxes = ephemeral/disposable microVMs (host group count:0, disk/snapshot cleaned on shutdown). Services = persistent VMs ('storage: image' persistent by default; `persistent` flag in YAML). ZFS-backed disks." [source](https://docs.slicervm.com/reference/api/) (confidence: high)
- **Data jurisdiction**: customer-controlled — data never leaves the customer's network — "'Self-hosted. Zero metering... data never leaves your network'; 'Nothing leaves your machine.' Jurisdiction is wherever the operator runs the host." [source](https://slicervm.com/) (confidence: high)
- **Resource limits & quotas**: License-based (not usage-metered): Individual/Team = 2× concurrent Slicer daemons per seat, unlimited VMs per daemon; Platform = per-server license, unlimited daemons + VMs per server. [source](https://slicervm.com/pricing/)
- **SDK languages**: Go, TypeScript [source](https://docs.slicervm.com/platform/go-sdk/)
- **Network & egress controls**: Yes [source](https://slicervm.com/egress/)
- **Snapshots & forks**: Yes [source](https://slicervm.com/)
- **Deployment methods**: cli, api, sdk — "`slicer` CLI, REST API, Go SDK + TypeScript SDK. Services launched from YAML host-group config; Sandboxes launched via API. Launch-time customisation via userdata (cloud-init-style)." [source](https://docs.slicervm.com/) (confidence: high)
- **Isolation**: Firecracker microVM — "PRIMARY (Linux/KVM core): 'Slicer turns the very raw Firecracker technology into a production-ready product'; 'Slicer for Linux uses KVM'. MIXED: the Mac port runs microVMs on Apple's Virtualization.framework (not Firecracker) — 'Slicer for Mac uses Apple Virtualization'. Firecracker recorded as the best-evidenced primary (the original/Linux substrate); Mac = Apple Virtualization microVMs. Both are microVM/own-kernel isolation." [source](https://slicervm.com/microvms/) (confidence: high)

## Capabilities

### AI & agents

| Capability | Status | Evidence |
| --- | --- | --- |
| Agent skills | Supported | "Agent skills: K3s, Docker, ArgoCD" [source](https://slicervm.com/blog/let-your-agent-drive/) |
| AI app builder | Not applicable | "n/a" [source](https://slicervm.com/) |
| Autonomous QA agent | Not supported | "Every PR we ship is reviewed in a sandbox" [source](https://slicervm.com/blog/evolving-our-code-review-bot-with-slicer-sandboxes/) |
| Built-in coding agent | Not supported | "Run Claude, Codex, and OpenCode in its own VM" [source](https://docs.slicervm.com/mac/coding-agents/) |
| BYOK for LLMs | Not supported | "Register a Bearer, Basic, or OAuth credential once" [source](https://slicervm.com/egress/) |
| Credential-injection proxy | Not assessed |  |
| LLM gateway | Not supported | "inject=llama ... host=api.example path=/v1/chat/completions" [source](https://slicervm.com/egress/) |
| MCP client | Not supported | "no MCP client" [source](https://docs.slicervm.com/) |
| MCP-server hosting | Not supported | "no MCP hosting feature" [source](https://slicervm.com/) |
| MCP server | Not supported | "no MCP server documented" [source](https://docs.slicervm.com/) |
| Model inference API (first-party) | Not supported | "trying Claude Code with Ollama" [source](https://slicervm.com/blog/trying-claude-code-with-ollama/) |
| Preinstalled coding agent | Not assessed |  |

### Networking & delivery

| Capability | Status | Evidence |
| --- | --- | --- |
| Automatic HTTPS | Not applicable | "Full Linux system ... bespoke networking configurations" [source](https://docs.slicervm.com/) |
| Custom domains | Not applicable | "Real Linux, on your hardware" [source](https://slicervm.com/) |
| Direct public IPv6 | Not applicable | "bespoke networking configurations" [source](https://docs.slicervm.com/) |
| Edge KV store | Not applicable | "n/a" [source](https://slicervm.com/) |
| Egress controls | Supported | "Default-deny egress. Per-host allow rules with method + path filters. Bearer, Basic, and OAuth secrets injected on the wire, never inside the workload." [source](https://slicervm.com/egress/) |
| Email send / receive | Not applicable | "n/a" [source](https://slicervm.com/) |
| Public preview URLs | Not applicable | "Nothing leaves your machine." [source](https://slicervm.com/) |
| Private networking | Supported | "VM & network isolation ... isolated network mode ... slicer proxy up --hostgroup lab --bind 192.168.222.1" [source](https://slicervm.com/blog/isolated-network-mode/) |
| Built-in reverse proxy | Partially supported | "Guest agent with cp, exec, shell, metrics, and port-forwarding" [source](https://docs.slicervm.com/tasks/execute-commands/) |

### Organisation & security

| Capability | Status | Evidence |
| --- | --- | --- |
| Built-in auth | Not supported | "Send an `Authorization: Bearer TOKEN` header for authenticated Slicer daemons." [source](https://docs.slicervm.com/reference/api/) |
| BYOC | Supported | "Run on your own hardware, in the cloud, or both ... Google Cloud (GCE), Microsoft Azure, Oracle Cloud (OCI), DigitalOcean, AWS EC2 (nested virtualization)." [source](https://slicervm.com/microvms/) |
| Deploy into customers' VPCs | Not assessed |  |
| Secrets management | Supported | "Secrets that stay on the host ... The proxy injects it on matching requests and strips the workload's placeholder ... never touch the VM." [source](https://slicervm.com/egress/) |
| Self-host / OSS core | Partially supported | "Slicer ... is licensed as commercial software and must not be used without a valid license key issued by OpenFaaS Ltd." [source](https://slicervm.com/eula/) |
| Sharing | Not applicable | "Nothing leaves your machine." [source](https://slicervm.com/) |
| SSO / SAML | Not applicable | "One seat per named developer" [source](https://slicervm.com/pricing/) |
| Teams | Supported | "Team ... 5 seat baseline (starter team), plus $25/mo per extra seat ... Easy, centralised billing." [source](https://slicervm.com/pricing/) |
| Workload identity | Not assessed |  |

### Developer access

| Capability | Status | Evidence |
| --- | --- | --- |
| CLI | Supported | "$ slicer vm new / slicer vm cp / slicer vm exec / slicer proxy up" [source](https://docs.slicervm.com/getting-started/install/) |
| E2B-compatible API | Not assessed |  |
| Filesystem API | Supported | "Copy files in, run commands, pull results out. No SSH, no Ansible. ... slicer vm cp ./pr.tgz vm-1:/home/ubuntu/" [source](https://slicervm.com/) |
| Git deploy | Not applicable | "n/a" [source](https://slicervm.com/) |
| HTTP data API | Not applicable | "n/a" [source](https://slicervm.com/) |
| OpenAPI spec | Supported | "openapi: 3.0.3 ... 27 documented paths; ErrorResponse schema" [source](https://docs.slicervm.com/openapi.yaml) |
| Private container registry | Not supported | "FROM ghcr.io/openfaasltd/slicer-systemd-ubuntu24.04 ... Extend a Slicer OS image" [source](https://slicervm.com/) |
| Public API | Supported | "This page documents the HTTP API exposed by Slicer for managing micro-VMs, images, disks, and operations." [source](https://docs.slicervm.com/reference/api/) |
| SDK | Supported | "Go SDK / TypeScript SDK" [source](https://docs.slicervm.com/platform/go-sdk/) |
| SSH access | Supported | "Run Claude, Codex, and OpenCode in its own VM with root access." [source](https://docs.slicervm.com/mac/coding-agents/) |

### Compute & storage

| Capability | Status | Evidence |
| --- | --- | --- |
| Cloud-init / ignition config | Supported | "$ slicer vm new --userdata-file setup_opencode.sh" [source](https://slicervm.com/) |
| Desktop / computer-use sandbox | Not applicable | "n/a" [source](https://slicervm.com/) |
| GPU compute | Supported | "Attach GPUs to microVMs for inference, fine-tuning, transcription, and more." [source](https://docs.slicervm.com/reference/vfio/) |
| Live-state (memory) snapshots | Not assessed |  |
| Multi-region | Not applicable | "Run on your own hardware, in the cloud, or both." [source](https://slicervm.com/microvms/) |
| Object storage | Not applicable | "n/a" [source](https://slicervm.com/) |
| Persistent disk | Supported | "A Slicer Service ... disk persistence is controlled via the `persistent` flag ... `storage: image` is persistent by default." [source](https://docs.slicervm.com/reference/api/) |
| Sandbox templates / custom images | Supported | "Customise microVMs via userdata or custom Docker/OCI images ... FROM ghcr.io/openfaasltd/slicer-systemd-ubuntu24.04 ... RUN apt-get install" [source](https://slicervm.com/pricing/) |
| Scale to zero | Partially supported | "Sandboxes are launched into a host group which has a `count: 0` on start-up" [source](https://docs.slicervm.com/) |
| Selectable isolation runtime | Not assessed |  |
| Snapshots / forking | Supported | "ZFS snapshots make every launch instant. Test, throw away, repeat." [source](https://slicervm.com/) |

### Data

| Capability | Status | Evidence |
| --- | --- | --- |
| Database branching | Not applicable | "n/a" [source](https://slicervm.com/) |
| Ephemeral instant DB (no-signup) | Not applicable | "n/a" [source](https://slicervm.com/) |
| First-party database | Not applicable | "n/a" [source](https://slicervm.com/) |
| Vector search | Not applicable | "n/a" [source](https://slicervm.com/) |

### Platform & operations

| Capability | Status | Evidence |
| --- | --- | --- |
| Managed CI/CD runners | Not supported | "Slicer's code has run 3M+ CI minutes on Arm runners for CNCF" [source](https://actuated.com/blog/millions-of-cncf-minutes) |
| Built-in observability | Partially supported | "Guest agent with cp, exec, shell, metrics, and port-forwarding" [source](https://docs.slicervm.com/tasks/execute-commands/) |
| Preview environments | Not applicable | "n/a" [source](https://slicervm.com/) |
| Scheduled tasks | Not supported | "Every microVM runs a real kernel with systemd, package managers, and cron." [source](https://slicervm.com/) |
| Project template marketplace | Not applicable | "n/a" [source](https://slicervm.com/) |
| Durable workflows | Not applicable | "n/a" [source](https://slicervm.com/) |

## Agent readiness

### Read: 7 of 11 signals present

7/11 signals (6 full, 1 partial)

- Llms txt: fail — "No /llms.txt (apex Next.js returns the SPA shell); docs (mkdocs-material) serves no llms.txt."
- Llms full txt: fail — "No /llms-full.txt."
- Robots AI policy: partial — "robots.txt = 'User-Agent: * / Allow: /' — silent default-allow, no explicit AI-UA policy."
- JSON LD: fail — "0 <script type=ld+json> on the homepage (rich OG meta present, but no JSON-LD)."
- Sitemap: pass — "sitemap.xml present, 22 URLs (marketing + blog); referenced in robots.txt."
- Meta quality: pass — "Complete <title>, meta description, and full OpenGraph (og:title/description/image/url) — descriptive."
- Markdown negotiation: fail — "No markdown variant served on content negotiation (Next.js apex + mkdocs docs)."
- Content efficiency: pass — "Readable-text ÷ HTML = 9.2% (server-rendered, >5%)."
- Docs discoverable: pass — "'Documentation' is a first-class hero/nav link to docs.slicervm.com, reachable without JS."
- Pricing machine readable: pass — "Structured pricing page with three named tiers + explicit prices ($25 / $125 / $250)."
- Anti bot: pass — "No challenge on public content — curl + firecrawl fetched landing, pricing, docs, OpenAPI, sitemap cleanly."

### Drive: 8 of 10 signals present

8/10 signals (6 full, 2 partial)

- Public API: pass — "Documented REST API (docs.slicervm.com/reference/api/) for managing micro-VMs, images, disks, operations."
- Openapi spec: pass — "Fetchable, valid OpenAPI 3.0.3 spec at docs.slicervm.com/openapi.yaml (27 paths, ErrorResponse schema)."
- MCP server: fail — "No MCP server (no /.well-known/mcp, no documented/npm MCP server)."
- SDK packages: pass — "Two official SDKs — Go + TypeScript."
- Auth docs: pass — "Clear API-auth docs: enable daemon auth, token saved to /var/lib/slicer/auth/token, send 'Authorization: Bearer TOKEN'."
- Agent self serve creds: partial — "Self-service purchase (14-day trial + card, no sales gate); the API token is then auto-generated on the self-hosted daemon (programmatic). Partial — a license purchase/human step precedes running the daemon."
- Webhooks: fail — "No documented webhooks."
- CLI tool: pass — "Official `slicer` CLI."
- Error model: pass — "OpenAPI defines an ErrorResponse schema (required `error`) returned across endpoints — a documented JSON error model."
- Rate limit docs: na — "Self-hosted single-tenant daemon — no vendor API rate limits apply; dropped from the denominator."
- Agent config: partial — "A published agent-skills repo (github.com/slicervm/agent-skills) is one agent-config surface; no agents.md or /.well-known/agent."

## Coding harnesses

- Claude Code (Anthropic) — "Run Claude, Codex, and OpenCode in its own VM with root access. Copy out the results when it's done." [source](https://docs.slicervm.com/mac/coding-agents/)
- Codex CLI (OpenAI) — "Run Claude, Codex, and OpenCode in its own VM with root access." [source](https://docs.slicervm.com/mac/coding-agents/)
- OpenCode (opencode) — "$ slicer vm exec vm-1 opencode -m "Review this code and quit when done" — OpenCode driven inside a Slicer microVM." [source](https://slicervm.com/)

Plausible compatibility (derived, not stored):

- Aider
- Amp
- Antigravity
- Devin
- Droid
- Gemini CLI
- Goose
- Hermes Agent
- Kilo Code
- Kiro CLI
- Pi
- Qwen Code

## Compliance & regions

- Regions note: SELF-HOSTED — there are NO vendor-operated regions. Placement is entirely the operator's choice: their Mac, Linux bare-metal (Hetzner, AWS Metal, PhoenixNAP, Vultr, Scaleway, OVHCloud, colo), mini PCs / Raspberry Pi, or a cloud VM with nested virt (GCE, Azure, OCI, DigitalOcean, AWS EC2). 'disclosed:false' reflects that region is not a product facet, not that it is hidden.

## Company & presence

- Headquarters: Peterborough, England, UK
- Founded: OpenFaaS Ltd incorporated 2017 (company #11076587); Slicer developed internally since 2022, publicly launched as a product in 2025.
- Terms of service: https://slicervm.com/eula/
- GitHub: https://github.com/slicervm
- Discord: https://slicervm.com/pricing/
- Blog: https://slicervm.com/blog/
- X/Twitter: https://x.com/alexellisuk

## Nearby in the atlas

- [Agent Safehouse](/products/agent-safehouse.md)
- [Agent Sandbox](/products/agent-sandbox.md)
- [Agent Substrate](/products/agent-substrate.md)
- [Agent37](/products/agent37.md)
- [AgentNest](/products/agentnest.md)
- [Anthropic Sandbox Runtime (srt)](/products/sandbox-runtime.md)

## Method

Facts come from the product's own public pages. Each claim carries its evidence: a quote and the page it came from. We count capabilities rather than grade products, and "Not assessed" means we have not checked, never that the product lacks it.