Your request · the atlas’s suggestions

Places to consider.

A ranked starting point, not a promise. Read the fit, check the caveats, and explore the profiles.

This request and its results are public: they may appear on the homepage and in search engines.

1. 01

   Beam

   Excellent fithigh certainty

   Key takeaway

   MicroVM sandboxes with filesystem and memory snapshots for safe untrusted code execution and rollback.

   Before you choose

   • Verify what concurrency your expected untrusted-code volume requires, since plan concurrency limits (5 GPU / 30 CPU containers on Developer, 50 GPU / 1,000 CPU on Team) may bind you.
   • Sandbox cold boot is stated as 1-3s; confirm that latency is acceptable.
   • The supplied facts do not establish the exact sandbox pricing at your usage.
   Why it fits your request

   The supplied facts state Beam runs secure agent code execution sandboxes on a kata-gvisor-microvm isolation primitive, matching your need to run untrusted code safely.

   It offers both filesystem snapshots (reusable as base images) and CRIU-based memory snapshots that restore running processes and exposed ports, matching your snapshot rollback need.

   It is hosted and self-hostable, and storage is included free, so budget should suit an any-budget requirement.

   Explore Beam profile
2. 02

   Celesto AI

   Excellent fithigh certainty

   Key takeaway

   Firecracker sandboxes for untrusted code with full snapshots and persistent volumes to roll back.

   Before you choose

   • Celesto Cloud pricing is metered in OpenClaw runtimes and tool calls rather than compute-time, so confirm how that maps to an LLM agent's call volume.
   • No GPU is offered, which may or may not matter to your sandbox workload.
   • Check the resource ranges (1-32 vCPU, 128-16384 MiB RAM) against your needs, and whether the snapshot semantics restore in-memory process state or only disk.
   Why it fits your request

   The supplied facts state Celesto AI is a sandbox product running code-execution and untrusted-code workloads on a firecracker-microvm isolation primitive, matching your safe-execution need.

   Snapshots and forks are supported, and persistence includes full Firecracker snapshots plus persistent attached volumes that survive restart or snapshot, covering rollback.

   It runs hosted or self-hosted under Apache-2.0, with a free tier and free self-host on your own infrastructure.

   Explore Celesto AI profile
3. 03

   Vercel (Vercel Sandbox)

   Excellent fithigh certainty

   Key takeaway

   Firecracker sandboxes for untrusted code with snapshot checkpoints and forks for rollback.

   Before you choose

   • Vercel Sandbox is currently iad1-only, so verify data residency and latency for your users.
   • Max duration is 45 min on Hobby and 5 h on Pro/Enterprise, and I/O waits are excluded from CPU billing, so check whether long-lived agent sessions fit those caps.
   • Snapshot default expiry is 30 days and configurable; snapshot storage is 15 GB lifetime included then metered.
   • Sandbox runs on Vercel's infrastructure only, with no bring-your-own-cloud option.
   Why it fits your request

   Vercel Sandbox is described as an ephemeral compute primitive designed to safely run untrusted or user-generated code, using a firecracker-microvm isolation primitive, which matches your safe-execution requirement.

   Snapshots are manual checkpoints of filesystem plus installed packages, and fork spawns a child sandbox from a known snapshot state, matching rollback.

   Hosted-only operation and the Hobby free tier plus Pro $20/mo with usage billing fit an any-budget requirement.

   Explore Vercel (Vercel Sandbox) profile
4. 04

   Daytona

   Excellent fithigh certainty

   Key takeaway

   Isolated sandboxes for AI-generated code with snapshots and volumes restoring state after stops.

   Before you choose

   • The isolation primitive is container rather than a microVM, so assess whether that is strong enough for your untrusted code; the facts do not detail container hardening.
   • Egress controls, concurrency, compute, and network egress limits are per-organization, and the supplied facts do not state their default values, so confirm them.
   • Multi-region locations are listed; verify the region you need is available.
   • Self-host methods are compose, helm, and source-build.
   Why it fits your request

   Daytona runs ai-agent-code-execution workloads in sandboxes, and the facts state snapshots and forks are supported with persistent Volumes shared across sandboxes without breaking isolation, matching your rollback need.

   Sandboxes run indefinitely with no session cap, auto_stop_interval suspends idle ones, and state survives stop via snapshots plus volumes.

   It supports hosted and self-host, usage-based per-second billing with no plan tiers, a $200 free credit, a free tier, and Customer Managed Compute for self-hosting.

   Explore Daytona profile
5. 05

   smolvm

   Excellent fithigh certainty

   Key takeaway

   Network-off isolated VMs that fork or snapshot for safe untrusted execution and rollback.

   Before you choose

   • Fork and snapshot are noted as not-yet on Windows, so confirm your platform.
   • Hosted cloud rate values are server-side and undisclosed publicly, and hosted quotas are set after waitlist activation, so hosted cost and limits are unknown from the facts.
   • The hosted cloud has no GPU field; GPU is self-host only and needs libkrun built with GPU support plus virglrenderer/Vulkan on the host.
   • There is no dedicated secrets vault; secrets are handled via SSH-agent forwarding.
   Why it fits your request

   smolvm sandboxes untrusted code in VMs, and network is off by default with opt-in egress allowlists, which matches running untrusted code safely.

   It supports machine fork and snapshot on macOS and Linux for rollback, and both ephemeral-by-default machines and persistent machines whose installed packages survive restarts.

   It runs locally, hosted, or self-hosted; the OSS engine is free under Apache-2.0 and hosted cloud is usage-metered CPU-hours plus memory-GB-hours plus exec-count.

   Explore smolvm profile