Platform · 02 · sandboxes
A computer with no standing secrets.
Every sandbox boots with nothing: no credentials, no network, no shared kernel. Capability is granted per call, for seconds, and recorded when it is.
01 / the threat model
Assume the agent is wrong, compromised, or both.
An agent runs text from a model against code from the internet on behalf of a human who is not watching. Prompt injection is not a hypothetical — it is the normal failure mode. So the sandbox is designed as though the process inside it is already hostile.
That rules out a shared kernel. A container escape is a bad day for a CI runner and a catastrophe for an agent holding a production credential, so isolation happens at the hypervisor.
<200ms
warm cold start
From request to usable shell.
0
standing credentials
Tokens are minted per call, scoped and short.
02 / isolation
microVM
what velone runs
Firecracker guest with its own kernel. A guest compromise buys the attacker a disposable VM and nothing else.
container
what most tools run
Shared host kernel and namespaces. Fast and cheap, and one escape away from every other tenant on the box.
03 / what you get
- Isolation
- Firecracker microVM, one guest kernel per session, seccomp-filtered device surface, no nested tenancy.
- Filesystem
- Copy-on-write root, writable scratch, and an explicit mount for the workspace. Snapshot and restore in under a second.
- Network
- Default deny. Egress is an allowlist of hosts per session, resolved and pinned at the proxy, with DNS rebinding blocked.
- Credentials
- None at boot. The sandbox asks the control plane, the policy engine decides, and the token it receives is scoped to one call and expires in seconds.
- Fork
- Branch a running sandbox to try two approaches from identical state. Both branches inherit the parent's ring and evidence lineage.
- Teardown
- Destroyed on session end. Disks are zeroed; nothing is reused between tenants.
- Runtimes
- Python, Node, Go, Rust, Java, and a plain Debian base. Bring your own OCI image for anything else.
- Hardware
- CPU pools by default, GPU pools on request for agents doing local inference or training work.
04 / credentials
The secret never enters the box.
An agent that needs to call Stripe does not receive a Stripe key. It asks for the call, the kernel makes it, and the response comes back through the gateway.
# the agent never holds the key
agent: POST /v1/charges → velone gateway
velone: policy check → ring 1, escalate
velone: wait for approval → mara@acme ✓
velone: mint token → scope=charges:write ttl=20s
velone: forward request → stripe
velone: append evidence → sha256:9c1e8a…f2
agent: ← 201 Created (never saw the credential)05 / questions
Do you build your own hypervisor?
No. Firecracker is excellent and battle-tested; reinventing it would be a bad use of our time. What we build is the binding between the VM, the identity that asked for it, the policy that constrains it, and the record it writes.
Can we run sandboxes in our own cloud account?
Yes. The control plane can schedule onto hosts in your AWS, GCP, or Azure account so that workload data and egress never leave your perimeter. Air-gapped deployments are supported for regulated estates.
How is this different from E2B or Daytona?
Those sell you the computer, and they sell it well. They do not know who asked for it, cannot deny a call before it happens, and do not produce an audit chain an auditor will accept. We are happy to run on top of a sandbox vendor if you already have one.
What does a cold start actually cost?
Under 200ms from a warm pool, roughly 900ms from cold on a new host. Pools are kept warm per region and per runtime; you can pin a pool size if your latency budget is tight.
keep reading
Ring 0
Run untrusted code like you mean it.
Bring the agent that already scares your security team. That is the one worth putting in a box that cannot exfiltrate.