A fresh microVM
for every run.
Tensile Sandbox is state-of-the-art Firecracker microVM isolation — sub-second boots and hard, kernel-level separation — the flagship substrate for agents, evals, RL rollouts, and load tests on Tensile. It runs on your own hardware, and it's the drop-in replacement for Modal. Training and inference schedule onto your Kubernetes/Volcano or Slurm cluster instead — the sandbox is for isolated, untrusted work.
Containers share a kernel. Untrusted AI workloads shouldn't.
Agents run arbitrary code, evals pull arbitrary models, rollouts touch the network. A shared-kernel container is one escape away from the host. Firecracker gives every run its own kernel and a minimal attack surface — the same tech that isolates serverless at scale — but it boots in milliseconds, so isolation costs you nothing.
Hardware-level isolation
A dedicated guest kernel per run. Tenant and run boundaries are enforced by the VMM, not by namespaces.
Sub-second cold starts
Minimal microVMs boot in ~180ms — a fresh, clean machine per run with no warm-pool bookkeeping.
Small blast radius
A stripped guest with no extra daemons. Less to attack, less to patch, nothing shared with the next tenant.
Provision, run, stream, tear down.
Boot a microVM from an image, pinned to your tenant and run id.
Run the workload harness inside the guest — agent, eval, or rollout.
Logs, spans, and artifacts stream back to the control plane live.
Tear down on exit. Nothing persists into the next run.
from tensile import Sandbox # One microVM, scoped to your org + runwith Sandbox.launch(image="python:3.12", cpu=4, mem="8Gi") as vm: vm.exec("pip install -e . && pytest -q") # streams live art = vm.collect("./artifacts") # pulled to the registry# → VM reclaimed; nothing shared with the next runThe substrate under every workload.
Same ergonomics. Your infra. Lower cost per verified outcome.
| Tensile Sandbox | Hosted (Modal) | |
|---|---|---|
| Runs on | Your hardware / cloud | Vendor cloud |
| Isolation | Firecracker microVM | microVM (managed) |
| Data boundary | Never leaves your perimeter | Leaves your perimeter |
| Cost model | Your capacity, metered per outcome | Per-second vendor billing |
| Lock-in | Open substrate, self-hostable | Proprietary |
The Workload Analyzer reports cost per verified outcome by substrate — so the Modal → Tensile move is a decision you make on evidence, family by family, not a leap of faith. See the comparison →