SandboxesOverview

Sandboxes for AI agents

Sandboxes are isolated Linux machines for running code and AI agent tasks on Lizard. Sandboxes run as Firecracker microVMs, each with its own kernel. Create one with Lizard SDK (@lizard-build/sdk for TypeScript, lizard-sdk for Python) or run lizard sandbox create in a terminal. You can then run commands, read and write files, and open ports. In a test on 2026-10-12, the median time from creating a sandbox to its first Python output was 228 ms.

When to use Sandboxes

  • Run code a model wrote. Give an LLM a code interpreter that keeps Python state between calls.
  • Give a coding agent its own machine. Run Claude Code, OpenCode or Codex in a sandbox instead of on your laptop. Connect its credentials with lizard agents and send prompts with lizard sandbox prompt.
  • Preview what the agent built. Start a dev server and open it through a private preview URL.
  • Try several paths at once. Fork a running sandbox, memory and processes included, or restore many copies from one snapshot.
  • Drive a browser. The desktop template runs a graphical desktop that an agent controls with screenshots, clicks and keys.

For a web service or worker that should keep running, deploy an app instead; see the app quickstart.

How fast does a sandbox start?

In a test on 2026-10-12, the median time from creating a sandbox to its first Python output was 228 ms, and the 95th percentile was 310 ms. The test ran 300 times from Railway’s US East region against us-east-1, with the base template and the Small size. Results of the same test for E2B, Daytona and Modal are on the Sandboxes page.

Sandboxes at a glance

QuestionAnswer
What runs the code?A Firecracker microVM with its own kernel; see runtime and templates
How do I create one?Lizard SDK, lizard sandbox, the dashboard, or the HTTP API
Which templates exist?base, interpreter, codex, claude, opencode, pi, prime, desktop and desktop-camoufox (US East only)
What sizes are there?Mini (1 vCPU / 2 GB, 5 GB disk), Small (2 vCPU / 4 GB, 20 GB disk), Medium (4 vCPU / 8 GB, 40 GB disk, the default) and Large (8 vCPU / 16 GB, 80 GB disk). Mini starts only from the base, claude, codex and interpreter templates. The trial runs 1 Small and 2 Mini at a time, in US regions. See sizes and prices
How long does one live?Five minutes by default from the SDK and CLI; no expiration by default from the raw API and dashboard
What survives a pause?The whole disk, including packages installed outside /workspace, plus memory and running processes (a pause with fast: true keeps the disk only)
What survives a stop (kill or expiration)?Files on a Persistent Volume at /workspace, and any snapshot you took; a snapshot holds the whole disk
How many can run at once?Limits count vCPU: 40 on Pro (for example 10 Medium), 220 on Pro 5x, 1,200 on Pro 20x and during the trial 1 Small and 2 Mini at a time; see account limits. Pro, Pro 5x and Pro 20x have no limit on sandbox starts.

Runtime and templates

Choose a template from the current catalog: base, interpreter, codex, claude, opencode, pi, prime, desktop, or desktop-camoufox. Availability depends on the region and pool capacity. interpreter includes Python, common data libraries and Node 22. desktop runs a graphical desktop that you drive with sandbox.desktop or lizard sandbox desktop. desktop-camoufox is the desktop template plus Camoufox, a Firefox build for scraping that you drive with Playwright; it runs only in us-east-1 for now. Check tool versions inside your sandbox. The public CLI does not provide a custom-template upload flow.

Lizard Sandboxes run as Firecracker microVMs, each with its own kernel. Give the agent only the credentials and access needed for its task.

Lifecycle

Create a sandbox, run commands, then call kill. connect attaches to an existing sandbox without changing its state, so it does not resume a paused or stopped sandbox. Pause, resume, snapshot, and restore are available; see Pause, resume, and snapshots. fork copies a running sandbox, memory and processes included; it returns 409 when a volume is attached. File watching is not available yet. lizard sandbox ssh opens an interactive shell with your CLI credentials. SSH protocol access is not available, so SSH clients, scp, and port forwarding do not work.

create -> running -> stopped (kill / expiration)
running -> paused -> running (pause / resume)
running -> new sandboxes (fork)
snapshot -> new sandbox (restore)

Resources and timeouts

Choose a size when you create a sandbox: Mini (1 vCPU / 2 GB, 5 GB disk), Small (2 vCPU / 4 GB, 20 GB disk), Medium (4 vCPU / 8 GB, 40 GB disk, the default), or Large (8 vCPU / 16 GB, 80 GB disk). Mini starts only from the base, claude, codex and interpreter templates, without a volume. During the trial, a sandbox is Mini or Small, 1 Small and 2 Mini at a time, runs in a US region, and is deleted 1 hour after it starts at the latest. See sizes and prices. Select a region explicitly when needed; a catalog entry does not guarantee free capacity.

The SDK and CLI default to a five-minute lifetime. The raw API and dashboard default to no expiration. Set an explicit lifetime: timeoutMs: 0 at creation disables expiration; a positive value sets a deadline. setTimeout accepts 1000 to 2147483647 ms, not zero. Commands do not reset the deadline. This is not an idle timer. During the trial, no lifetime or 0 gets 1 hour, and a lifetime over 1 hour returns HTTP 403 with TRIAL_SANDBOX_LIFETIME; see Lifetime.

Storage and billing

Files and running processes remain available while the sandbox runs. A pause keeps the whole disk, including packages installed outside /workspace, plus memory and running processes; a resume brings all of it back. A snapshot holds the same, and you can restore it after the source sandbox is gone. A stop (kill or expiration) deletes the sandbox’s disk: only files on an attached Persistent Volume at /workspace and the snapshots you took remain. Without a volume, /workspace is part of that disk. Each volume attaches to one sandbox at a time and uses node-local storage; export files that must survive node loss.

Each size has a flat hourly price, billed by the second while the sandbox runs, idle time included. Egress is included up to 2 TB per account over a rolling 30 days. A sandbox restored from a snapshot runs at its source’s size and price. A successful pause stops compute charges; Persistent Volumes bill separately while you keep the data. Pause or kill a sandbox when the task ends. Rates for every resource are on the billing page and pricing.

Guides

Articles on the Lizard blog:

Reference

Object Storage (S3)Quickstart

Updated