Skip to main content

​
Why Sandboxes

Prime Sandboxes are disposable, isolated environments for AI-assisted coding, benchmarking, and quick experiments. They give agents and humans a clean workspace without touching production infrastructure. New sandboxes are VM sandboxes by default.
Container sandboxes have been deprecated. Prime Sandboxes run on VM sandboxes. Previously built images may no longer appear in lists; creating a sandbox by image reference still works.
Sandbox Dashboard
  • Prototype quickly – launch a clean runtime and iterate without worrying about teardown.
  • Benchmark safely – run untrusted code or model evaluations in a locked-down environment.
  • Run AI agents securely – restrict where code can reach with network allow/deny lists.
  • Inject secrets safely – pass API keys, passwords, and tokens as encrypted secrets that never appear in logs or API responses.
  • Teach & demo – hand teammates a reproducible workspace that mirrors your setup.
  • Use custom images – push your own Docker images and use them in sandboxes with all your dependencies pre-installed.
  • Organize with labels – tag sandboxes by project, team, or environment for easy filtering and bulk cleanup.

​
VM Sandboxes

VM sandboxes boot an OCI/Docker image as the root filesystem of a hardware-isolated microVM. Use them when you need a stronger isolation boundary or VM-only egress controls. VM sandboxes were built with agentic RL in mind. They offer:
  • Full VM fidelity - supports Docker, systemd, background services, and kernel-dependent workloads.
  • Fast startup - we can start thousands of concurrent sandboxes in seconds, with image-aware scheduling for heterogeneous training runs.
  • Latency – commands come back noticeably faster.
  • GPUs – GPU sandboxes are VM-only (coming soon).
  • Snapshots - save, restore, and fork a sandbox mid-run, preserving & branching your trajectories (coming soon).

​
First Run

Make sure you have an API key with the right permissions on hand (prime login) before running these commands.
Track usage limits and billing inside the Prime Billing dashboard.

​
Pricing

Sandboxes are billed while running:
  • CPU: $0.04 per vCPU per hour
  • Memory: $0.013 per GiB per hour
  • Disk: $0.001 per GB per hour
Example: 1 vCPU, 2 GiB RAM, 10 GB disk → $0.08/hour.

​
Limits

​
Per-sandbox — VM sandboxes

CPU is allocated in whole vCPUs. Fractional requests are rounded down to the nearest whole vCPU, with a minimum of 1 vCPU. Any negative timeout value removes the lifetime deadline. Idle timeouts must be between 1 and 1,440 minutes and cannot exceed a finite lifetime.

​
Per-account

Account limits apply across all running sandboxes. If you need higher limits, contact support.

​
Images

Sandboxes run standard Docker images. When you pass an image reference to prime sandbox create, it resolves in this order:
  1. Prime Images — references that start with prime/, like prime/<username>/<image>:<tag>, prime/<team-slug>/<image>:<tag>, or the id forms (prime/<userId>/<image>:<tag>, prime/team-<teamId>/<image>:<tag>), resolve to a Prime Image you can access: your own, your team’s, or one that’s been published.
  2. Docker Hub — any other reference with no registry host and no prime/ prefix resolves as a Docker Hub image, so official images like ubuntu:22.04 or pytorch/pytorch:latest work as usual.
  3. Other public registries — references hosted on registries like ghcr.io or quay.io are not accepted directly. Transfer the image into Prime first with prime images push --source-image, then reference the resulting prime/ image.

​
VM sandbox images

VM sandboxes boot Prime Images and Docker Hub images. The first time a given image is launched as a VM sandbox, Prime converts it into a VM image. The sandbox stays PENDING while that runs, which can take a few minutes; later sandboxes from the same image start normally.

​
GPU Support

GPU-enabled sandboxes are coming soon. They run only on VM sandboxes and need an explicit grant from Prime, so --gpu-count above 0 returns an error until your account has access. We’ll announce as soon as GPU tiers open up.

​
Next Steps