Per-tenant microVM workspaces, created and destroyed around your code
Give any workflow an isolated, per-tenant workspace to run untrusted or AI-generated code — a userspace-kernel sandbox by default or an optional microVM tier with its own kernel — created, injected, and thrown away around your workflow body.
# The workspace is created, injected, and destroyed around the workflow body.
@app.workflow(workspace={"repo_url": "…", "auto_destroy": True})
async def agent(task, services=None):
ws = services["workspace"]
# run untrusted / agent-generated code inside the isolated workspace
return await ws.run(task)DigitalFrontier Flow Sandbox features
Ephemeral, per-tenant workspaces
Give a workflow an isolated, per-tenant workspace to run untrusted or AI-generated code, then throw it away — created, injected as a service, and destroyed around your workflow body by a single decorator.
Choose your isolation tier
Each workspace gets its own isolation — a userspace-kernel sandbox by default, or an optional microVM tier that gives it a separate kernel — with CPU, memory, PID and disk limits applied per workspace.
Locked-down workspace egress
On a self-hosted cluster, a workspace's outbound traffic is forced through a per-workspace proxy with a domain allow-list, and the network is severed at the install→run boundary so build-time access can't leak into execution.
Thread-persistent agent workspaces
Keep a workspace alive across a conversation: follow-up messages reuse the same sandbox with its cloned repo and state intact, torn down only on a terminal outcome or timeout — built for coding agents.
Get early access to Flow Sandbox.
Tell us about your workload and we'll get you into the preview.