Composable infrastructure primitives for agents.
Isolated sandboxes, hosted Git, and a versioned filesystem for deploying agent harnesses, running RL rollouts and evals, and building CI that scales.
Free tier included. No credit card required.
import { Sandbox } from "tensorlake";
async function main() {
const sbx = await Sandbox.create();
const result = await sbx.run("/bin/sh", { args: ["-c", "npm install && npm run build"] });
console.log(result.stdout);
}
main();
Give your agent a computer.
harness · tool
Run persistent sandboxes that give an agent its own computer, or spin up ephemeral ones to isolate each tool call.
Give the agent its own filesystem, shell, packages, and processes instead of sharing the app server runtime.
Sandboxes sleep on inactivity and wake instantly when invoked — sessions can run for hours or days.
Compile code, run databases, process large files. Bring any Linux stack.
Execute LLM-generated code inside secure microVMs, isolated from the harness.
POSIX directory mounts and hosted Git so your agents never lose the work they produce.
A versioned filesystem you mount like a disk.
Mount a durable volume and it shows up as an ordinary POSIX directory. Reads and writes hit local NVMe, and every settled change saves itself to durable storage. Take a snapshot to pin a permanent checkpoint, roll back to any point in time, and pick the work back up on another machine after a crash.
A POSIX directory on local NVMe. It runs on any sandbox, cloud VM, or Kubernetes pod, on Linux or macOS.
Settled writes replicate to durable storage on their own, so an agent keeps a versioned working state without ever learning Git.
Seal a permanent checkpoint with one command. Restore or fork the whole tree from any point you kept.
Hand skills, tools, and configs to a whole fleet with read-only mounts that follow head or pin a snapshot.
$ tl fs mount agent-scratch ~/work✓ mounted · session 54398548 · autosave on (~1s)# a normal POSIX directory. writes hit local NVMe$ echo "parser is quadratic" > ~/work/notes.md↻ autosave · settled changes replicate to durable storage$ tl fs snapshot ~/work -m "baseline"✓ snapshot 4d9a2f7e · permanent checkpoint$ tl fs restore agent-scratch @2m-ago✓ time-traveled · mount now at an earlier state↺ crash the sandbox, remount anywhere, and nothing is lost
Managed Git that scales to millions of repos.
Use it as ordinary Git and clone, branch, commit, merge, and push the way you always have. Or mount a repository into a sandbox with no clone at all: work in a private workspace, take snapshots as you go, and promote the result to a branch with a compare-and-swap. Merges run on the server, and you pay for the paths that changed rather than the size of the repo.
Clone, branch, commit, merge, and push over Git smart HTTP. It works with the tools your team already uses.
Stream a branch into a sandbox on demand. Content arrives as it's read, so there's no full checkout to wait on.
Autosave protects a private workspace WAL. A snapshot seals a commit, and promote moves a branch with a compare-and-swap that copies zero bytes.
Merge, rebase, and preflight conflicts without a checkout, at hundreds of pushes per second per repository.
$ tl git mount agent-outputs ./work✓ mounted · workspace ws_3f9a2b7e · no clone, streams on read# build tools run on local NVMe$ npm install && npm run build✓ 143 pkgs · build ok$ tl git snapshot ./work -m "fix parser"✓ snapshot s3 · sealed as a Git commit$ tl git promote ./work main✓ main → s3 · CAS ok · 0 bytes copied↳ git fetch sees it. it's a normal commit
A workspace is just a ref, and each snapshot is an ordinary commit on it. Promote moves main with a compare-and-swap, so no bytes are copied and no trees rebuild. If main has moved, the promote either fails or merges, and the snapshot that lost stays a recoverable commit you can reach through workspace and operation history.
Store anything an agent produces. Version all of it.
Generated code
One repository per generated project, with branches, merges, and a durable history that records who changed what. Keep it somewhere you can publish from.
Generated artifacts
Model outputs, reports, and datasets stay versioned and easy to roll back, so they don't disappear when the sandbox goes away.
Documents
Long-lived working documents with full history, restore, and undo across every editing session.
Session memory
Mount ~/.claude and snapshot after each phase. Agents resume exactly where they left off, on any machine.
Suspend, resume, and copy a whole machine.
suspend · resume · fork
Pause on idle. Wake in a second.
Freeze a sandbox — memory, processes, and filesystem intact — and the meter stops. Resume by name in about a second, or let it wake automatically the moment a request or connection comes in.
$ tl sbx suspend my-dev✓ suspended · meter stopped · state on disk$ tl sbx resume my-dev✓ resumed in 0.9s · pid 4127 still alive↺ auto-wakes on the next request or connection
Fork a running VM, memory and all.
Clone a live sandbox — its memory and filesystem copied whole — then run the copies. A fork of the entire machine: build a base once, then fan out identical copies to run many CI jobs in parallel.
$ tl sbx copy build-base --count 8✓ forked 8 copies (memory + filesystem)build-base-01 … build-base-08 running$ tl sbx ls --tag build-base8 sandboxes · 0 cold starts · ready for jobs
The fastest sandbox file system.
fio · sqlite · p50
SQLite benchmark — 2 vCPU, 4 GB RAM, 100k inserts
View benchmark on GitHub→In our published SQLite benchmark across Tensorlake, Vercel, E2B, Daytona, and Modal, Tensorlake was the fastest across default, fsync, and large-dataset runs. Benchmark setup: 2 vCPU / ~4 GB sandboxes, 3 runs.
Harbor integration for agents evals and RL rollouts.
terminal-bench@2.1
Run your Docker image, unchanged
Import any OCI image and convert it to an ext4 rootfs with full fidelity — filesystem and runtime metadata preserved. Sandboxes boot exactly like your Docker container, no translation errors.
Pre-published, boots in seconds
Images are already there — no per-run build, no first-run pull-and-cache. A multi-minute build becomes a seconds-long boot. That fidelity plus speed is what took the oracle to 1.000.
Snapshot & scale rollouts
Snapshot a warmed environment, then clone and fan out to 10k+ concurrent sandboxes. Checkpoint and resume at any step, write to object storage.
# pre-published image — boots directly, no rebuild harbor run --env tensorlake \ --dataset terminal-bench/terminal-bench-2-1 \ --agent claude-code \ --model anthropic/claude-opus-4-8 \ --ae ANTHROPIC_API_KEY=$ANTHROPIC_API_KEY # oracle pass — reproduces the run on the right harbor run --env tensorlake \ --dataset terminal-bench/terminal-bench-2-1 \ --agent oracle
terminal-bench • oracle ┏━━━━━━━━┳━━━━━━━━━━━━┳━━━━━━━┓ ┃ Trials ┃ Exceptions ┃ Mean ┃ ┡━━━━━━━━╇━━━━━━━━━━━━╇━━━━━━━┩ │ 89 │ 0 │ 1.000 │ └────────┴────────────┴───────┘ ┏━━━━━━━━┳━━━━━━━┓ ┃ Reward ┃ Count ┃ ┡━━━━━━━━╇━━━━━━━┩ │ 1.0 │ 89 │ └────────┴───────┘ Job Info Total runtime: 36m 44s
Tensorlake 1.000 · 36m 44s — 1.7× faster than the next best provider.
Sandbox-native orchestration for agents.
endpoints · durability
Once sandbox usage turns into a real application, Orchestrate coordinates it.
The layer that adds application endpoints, durability, fan-out, retries, and application-level observability on top of sandbox execution.
Expose sandbox-backed workflows as callable applications instead of stitching together raw VM APIs.
Predictable throughput means fresh sessions spin up immediately, even when a thousand others are mid-task.
Dormant sandboxes resume on incoming traffic. Every session gets its own sandbox so nothing leaks across runs.
Durable primitives for long-running agentic flows. Application observability baked in.
# PDF → Markdown with Claude
from tensorlake.applications import application, function
from anthropic import Anthropic
claude = Anthropic()
@application()
@function()
def to_markdown(pdf_url: str) -> str:
pdf = fetch(pdf_url)
msg = claude.messages.create(
model="claude-sonnet-4-5",
max_tokens=8192,
messages=[{"role": "user", "content": [
{"type": "document", "source": pdf},
{"type": "text", "text": "Convert to clean Markdown."},
]}],
)
return msg.content[0].text
SSH in from any machine. The sandbox is your dev environment too.
ssh · vs code · pty
A named sandbox isn't only an execution surface — it's a portable cloud workstation. Register your key once, then ssh in, or open it in VS Code, Cursor, or JetBrains Gateway over Remote-SSH. scp, rsync, and full port-forwarding all ride the same connection.
- PORTABLE IDENTITY
- Connect to the same sandbox id from any laptop. Which region or host the VM lives on is the platform's problem — not yours.
- SUSPEND ON IDLE
- Named sandboxes auto-suspend after the idle timeout. The clock pauses while you're connected, so you only pay while you work.
- STATE SURVIVES RESUME
- Filesystem, memory, running processes, tmux sessions and ~/.vscode-server are exactly where you left them — resume by name, weeks later.
- PTY OVER WEBSOCKET
- Building a browser terminal? Drive a programmatic PTY over WebSocket, disconnect, and reattach to the same session by token.
Run it in our cloud — or yours.
SOC 2 · HIPAA
Bring Tensorlake into your cloud.
Run sandboxes and applications inside your own AWS / GCP / Azure account when you need lower egress, stricter network boundaries, dedicated capacity or more predictable performance.
Security built for agentic workflows.
LLM-generated code runs in isolated VMs, not shared processes. Full audit trails, per-project data boundaries, and compliance for regulated workloads.