Create at order time
Request multiple sandboxes with the VPS. The intent is saved with the order and reconciles after the signed supervisor is installed.
Optional runtime / one owner · many agents
Give each agent its own boundary.
Split one VPS you already own into isolated, fixed-size sandboxes. Each agent receives a distinct key and workspace without receiving the VPS owner key, a management token, or access to another agent.
Agent Runtime is optional and does not change VPS price, term, or billing. V1 is for one VPS owner's own agents—not unrelated tenants.
One VPS / controlled parallel work
Share capacity without sharing credentials.
Add them later
Enable the runtime on an eligible ready VPS, then create, inspect, stop, restart, preserve, or delete sandboxes through the same API.
Choose each size
Sandboxes on one host do not need to be equal. Pick a published size for each agent; WarpMetal atomically checks the VPS capacity budget.
Keep or expire work
Persistent is the safe default. Temporary workspaces have an explicit lifetime and are permanently cleaned up by the VPS supervisor.
Fixed admission units / no arbitrary limits
Size each agent for its job.
These units reserve CPU, memory, workspace disk, and process count. The live catalog is authoritative and reports what fits on each VPS plan.
01 / sandbox.small
small
0.5 vCPU
- Memory
- 1 GB
- Workspace
- 10 GB
- Processes
- 256
- Image
- WarpMetal pinned
02 / sandbox.medium
medium
1 vCPU
- Memory
- 2 GB
- Workspace
- 20 GB
- Processes
- 512
- Image
- WarpMetal pinned
03 / sandbox.large
large
2 vCPU
- Memory
- 4 GB
- Workspace
- 40 GB
- Processes
- 1024
- Image
- WarpMetal pinned
04 / sandbox.xlarge
xlarge
4 vCPU
- Memory
- 8 GB
- Workspace
- 80 GB
- Processes
- 2048
- Image
- WarpMetal pinned
Security model / least authority per agent
The owner stays root. Agents stay scoped.
Sandboxes protect the owner's agents from accidental cross-access and reduce blast radius. They are containers sharing one VPS kernel, not separate virtual machines and not a hostile multi-tenant boundary.
Audit the public supervisor source and signed releases and the fixed sandbox image source.
One key maps to one sandbox
A forced SSH gateway ignores requested host shells and maps a distinct agent public key to exactly one sandbox. The owner login key is rejected as an agent grant.
No token in agent access
The connection profile contains host, port, username, and pinned VPS host keys—not the owner token, management token, bootstrap secret, or private key.
Hardened containers
Rootless execution, cgroups v2 limits, dropped capabilities, no-new-privileges, a read-only base, separate workspace storage, and no inbound ports are the V1 defaults.
Revocation reaches sessions
Revoking a grant removes future login and terminates tracked active sessions. Deleting a sandbox revokes every grant before its workspace is removed.
Reconciled lifecycle / desired and observed state
Declare, install, grant, clean up.
HTTP 202 means accepted. The control plane and supervisor report separate desired and observed revisions so agents can poll for completion.
- 01
Enable
Add runtime intent during the order or on a ready server.
runtime enable - 02
Install
Verify and upload the signed supervisor over owner SSH.
runtime install - 03
Create + grant
Choose sizes, then assign each agent a distinct public key.
sandbox create - 04
Expire or delete
Cleanup runs locally even if the WarpMetal API is temporarily unreachable.
confirm DELETE
Security and lifecycle answers
Know where the boundary ends.
01Can outside customers share my VPS?+
No. V1 is owner-scoped: one buyer divides one VPS among that buyer's agents. It adds no tenants, reseller billing, or outsider access model.
02Can one agent enter another sandbox?+
Not through the supported access path. Each distinct key is forced into one sandbox, forwarding is disabled, and the agent receives no host shell. The VPS owner remains the trust root and can administer all sandboxes.
03What happens when temporary time runs out?+
The clock starts on first running and never pauses or resets. At expiry the local supervisor revokes access, terminates sessions, removes the container, and permanently deletes the workspace—even during a control-plane outage.
04Can I prevent an upcoming expiry?+
Before the sandbox reaches expiring, make it persistent. V1 does not extend a temporary duration; after expiring begins, deletion is final.