Skip to main content
Zap’s sandbox contract (@wzrdtech/zap-sandbox) is one interface — SandboxProvider / SandboxHandle / SandboxSpec / ExecResult — over every execution provider. Box (ascii.dev) is the default; every other provider implements the same contract, and GPUs are opt-in lane plugins.

​
Providers

Box

Default VM sandbox

Namespace

NamespaceFirst-party VM

Self-host

Your own KVM microVMs

microsandbox

microsandboxLocal KVM microVMs

E2B

E2BFirecracker microVMs

Daytona

DaytonaContainer sandboxes

Cloudflare

CloudflareWorkers containers

Modal (GPU)

ModalGPU lane only

Docker

DockerLocal containers

​
Isolation classes

  • vm / microvm — hardware-virtualized guests (Box, E2B Firecracker microVMs, microsandbox KVM). Strongest boundary; the kernel is not shared.
  • container — namespaced Linux containers (Daytona, Cloudflare Sandbox, Modal, Docker). Shared host kernel; rely on the provider’s hardening.
  • process — a confined host process (local, lane confinement via systemd-run). Development and self-host only.
  • hyperlight-wasm — wasm micro-guests for the wasm lane.
  • none — catalog stubs; acquire() throws CATALOG_STUB before anything runs.

​
Provider tiers

  • first-party — implements the contract and runs the conformance suite (fake-backed in CI, live variant opt-in with the provider’s key).
  • catalog-stub — manifest + docs page + doctor row with verified: false; no execution path.

​
Capability matrix

​
Machine starts are the scarce resource

Box counts create, fork, and resume against plan ceilings. The runtime uses one stop_after sweeper, idle timeouts of 15–30 minutes, and treats 429 start_limit_reached as a first-class queued state.

​
GPU lanes

The modal adapter mounts only when Runtime.md declares a gpu:<class> lane or a media step declares gpu. Every acquire uses purpose: "lane" and is billed by the gpu_second SKU per class. GPUs never become the default substrate.