> ## Documentation Index
> Fetch the complete documentation index at: https://docs.zap.wzrd.tech/llms.txt
> Use this file to discover all available pages before exploring further.

# Box-first sandboxes and isolation

> One sandbox contract over every execution provider. Box is the default; everything else mounts behind the same interface.

Zap's sandbox contract (`@wzrdtech/zap-sandbox`) is one interface — `SandboxProvider` / `SandboxHandle` / `SandboxSpec` / `ExecResult` — over every execution provider. Box (ascii.dev) is the default; every other provider implements the same contract, and GPUs are opt-in lane plugins.

## Providers

<CardGroup cols={3}>
  <Card title="Box" icon="box" href="/sandboxes/box" horizontal>
    Default VM sandbox
  </Card>

  <Card title="Namespace" href="/sandboxes/namespace" horizontal>
    <img src="https://mintcdn.com/gratitude5dee-zap-56/Y4G9H4edehsua_Ul/images/logos/namespace.svg?fit=max&auto=format&n=Y4G9H4edehsua_Ul&q=85&s=cf23f95bc5cbd354314d8081bfd7fcb9" alt="Namespace" style={{ height: "24px", width: "auto" }} noZoom width="160" height="160" data-path="images/logos/namespace.svg" />

    First-party VM
  </Card>

  <Card title="Self-host" icon="server" href="/sandboxes/selfhost" horizontal>
    Your own KVM microVMs
  </Card>

  <Card title="microsandbox" href="/sandboxes/microsandbox" horizontal>
    <img src="https://mintcdn.com/gratitude5dee-zap-56/Y4G9H4edehsua_Ul/images/logos/microsandbox.png?fit=max&auto=format&n=Y4G9H4edehsua_Ul&q=85&s=43fcfe3f568d2dfbeb5e06963ccd0ff2" alt="microsandbox" style={{ height: "24px", width: "auto" }} noZoom width="128" height="128" data-path="images/logos/microsandbox.png" />

    Local KVM microVMs
  </Card>

  <Card title="E2B" href="/sandboxes/e2b" horizontal>
    <img src="https://mintcdn.com/gratitude5dee-zap-56/Y4G9H4edehsua_Ul/images/logos/e2b.png?fit=max&auto=format&n=Y4G9H4edehsua_Ul&q=85&s=6d608c0fc4b0e2beaf951eabc8df7cac" alt="E2B" style={{ height: "24px", width: "auto" }} noZoom width="128" height="128" data-path="images/logos/e2b.png" />

    Firecracker microVMs
  </Card>

  <Card title="Daytona" href="/sandboxes/daytona" horizontal>
    <img src="https://mintcdn.com/gratitude5dee-zap-56/Y4G9H4edehsua_Ul/images/logos/daytona.png?fit=max&auto=format&n=Y4G9H4edehsua_Ul&q=85&s=5295f02aad34d160325994188b85ff06" alt="Daytona" style={{ height: "24px", width: "auto" }} noZoom width="128" height="128" data-path="images/logos/daytona.png" />

    Container sandboxes
  </Card>

  <Card title="Cloudflare" href="/sandboxes/cloudflare" horizontal>
    <img src="https://mintcdn.com/gratitude5dee-zap-56/Y4G9H4edehsua_Ul/images/logos/cloudflare.svg?fit=max&auto=format&n=Y4G9H4edehsua_Ul&q=85&s=df6ca0cda30c00428bf645b2de4ddbe4" alt="Cloudflare" style={{ height: "24px", width: "auto" }} noZoom width="256" height="116" data-path="images/logos/cloudflare.svg" />

    Workers containers
  </Card>

  <Card title="Modal (GPU)" href="/sandboxes/modal" horizontal>
    <img src="https://mintcdn.com/gratitude5dee-zap-56/Y4G9H4edehsua_Ul/images/logos/modal.svg?fit=max&auto=format&n=Y4G9H4edehsua_Ul&q=85&s=ea190d51d931d3e2e6365a2d62df0cdc" alt="Modal" style={{ height: "24px", width: "auto" }} noZoom width="24" height="24" data-path="images/logos/modal.svg" />

    GPU lane only
  </Card>

  <Card title="Docker" href="/sandboxes/docker" horizontal>
    <img src="https://mintcdn.com/gratitude5dee-zap-56/Y4G9H4edehsua_Ul/images/logos/docker.svg?fit=max&auto=format&n=Y4G9H4edehsua_Ul&q=85&s=69a270ae4c2259b6657d5df94acbec07" alt="Docker" style={{ height: "24px", width: "auto" }} noZoom width="24" height="24" data-path="images/logos/docker.svg" />

    Local containers
  </Card>
</CardGroup>

## Isolation classes

* **vm / microvm** — hardware-virtualized guests (Box, E2B Firecracker microVMs, microsandbox KVM). Strongest boundary; the kernel is not shared.
* **container** — namespaced Linux containers (Daytona, Cloudflare Sandbox, Modal, Docker). Shared host kernel; rely on the provider's hardening.
* **process** — a confined host process (`local`, lane confinement via systemd-run). Development and self-host only.
* **hyperlight-wasm** — wasm micro-guests for the `wasm` lane.
* **none** — catalog stubs; `acquire()` throws `CATALOG_STUB` before anything runs.

## Provider tiers

* **first-party** — implements the contract and runs the conformance suite (fake-backed in CI, live variant opt-in with the provider's key).
* **catalog-stub** — manifest + docs page + `doctor` row with `verified: false`; no execution path.

## Capability matrix

| provider                                  | tier         | isolation | snapshot | fork | stop/resume | ports | private ports | gpu | docker |
| ----------------------------------------- | ------------ | --------- | -------- | ---- | ----------- | ----- | ------------- | --- | ------ |
| [box](/sandboxes/box)                     | first-party  | vm        | yes      | yes  | yes/yes     | yes   | yes           | no  | yes    |
| [namespace](/sandboxes/namespace)         | first-party  | vm        | no       | no   | yes/yes     | yes   | no            | no  | yes    |
| [selfhost](/sandboxes/selfhost)           | first-party  | microvm   | yes      | no   | no/no       | no    | no            | no  | no     |
| [microsandbox](/sandboxes/microsandbox)   | first-party  | microvm   | yes      | no   | yes/no      | no    | no            | no  | no     |
| [e2b](/sandboxes/e2b)                     | first-party  | microvm   | yes      | no   | yes/yes     | yes   | no            | no  | no     |
| [daytona](/sandboxes/daytona)             | first-party  | container | yes      | no   | yes/yes     | yes   | yes           | no  | no     |
| [cloudflare](/sandboxes/cloudflare)       | first-party  | container | yes      | no   | no/no       | yes   | no            | no  | no     |
| [modal (gpu lane)](/sandboxes/modal)      | first-party  | container | no       | no   | no/no       | no    | no            | yes | no     |
| [docker](/sandboxes/docker)               | first-party  | container | no       | no   | yes/yes     | no    | no            | no  | yes    |
| [catalog stubs](/sandboxes/catalog-stubs) | catalog-stub | none      | no       | no   | no/no       | no    | no            | —   | no     |

## Machine starts are the scarce resource

Box counts create, fork, *and resume* against plan ceilings. The runtime uses one `stop_after` sweeper, idle timeouts of 15–30 minutes, and treats `429 start_limit_reached` as a first-class queued state.

## GPU lanes

The `modal` adapter mounts only when `Runtime.md` declares a `gpu:<class>` lane or a media step declares `gpu`. Every acquire uses `purpose: "lane"` and is billed by the `gpu_second` SKU per class. GPUs never become the default substrate.