Firecracker sandboxes on the Kubernetes you already run.

Idle sandboxes save their memory and disk to S3, releasing VM memory. The next request restores their processes on a node with room.

Install guide Source on GitHub

Self-hosted, x86_64 with KVM only. No hosted service. loam-api runs as a single replica, so restarts interrupt the API and sandbox URLs. See isolation limits and E2B gaps.

# point the E2B SDK at your loam
pip install e2b
export E2B_DOMAIN=e2b.loam.example.com
export E2B_API_KEY=loam_...

from e2b import Sandbox

sbx = Sandbox.create()
print(sbx.commands.run("uname -a").stdout)
sbx.pause()     # snapshot to S3, VM off the node
sbx.connect()   # wake it, processes intact

Across the unmodified official Python and JS SDKs, 26 of 26 conformance steps pass for the supported surface. Template builds are unsupported. See E2B coverage.

Sleep and wake

A Postgres record tracks each sandbox. Long-lived nodelet pods run the VMs, so waking needs no new pod.

Scroll the diagram horizontally →

Wake prefers the node holding the snapshot, then any node with room. Architecture · Primer

Snapshot timings

Log scale begins at 28 ms. Each bar has its own test condition.

Scroll the chart horizontally →

Measured on x86 bare-metal k3s nodes with Garage as the store. Snapshot operations, not cold starts or percentiles. Lost-node wake restores saved paused or stopped state. Awake, unsaved work is lost. Test write-up

What the adapter serves

Supported

Create, get, kill, timeout, filtered list
Commands, files and streaming
Pause, resume and their automatic modes
Sandbox ports
Internet toggle and egress by name
One metrics sample and health

Not supported

Template builds
E2B snapshot and fork endpoints
Volumes
Sandbox logs and metrics history
CIDR and IP egress rules
secure:false, allowPublicTraffic:false

Checkpoints and forks are available through loam's native API. Full coverage and differences

Where sandboxes run

Project	Runtime	Deployment
Hosted E2B	Firecracker on E2B's machines	Hosted service
E2B self-hosted	Nomad and Consul	Terraform. GCP supported, AWS beta
scitix/agent-sandbox	Warm pod pools. MicroVMs planned	Kubernetes operator, E2B-compatible server
kubernetes-sigs/agent-sandbox	Kubernetes-native sandbox API	Alpha, no E2B API
loam	Firecracker in nodelets, snapshots while idle	Kubernetes, kustomize base and overlay

What a sandbox can reach

The nodelet enforces the boundary outside the guest. A sandbox with egress rules gets TCP over IPv4 only.

Scroll the diagram horizontally →

Brokered values stay out of guest memory, disk and snapshots. Secrets the application writes itself are outside that protection.

Sandboxes have OIDC identity. VMs share their unprivileged nodelet's cgroup and memory limit.

What you need

Kubernetes on x86_64 with KVMBare metal or nested virtualization
Linux 6.1 or newerFor /dev/userfaultfd
Device plugin/dev/kvm, /dev/net/tun, /dev/userfaultfd
XFS reflink directory on each nodeAn XFS image on ext4 works
Postgres
S3-compatible bucket
Wildcard DNS and TLSAPI, port and E2B domains

Follow the install guide with the kustomize base and example overlay.

git clone https://github.com/arugula-salad/loam
cp -r loam/deploy/examples/basic my-loam
# set your domain, store URL, ingress and secrets in my-loam
kubectl kustomize my-loam | less
kubectl apply -k my-loam

For single-machine development, the local recipe uses an in-memory database that disappears on exit.

What would help

Send install reports from Talos, kubeadm, Hetzner or OVH bare metal, or cloud instances with nested virtualization. Contributions toward per-VM cgroups and E2B gaps would help.

Network after a move

A moved sandbox lost networking for 30 seconds. Random bridge MACs left stale guest ARP entries. Every node's bridge now uses a fixed MAC.

Chrome through the proxy

Headless Chrome's ECH GREASE triggered the egress filter's ECH rejection. The proxy now judges the outer SNI name.

Start with CONTRIBUTING.md. Report vulnerabilities privately through SECURITY.md.