Behavior & Limits

Claims here were verified against a real account unless the text says otherwise at the point it matters.

Guarantees

No inherited identity. A sandbox never holds your workload's identity. There is no mounted token, no metadata credential, and no ambient principal. Credentials it legitimately needs are brokered short-lived after start, never written to env or disk at create time.

No implicit access to your stack. A sandbox reaches no other resource in your deployment unless you hand it something explicitly.

No inbound exposure. A sandbox is never reachable from the internet except through an authenticated, port-scoped preview capability, on the platforms that offer one.

Contents stay out of the control plane. Heartbeats carry session counts and lifecycle states only. On AWS the image's own provider logging is disabled outright.

Capabilities are published, not assumed. Each platform declares what it supports, and calling an unsupported operation returns a typed error naming both the platform and the capability — never a silent no-op, never a null-ish success. See API Reference for the full set.

A declaration is accepted or refused, never half-applied. A ceiling a platform cannot enforce, an egress mode it cannot express, or a session deadline it has no primitive for is rejected when you deploy rather than ignored at runtime.

deny egress is constructed, not inherited. Where a cloud's default is the open internet, Alien builds the deny rather than trusting the default.

Limits

Which operations exist at all is a separate question from how far they go — see the capability table in the Overview. The short version: no platform has snapshot or a hostname allowlist, Azure's binding implements no file transfer, and GCP cannot reconnect.

Platform Notes

AWS

Lambda MicroVMs, isolated at the VM level by Firecracker. GA.

• deny requires a network. The cloud default is the open internet — CreateMicrovmImage fills in an INTERNET_EGRESS connector when you name none — so Alien builds a VPC egress connector whose security group permits nothing outbound. A stack declaring deny without a network is refused, because the connector is what makes the deny real.
• Measured against a live account: one MicroVM with that connector failed to reach a public address within the probe's 8-second budget; an otherwise identical one without it returned 200.
• allow emits no connector at all and needs no network.
• Session deadline comes from maximumDurationInSeconds, which the service caps at 8 hours.
• Suspend and resume are available; auto-resume is off, so a stray request cannot bring a session back after the caller has moved on.

GCP

Cloud Run sandboxes. Public preview. Choose GCP for cost, not capability.

Google does not publish the isolation mechanism for the sandbox itself, so this page does not name one. What is documented: a sandbox requires a second-generation execution environment, and it isolates process execution from the rest of your container.

• No reconnection. A sandbox id is scoped to one Cloud Run instance. Turn N+1 reaches turn N's sandbox only if the request lands on the same instance. Measured over 100 conversations of 5 turns under real scale-out: sessionAffinity = false kept 0 of 100; sessionAffinity = true kept 2 of 100. A control pinned to one instance kept 4 of 4, so the measurement is sound. GCP sandboxes are single-turn.
• No enforced ceilings. Sandboxes share the hosting service's CPU and memory budget, so size that service for your app and its concurrent sandboxes. A Sandbox declaring limits on GCP is rejected at plan time.
• No private-range denies when egress is allowed. Kubernetes blocks RFC1918 and link-local in both modes; Azure emits no egress configuration at all, and Local's allow is a plain bridge. A Cloud Run sandbox has no network identity to attach policy to.
• Two things GCP gives you that no other cloud does, both verified from inside: the metadata server is unreachable, and the hosting service's environment variables are invisible.
• A Sandbox on GCP needs a Worker to host it. A Container does not satisfy this — the check names Workers specifically — so a stack with a Sandbox and no Worker fails at plan time.

Azure

Container Apps Sandboxes, isolated at the VM level by Hyper-V. Public preview.

• No file transfer. Alien's Azure binding does not implement it, so readFile, writeFiles and mkdir are refused. Pass what the session needs on the command line.
• Your declared image is not used. The binding starts every session from a stock ubuntu disk whatever .code(...) says. No capability covers this, so the table cannot warn you: if your sandbox needs your own tooling, Azure cannot carry it today. This is the one Azure gap that fails silently rather than with a typed error.
• No enforced ceilings and no enforced deny. Alien emits no egress configuration here, so a declared deny is refused rather than accepted and dropped.
• Azure the cloud has a per-port URL closed to anonymous traffic, a 0.54s resume, a full-VM snapshot and a hostname egress proxy. None of them are wired through the binding today, so each capability reads false.
• The preview carries an explicit warning that sandboxes created now might not be compatible with future releases and might need recreating. Weigh that before committing production traffic.

Kubernetes / On-Prem

A pod under a sandboxed runtimeClassName — gVisor or Kata.

• A sandboxed runtime class is required, not preferred. The controller inspects the cluster before creating anything and refuses if none is declared, or if the declared one uses an ordinary container runtime. That check has to happen up front: on Autopilot an unschedulable sandbox pod is not rejected — node auto-provisioning picks it up and the pod sits in Pending while nodes are created and billed.
• gVisor is a kernel boundary, not a network boundary. The GCE metadata server answered from inside a gVisor pod on GKE, so Alien denies link-local in both egress modes here rather than assuming the runtime handles it.
• deny is only as strong as your CNI. Kubernetes accepts a NetworkPolicy on any cluster and silently ignores it where no controller implements one. Measured both ways with the same chart: on a cluster with no NetworkPolicy controller the pod reached the public internet; on GKE Autopilot with Dataplane V2 it could not resolve a hostname. Supply a NetworkPolicy-enforcing CNI along with the cluster.
• Where the CNI does enforce it, deny also closes DNS, which AWS's cannot.
• Session deadline comes from activeDeadlineSeconds.

Local

Docker, on a shared kernel. Development only for untrusted code.

• Hardening narrows the attack surface — the sandbox runs unprivileged, with all capabilities dropped, a read-only root filesystem and enforced pid, memory and cpu ceilings — but container escape stays in scope for code you do not trust. Use gVisor or Kata if you need more.
• deny gives the session no network interface at all, which is a stronger and simpler guarantee than a private network with its gateway firewalled off.
• allow puts sessions on one bridge per sandbox with inter-container communication disabled, which blocks session-to-session traffic on stock Linux Docker. OrbStack accepts that setting and ignores it — verified with the Docker CLI, no Alien code involved. On macOS under OrbStack, two egress-allowed sessions can reach each other.
• The only platform with a process ceiling, via Docker's pid limit.

Startup

79 seconds per agent turn is unusable, so on Kubernetes Alien keeps a warm pool of idle pods — two by default — and hands one out per session. A create that finds the pool drained fails rather than falling back to a cold start.

Design Decisions

Sessions are the unit, not the resource. Every other Alien resource provisions one durable object at deploy time. A Sandbox declaration provisions a parent; the sessions your application uses are created and destroyed at runtime, per agent turn if you want.

The floor is create, exec and terminate. File transfer is not on it, because one backend does not implement it. Publishing that as a capability is what lets portable code branch instead of discovering the gap through an error.

Snapshot billing is not a snapshot feature. AWS bills for MicroVM snapshot storage and I/O — see Pricing — but those are the build-time image snapshot and suspend/resume state. snapshot() is unavailable on every platform.

A refused declaration beats a silently ignored one. A ceiling GCP cannot enforce would give you a sandbox that looks bounded and is not, so the declaration is rejected instead.

No hostname allowlist, even where the cloud has one. Azure runs a proxy that enforces one — measured, a permitted host returned 200 and another 403 — but Alien does not render that policy today. The capability reads false and allowDomains is refused, rather than working on one platform and silently doing nothing on the rest.