Secure sandboxing for Kubernetes.
Run untrusted and AI‑generated code in gVisor‑isolated sandboxes, on the cluster you already have.
A powerful platform to build on.
-
gVisor isolation
A user-space kernel. Runs on any VM, no KVM or bare metal required.
-
Any OCI image
Use your existing images and Dockerfiles.
-
Rootfs snapshots
Set an environment up once, restore it in new sandboxes on any node.
-
Isolated networking
Deny-all by default, with flexible egress rules and rate limiting.
-
Kubernetes-native
Runs inside your perimeter, under the RBAC and tooling you already have.
-
Multi-container sandboxes
Sandbox your app together with its sidecars and MCP servers.
Start in seconds.
Commands, files, and output streams over a REST API, with SDKs for Python and TypeScript.
from isola import Isola
with Isola() as client:
sandbox = client.sandboxes.create(image="python:3.12-slim")
result = sandbox.commands.run("python3", "-c", "print('ciao')")
print(result.stdout)
sandbox.delete()import { Isola } from "@isola-run/sdk";
const client = new Isola();
const sandbox = await client.sandboxes.create({ image: "python:3.12-slim" });
const result = await sandbox.commands.run(["python3", "-c", "print('ciao')"]);
console.log(result.stdout);
await sandbox.delete();
ciao
pip install isola-run
npm install @isola-run/sdk