PandaStack

Open-source Firecracker microVM sandboxes for AI agents and code execution.

60-second quickstart

git clone https://github.com/pandastack-io/pandastack-ai
cd pandastack
bash scripts/mac-local-e2e.sh
open http://localhost:3000

Create a sandbox from the local API:

curl -sS http://localhost:8080/v1/sandboxes \
  -H 'Authorization: Bearer pds_local_dev_token' \
  -H 'Content-Type: application/json' \
  -d '{"template":"base","ttl_seconds":600}'

scripts/mac-local-e2e.sh seeds the base and postgres-16 templates. The full first-party catalog is base, code-interpreter, agent, claude-agent, browser, postgres-16, postgres-16-4g, and postgres-16-16g.

What it does

• Firecracker microVM sandboxes with strong process and kernel isolation.
• Snapshot anywhere and fork running environments instantly.
• Sub-second boot on every create via baked snapshot restore.
• Template-defined CPU, RAM, and disk quotas.
• Network egress controls for safer code execution.
• Template-based images: Docker images converted to ext4 roots.
• Pause, hibernate, and wake lifecycle controls.
• Exec, REPL, LSP, and browser terminal surfaces.
• Audit log and observability backed by Postgres and ClickHouse.
• Multi-region scheduling primitives for larger fleets.

Architecture

+---------+      +-----+      +-----------+      +------------------+      +----------------------+
|  SDKs   | ---> | API | ---> | Scheduler | ---> | Agents per host  | ---> | Firecracker microVMs |
+---------+      +-----+      +-----------+      +------------------+      +----------------------+
                      |              |                    |
                      v              v                    v
                Postgres/audit   Capacity scoring   Snapshot seeds + UFFD streaming

The API receives sandbox requests, the scheduler chooses a host, and an agent creates or resumes a Firecracker microVM. Every create restores a baked per-template snapshot (optionally streaming guest memory on demand), and the snapshot store persists state.

Use it from your code

import os
from pandastack import Client

client = Client(api_key=os.environ["PANDASTACK_API_KEY"])
sandbox = client.sandboxes.create(template="code-interpreter")

result = sandbox.exec("python -c 'print(\"hello\")'")
print(result.stdout, result.exit_code)

sandbox.kill()

import { Client } from "@pandastack/sdk";

const client = new Client({ apiKey: process.env.PANDASTACK_API_KEY });
const sandbox = await client.sandboxes.create({ template: "code-interpreter" });

const result = await sandbox.exec("node -e \"console.log('hello')\"");
console.log(result.stdout, result.exitCode);

await sandbox.kill();

pandastack sandbox create --template code-interpreter
pandastack sandbox exec <sandbox-id> -- "node -e \"console.log('hello')\""
pandastack sandbox delete <sandbox-id>

curl -X POST https://api.pandastack.ai/v1/sandboxes \
  -H "Authorization: Bearer $PANDASTACK_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"template": "code-interpreter"}'

curl -X POST https://api.pandastack.ai/v1/sandboxes/<sandbox-id>/exec \
  -H "Authorization: Bearer $PANDASTACK_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"cmd": "node -e \"console.log('\''hello'\'')\""}'

curl -X DELETE https://api.pandastack.ai/v1/sandboxes/<sandbox-id> \
  -H "Authorization: Bearer $PANDASTACK_API_KEY"

exec takes one command string, not a program plus an argument list. To point either SDK at a local install instead of https://api.pandastack.ai, pass apiUrl (TypeScript) or api_url (Python), or set PANDASTACK_API.

Next steps

• Start locally with the Apple Silicon guide.
• Review Supabase auth for self-hosting.
• Explore Terraform self-host examples.