When an AI agent can run arbitrary commands, install packages, and start servers, where it runs matters as much as what it does. We give every project its own virtual machine — a real, isolated environment with its own filesystem and network boundary — rather than sharing a container or running things in your browser.
Isolation by default
A runaway script, a risky command, or a dependency that misbehaves in one project can't reach another. Mutable state is scoped to the project that owns it. There's no shared blast radius, because there's nothing shared to begin with.
Fast to start, cheap to keep
A dedicated machine per project sounds expensive, so we spent real effort on cold-start latency: boot fixes that skip a doomed network lease, a read-only base image shared across projects, and an optional pre-booted snapshot that makes new projects start in well under a second. Idle workspaces pause and resume exactly where you left off.
- Own filesystem — your code and dependencies stay walled off.
- Own network boundary — nothing leaks between projects.
- Pause when idle, resume in place — no lost state, no wasted compute.
The trust foundation
Real isolation is what makes everything else safe to offer. Letting an agent run commands freely is only reasonable when those commands live inside a boundary that can't touch your other work, your secrets, or anyone else's project. The private VM is the floor the rest of the product stands on.