Hardware-isolated sandboxes
for AI agents.

One Cloud Hypervisor microVM per sandbox. Drop-in for the E2B and Daytona SDKs. Apache 2.0, self-hostable.

spawn.tsTypeScript

import { Platinum } from "@platinum/sdk";

const dn  = new Platinum({ token: process.env.PT_TOKEN });
const sbx = await dn.sandboxes.create({
  template: "pt-base",
  type:     "ephemeral",
});

await sbx.exec(["uname", "-a"]);

E2B_API_URL + E2B_API_KEY work too — E2B SDKs are unchanged.

Why Platinum

▸ Real isolation

One Cloud Hypervisor microVM per sandbox. KVM is the boundary — kernel CVE blast radius stops at the VM. Not gVisor. Not Firecracker-in-a-container. Not a chroot.

▸ vsock-only guest

The in-VM agent listens on AF_VSOCK only. A compromised sandbox can't reach its neighbour's /exec — no TCP, no shared L2.

▸ No kernel mods

Stock distro kernel. No DKMS, no out-of-tree drivers, no signed-module dance. You can boot the host with Secure Boot on.

▸ Cross-host by default

Pause in PAR1, resume in PAR2. Archive offloads to S3-compatible storage; the scheduler re-picks a host on resume. Continuous backup with a 4 ms pause window.

▸ API parity

Drop-in for E2B and Daytona SDKs. We accept E2B's templateID body shape, expose /pause, /resume, /files/watch, etc.

▸ Agent-native

MCP server, llms.txt, OpenAPI 3.1, agent skill (npx skills add). Drops into Claude Code, Cursor, Windsurf in one line.

▸ virtio-fs share

Every sandbox gets a host↔guest share at /mnt/dnah-share. Bulk file transfer goes through the host page cache, not framed JSON. Works while the sandbox is paused.

▸ Signed snapshots

Ed25519 signature over (sandbox_id, snapshot_id, manifest_hash, size, ts). Restore rejects unsigned or tampered images. Key rotation via kid.

▸ Add hosts from dashboard

Mint a one-time bootstrap token, run curl /install.sh | sudo bash on a fresh Ubuntu box. Host self-registers in ~5 s. No Ansible.

Lifecycle

Two presets over the underlying auto_stop_minutes / auto_archive_days / auto_delete_days columns. Pick type at create; explicit values always win.

type	auto-stop	auto-archive	auto-delete	Use for
`persistent` (default)	0	0	0	Long-lived dev workspaces — never auto-anything.
`ephemeral`	15 min idle	7 d stopped	30 d archived	Agent runs, CI jobs, throwaway compute (Daytona defaults).

Activity = any route that touches the guest (/exec, /run-code, /files, /sessions, /git, /metrics, /terminal, /snapshot, /share). Detail reads and listings don't count.

Performance

Path	What's happening	P50	P95
Warm allocation	Pool claim — Postgres row flip, no spawn	14 ms	24 ms
Cold spawn	Reflink rootfs · TAP · CH boot · vsock RPC up	98 ms	313 ms
First exec (warm)	create → exec returning exit 0	22 ms	39 ms
/exec roundtrip	Framed-JSON RPC over vsock	4 ms	5 ms
Resume from stop-snap	Memory + disk restore, identity preserved	309 ms	—
Restore signed snapshot	Ed25519 verify · CH `--restore` · resume	1.0 s	—
Fork	Snapshot + clone in one call	66 ms	—
Sequential throughput	100× create+delete, pool refills	26.3 /s	—

Architecture

The neighbour-VM blast radius stops at KVM. The host-agent never opens a TCP socket to the in-VM agent — control RPC crosses on AF_VSOCK, bulk files cross on virtio-fs, disks on virtio-blk, network on virtio-net. Each plane is independently auditable.