Perplexity Opens SPACE, Its Internal Sandbox for Running AI Agent Code
Perplexity open-sourced SPACE, a Rust-based platform that runs untrusted agent code inside Firecracker microVMs with an E2B-compatible HTTP API.
- Perplexity open-sourced SPACE, its internal Firecracker-based sandbox platform for running agent code, under Apache 2.0.
- Five-concept model: Template, Sandbox, Process, Command session, Operation, with decoupled lifetimes.
- Control plane writes desired state to PostgreSQL; data plane streams output over SSE with scoped attachment tokens.
- Warm pools and base snapshots cut cold starts; btrfs copy-on-write makes sandbox clones cheap.
- Default six-hour idle auto-suspends sandboxes to full snapshot, with Wake to restore state.
- Ships an E2B compatibility wrapper so existing E2B Python SDK apps can migrate.
Perplexity has published SPACE, the sandbox platform it uses internally to run agent-generated code. Short for Sandboxed Platform for Agentic Code Execution, the Apache 2.0-licensed Rust project creates isolated Linux environments in Firecracker microVMs and exposes them through HTTP and server-sent events.
SPACE gives applications a self-hosted place to execute code they do not fully trust. Firecracker uses Linux KVM to create lightweight virtual machines with a hardware-backed isolation boundary. Applications choose what to run and retain, while SPACE manages virtual machines, processes, filesystems, networking, and streamed output. This makes it relevant to teams evaluating hosted sandbox services such as E2B, Modal, or Daytona.
Five resources, independent lifetimes
| Resource | Purpose |
|---|---|
| Template | Defines the starting filesystem and runtime configuration shared by many sandboxes. Clients reference one by a tag such as seed:latest or by content digest. |
| Sandbox | Provides an isolated microVM with its own writable filesystem and lifecycle. |
| Process | Represents a program running inside a sandbox. Processes in one sandbox share its environment and filesystem. |
| Command session | Holds connection details and authorization for one command. Creating a session assigns a process ID, while attaching starts the process. |
| Operation | Tracks an asynchronous create, pause, suspend, wake, or delete request. |
A sandbox, its lifecycle operation, and its command stream expire independently. The sandbox can survive both the request that created it and a disconnected output stream, allowing clients to reconnect during long-running agent sessions.
This story is for Pro members
You've reached the end of the free preview. Upgrade to AlphaSignal Pro to read the full article - and everything else behind the paywall.
Comments
