Sandbox overview

Updated at:

PAI-Sandbox is a secure execution infrastructure provided by Alibaba Cloud's Platform for AI (PAI). Built on hardware-virtualized lightweight MicroVM technology, PAI-Sandbox gives AI agents an isolated, on-demand, and programmable runtime environment for code execution, file operations, and browser automation, returning structured results to the calling application.

What is PAI-Sandbox

AI agents need to run code, read and write files, and control browsers. These operations can compromise the host system, leak data, or exhaust resources due to model hallucinations or prompt injection. Traditional containers share the host kernel, which expands the attack surface and cannot meet an agent's requirements for state persistence, millisecond-level start and stop, and fine-grained lifecycle management.

PAI-Sandbox uses lightweight MicroVM hardware-level virtualization to build a strictly isolated execution environment with three-layer protection: filesystem isolation, network egress control, and resource limits.

Key features

  • MicroVM hardware-level security isolation: Each sandbox runs on a lightweight VM with its own guest OS kernel. This provides VM-grade isolation and eliminates the container kernel-sharing escape risk. Sandboxes achieve millisecond-level cold starts and high resource utilization while maintaining this strong security boundary.

  • Enterprise-grade management console: A full-featured visual console supports three-tier resource management (space/template/instance), Web Terminal, VNC graphical desktop, online file management, HTTP endpoint debugging, and request log auditing.

  • E2B SDK compatible: PAI-Sandbox natively supports the E2B open-source SDK interface. Migrate existing agent applications by updating two environment variables: E2B_DOMAIN and E2B_API_KEY. No business code changes are needed. Official templates for Code Interpreter, Browser Use, Desktop GUI, and other common agent scenarios are available out of the box.

Use cases

PAI-Sandbox supports two core scenarios:

  • Agent scenarios: Single-sandbox, long-lived, stateful sessions. Require browser, desktop, and filesystem capabilities, plus security isolation and human-in-the-loop controls (pause/resume, credential injection). Typical examples include general-purpose task agents such as OpenClaw, coding agents, and deep research agents.

  • RL training and evaluation scenarios: Massive concurrency (hundreds to thousands of sandboxes), short lifecycles, and rapid environment forking. Typical examples include reinforcement learning training and agent benchmarking.

Resource hierarchy

PAI-Sandbox uses a three-tier resource structure: Space > Template > Sandbox. This structure separates heavyweight operations (space creation, billing setup) from lightweight operations (sandbox creation and management). After an administrator completes the one-time space setup, end users only need a token to create and use sandboxes on demand.

image

Tier

Description

Space

The billing and permission unit. Resource usage and costs for all templates and sandbox instances under a space are aggregated to that space. Each space has its own network configuration (VPC, vSwitch, and security group) and access credentials.

Template

A template defines a sandbox runtime environment. A space can contain multiple templates for different runtimes (for example, Python data analysis or Browser Use). Three template creation methods are available: from an image, from a saved sandbox, or from a public template.

Sandbox

A running instance created from a template with an independent lifecycle. Each instance has its own sandbox ID, access token, filesystem, access URL, and service ports.

Supported regions

Currently available region: China (Shanghai).

Billing

Billing overview

PAI-Sandbox charges for compute resources (CPU and memory) and system disks consumed by sandbox instances.

Billing is aggregated at the space level: costs from all templates and sandbox instances under a space are recorded under that space, making it straightforward to track spending by business unit or project.

PAI-Sandbox offers two resource types, each with a different billing model:

Resource type

Billing model

Description

Best for

Public resources

Pay-as-you-go

Billed per minute based on actual sandbox instance runtime. No upfront purchase required.

Sparse, bursty workloads with no operations overhead.

Dedicated resource group

Pay-as-you-go / Subscription

Pre-purchase "Sandbox Compute Resources" on the PAI general compute purchase page. Resources are exclusively reserved for your use. Dedicated resource groups support high-performance CPU specifications designed for sandboxes.

Sustained, large-scale workloads with resource stability or compliance requirements.

Important

All prices in this topic are for reference only. Actual prices are subject to the Alibaba Cloud purchase page and your billing statement.

Billing period

Resource type

Billing starts

Billing ends

Public resources

When the sandbox instance enters the Running state.

When the sandbox instance is destroyed.

Dedicated resource group (pay-as-you-go)

When the dedicated resource group machine is created and enters the Running state (billing continues even if no sandbox instances are created).

When the dedicated resource group machine is deleted.

Dedicated resource group (subscription)

00:00:00 on the day after the purchase.

The subscription expiration time.

Monitor when billing starts and stops. Destroy unused sandbox instances promptly to avoid unnecessary charges.

Billing by state

Sandbox instance billing depends on the instance lifecycle state:

State

Compute resources (CPU/memory)

System disk

Description

Running

Billed

Billed

Billed based on the instance specification multiplied by the actual runtime.

Paused

Billed at the same rate as Running

Billed

Sandbox state is preserved for resumption or template creation. Resources remain allocated, so billing continues at the same rate.

Destroyed

Not billed

Not billed

Resources are released and billing stops.

Important

Paused sandboxes are billed at the same rate as running sandboxes. Pausing preserves the sandbox state for resumption or template creation. To reduce costs, destroy sandbox instances that are no longer needed.

Unit prices

Billing item

Billing model

Formula

Unit price

Public resources

Pay-as-you-go

Bill amount = Number of instances x (Number of CPU cores x CPU hourly rate + Memory in GiB x Memory hourly rate + System disk capacity x System disk unit price) x Duration (minutes) / 60

For pricing details, see Public resource unit prices (reference). Billed per minute.

Dedicated resource group

Pay-as-you-go

Bill amount = Number of machines x (Machine hourly rate + System disk capacity x System disk hourly rate) x Duration (minutes) / 60

For pricing details, go to the EAS Dedicated Machine Pay-As-You-Go purchase page and ESSD PL1 cloud disk pricing page.

Subscription

Bill amount = Number of machines x (Machine monthly rate + System disk capacity x System disk monthly rate) x Subscription duration (months)

For pricing details, go to the EAS Dedicated Machine Subscription purchase page and ESSD PL1 cloud disk pricing page.

Pay-as-you-go billing is calculated at a per-minute granularity.

Public resource unit prices (reference):

Resource item

Unit price

CPU

0.194 (CNY/core/hour)

Memory

0.024 (CNY/GiB/hour)

System disk

Go to the ESSD PL1 cloud disk pricing page for details.

The prices above are indicative. Actual prices are based on the estimated cost shown at the bottom of the Create Sandbox Template page in the PAI console and the Alibaba Cloud pricing page.

Overdue payments and service suspension

If your Alibaba Cloud account has an overdue payment, PAI-Sandbox enters a service suspension process:

  • When payment becomes overdue: You cannot create new sandbox instances or templates. All sandbox instances are destroyed, but custom templates are retained.

Monitor your account balance to avoid data loss.

What's next