Sandbox overview
PAI-Sandbox is a secure execution infrastructure provided by Alibaba Cloud's Platform for AI (PAI). Built on hardware-virtualized lightweight MicroVM technology, PAI-Sandbox gives AI agents an isolated, on-demand, and programmable runtime environment for code execution, file operations, and browser automation, returning structured results to the calling application.
What is PAI-Sandbox
AI agents need to run code, read and write files, and control browsers. These operations can compromise the host system, leak data, or exhaust resources due to model hallucinations or prompt injection. Traditional containers share the host kernel, which expands the attack surface and cannot meet an agent's requirements for state persistence, millisecond-level start and stop, and fine-grained lifecycle management.
PAI-Sandbox uses lightweight MicroVM hardware-level virtualization to build a strictly isolated execution environment with three-layer protection: filesystem isolation, network egress control, and resource limits.
Key features
MicroVM hardware-level security isolation: Each sandbox runs on a lightweight VM with its own guest OS kernel. This provides VM-grade isolation and eliminates the container kernel-sharing escape risk. Sandboxes achieve millisecond-level cold starts and high resource utilization while maintaining this strong security boundary.
Enterprise-grade management console: A full-featured visual console supports three-tier resource management (space/template/instance), Web Terminal, VNC graphical desktop, online file management, HTTP endpoint debugging, and request log auditing.
E2B SDK compatible: PAI-Sandbox natively supports the E2B open-source SDK interface. Migrate existing agent applications by updating two environment variables:
E2B_DOMAINandE2B_API_KEY. No business code changes are needed. Official templates for Code Interpreter, Browser Use, Desktop GUI, and other common agent scenarios are available out of the box.
Use cases
PAI-Sandbox supports two core scenarios:
Agent scenarios: Single-sandbox, long-lived, stateful sessions. Require browser, desktop, and filesystem capabilities, plus security isolation and human-in-the-loop controls (pause/resume, credential injection). Typical examples include general-purpose task agents such as OpenClaw, coding agents, and deep research agents.
RL training and evaluation scenarios: Massive concurrency (hundreds to thousands of sandboxes), short lifecycles, and rapid environment forking. Typical examples include reinforcement learning training and agent benchmarking.
Resource hierarchy
PAI-Sandbox uses a three-tier resource structure: Space > Template > Sandbox. This structure separates heavyweight operations (space creation, billing setup) from lightweight operations (sandbox creation and management). After an administrator completes the one-time space setup, end users only need a token to create and use sandboxes on demand.
Tier | Description |
Space | The billing and permission unit. Resource usage and costs for all templates and sandbox instances under a space are aggregated to that space. Each space has its own network configuration (VPC, vSwitch, and security group) and access credentials. |
Template | A template defines a sandbox runtime environment. A space can contain multiple templates for different runtimes (for example, Python data analysis or Browser Use). Three template creation methods are available: from an image, from a saved sandbox, or from a public template. |
Sandbox | A running instance created from a template with an independent lifecycle. Each instance has its own sandbox ID, access token, filesystem, access URL, and service ports. |
Supported regions
Currently available region: China (Shanghai).
Billing
Billing overview
PAI-Sandbox charges for compute resources (CPU and memory) and system disks consumed by sandbox instances.
Billing is aggregated at the space level: costs from all templates and sandbox instances under a space are recorded under that space, making it straightforward to track spending by business unit or project.
PAI-Sandbox offers two resource types, each with a different billing model:
Resource type | Billing model | Description | Best for |
Public resources | Pay-as-you-go | Billed per minute based on actual sandbox instance runtime. No upfront purchase required. | Sparse, bursty workloads with no operations overhead. |
Dedicated resource group | Pay-as-you-go / Subscription | Pre-purchase "Sandbox Compute Resources" on the PAI general compute purchase page. Resources are exclusively reserved for your use. Dedicated resource groups support high-performance CPU specifications designed for sandboxes. | Sustained, large-scale workloads with resource stability or compliance requirements. |
All prices in this topic are for reference only. Actual prices are subject to the Alibaba Cloud purchase page and your billing statement.
Billing period
Resource type | Billing starts | Billing ends |
Public resources | When the sandbox instance enters the Running state. | When the sandbox instance is destroyed. |
Dedicated resource group (pay-as-you-go) | When the dedicated resource group machine is created and enters the Running state (billing continues even if no sandbox instances are created). | When the dedicated resource group machine is deleted. |
Dedicated resource group (subscription) | 00:00:00 on the day after the purchase. | The subscription expiration time. |
Monitor when billing starts and stops. Destroy unused sandbox instances promptly to avoid unnecessary charges.
Billing by state
Sandbox instance billing depends on the instance lifecycle state:
State | Compute resources (CPU/memory) | System disk | Description |
Running | Billed | Billed | Billed based on the instance specification multiplied by the actual runtime. |
Paused | Billed at the same rate as Running | Billed | Sandbox state is preserved for resumption or template creation. Resources remain allocated, so billing continues at the same rate. |
Destroyed | Not billed | Not billed | Resources are released and billing stops. |
Paused sandboxes are billed at the same rate as running sandboxes. Pausing preserves the sandbox state for resumption or template creation. To reduce costs, destroy sandbox instances that are no longer needed.
Unit prices
Billing item | Billing model | Formula | Unit price |
Public resources | Pay-as-you-go | Bill amount = Number of instances x (Number of CPU cores x CPU hourly rate + Memory in GiB x Memory hourly rate + System disk capacity x System disk unit price) x Duration (minutes) / 60 | For pricing details, see Public resource unit prices (reference). Billed per minute. |
Dedicated resource group | Pay-as-you-go | Bill amount = Number of machines x (Machine hourly rate + System disk capacity x System disk hourly rate) x Duration (minutes) / 60 | For pricing details, go to the EAS Dedicated Machine Pay-As-You-Go purchase page and ESSD PL1 cloud disk pricing page. |
Subscription | Bill amount = Number of machines x (Machine monthly rate + System disk capacity x System disk monthly rate) x Subscription duration (months) | For pricing details, go to the EAS Dedicated Machine Subscription purchase page and ESSD PL1 cloud disk pricing page. |
Pay-as-you-go billing is calculated at a per-minute granularity.
Public resource unit prices (reference):
Resource item | Unit price |
CPU | 0.194 (CNY/core/hour) |
Memory | 0.024 (CNY/GiB/hour) |
System disk | Go to the ESSD PL1 cloud disk pricing page for details. |
The prices above are indicative. Actual prices are based on the estimated cost shown at the bottom of the Create Sandbox Template page in the PAI console and the Alibaba Cloud pricing page.
Overdue payments and service suspension
If your Alibaba Cloud account has an overdue payment, PAI-Sandbox enters a service suspension process:
When payment becomes overdue: You cannot create new sandbox instances or templates. All sandbox instances are destroyed, but custom templates are retained.
Monitor your account balance to avoid data loss.
What's next
Build and verify your first sandbox instance: Quick start
Create a sandbox space and template: Manage sandbox spaces and templates
Create and use sandbox instances: Manage sandbox instances