OVRIN
View docs Start building
Platform Agents Security Docs Start building →
Agent compute cloud

Everything an agent
needs to run.

Secure compute, browsers, agent environments, memory and real-world capabilities — through one API.

$ pip install ovrin
OVRIN / SANDBOX 8F31 {{ statusLabel }}
import ovrin

client = ovrin.Client()

sandbox = client.sandboxes.create(
template="codex",
env={"OPENAI_API_KEY": key},
)

result = sandbox.run(
'codex "Find and fix the failing test"'
)

print(result.stdout)
import { Ovrin } from "ovrin"

const client = new Ovrin()

const sandbox = await client.sandboxes.create({
template: "codex",
env: { OPENAI_API_KEY: key },
})

const result = await sandbox.run(
`codex "Find and fix the failing test"`
)

console.log(result.stdout)
curl -X POST https://api.ovrin.dev/sandboxes \
-H "Authorization: Bearer $OVRIN_API_KEY" \
-H "Content-Type: application/json" \
-d '{"template":"codex","timeout":3600}'

# => { "id": "sbx_8f31", "state": "running" }

curl -X POST .../sandboxes/sbx_8f31/run \
-d '{"command":"codex \"fix the test\""}'
{{ line.mark }} {{ line.text }} {{ line.ms }}
>{{ runningText }}▌
gVisor CPU MEM {{ elapsed }}
01
Compute
Isolated Linux in milliseconds. Python, Node, Ubuntu.
02
Browser
Chrome and Playwright with controlled network and files.
03
Agents
Claude Code, Codex, Gemini CLI, DeepSeek Harness.
04
Memory
Context that outlives the environment it ran in.
05
Payments
Scoped Stripe access, per-account restricted keys.
What is actually running no logo wall — the stack instead
Production runtime
k3s
gVisor
OpenSandbox
Agent environments
Claude Code
Codex
Gemini CLI
DeepSeek Harness
Capabilities
Python
Chrome
Node
Playwright
Memory
Payments
01 / Runtime

A real computer for every agent.

Not a code interpreter with extra steps. Every sandbox is a full Linux environment with a filesystem, a network stack, a process table and a shell — provisioned on demand, kept behind a kernel boundary, and destroyed when the task ends.

Milliseconds, not minutes
Create, run, kill. Three calls, no cluster to operate.
Kernel-level isolation by default
gVisor intercepts syscalls before they reach the host. Kata and Firecracker microVMs on the roadmap.
Disposable by design
Untrusted output stays inside the boundary. Nothing survives that you did not persist.
OVRIN / SANDBOX 8F31
RuntimegVisor
AgentCodex
MemoryAttached
BrowserReady
Egressdefault-deny
CPU1 vCPU
> running task…
02 / Agent environments

The coding agents, already installed.

Pick a template and the CLI is in the image, on the PATH, ready for a prompt. No Dockerfile, no npm install, no waiting for a base layer to warm up.

Four templates.
One lifecycle API.
TEMPLATE / {{ envSlug }} AUTH {{ envAuth }}
sandbox = client.sandboxes.create(
template="{{ envSlug }}",
env={"{{ envAuth }}": token},
)

sandbox.run({{ envCmd }})
{{ l.mark }}{{ l.text }}
03 / Browser and tools

A browser the agent can actually drive.

Chrome and Playwright run inside the same boundary as the code. The agent clicks, scrapes, uploads, downloads and reads its own screenshots back off the filesystem.

Chrome
Playwright
Filesystem
Terminal
VNC desktop
VS Code Web
https://app.example.com/invoices SESSION LIVE
GETapp.example.com/invoices200
POSTapi.stripe.com/v1/invoices200
DENYtelemetry.unknown.netegress policy
04 / Persistent memory

The environment can disappear. The context doesn't.

Sandboxes are meant to be thrown away. What the agent learned in one shouldn't be. Memory is a first-class endpoint on the control plane, not a database you have to run.

SANDBOX 8F31
read repo
fix failing test
SANDBOX A104
crawl invoices
reconcile totals
SANDBOX C77B
build docs site
deploy preview
Ovrin memory — persistent POST /memory · GET /memory/search · scoped per account
client.memory.add("prefers pytest over unittest")
hits = client.memory.search("test framework")
05 / One API

One key. One SDK. One bill.

Compute, browsers, agents, memory and payments sit behind the same client and the same account. Signup to first sandbox is minutes, and it stays self-service.

Full API reference →
PYTHON
import ovrin

client = ovrin.Client()

sbx = client.sandboxes.create(template="python")
sbx.files.write("/workspace/run.py", src)
out = sbx.run("python /workspace/run.py")
sbx.kill()
TYPESCRIPT
import { Ovrin } from "ovrin"

const client = new Ovrin()

const sbx = await client.sandboxes.create({ template: "node" })
await sbx.files.write("/workspace/run.js", src)
const out = await sbx.run("node /workspace/run.js")
await sbx.kill()
/sandboxes
create · list · run · files · kill
/secrets
write-only credential store
/memory
add · search · list · delete
/payments
customers · invoices · links
/keys
scoped, revocable API keys
/usage
metered compute and quotas
06 / Security architecture

Isolation is the product, not a setting.

Ovrin runs arbitrary, untrusted, model-generated code. Every layer assumes the code inside is hostile.

gVisor A userspace kernel intercepts syscalls before the host sees them.
Namespace Each account gets its own Kubernetes namespace, ResourceQuota and LimitRange.
Egress Default-deny per sandbox. Hosts are allowlisted, not discovered.
API keys Per-account, scoped, revocable. Sandbox calls are proxied with a short-lived signed token.
Boundaries, outermost first
HOST · k3s NODE
TENANT NAMESPACE · quota
gVisor SANDBOX · runsc
UNTRUSTED PROCESS
codex · playwright
model-generated code
syscalls intercepted4 boundaries
07 / Architecture

One API in front of the whole machine room.

YOUR AGENT
OVRIN API · ONE KEY
COMPUTE
Python · Node · Ubuntu
BROWSER
Chrome · Playwright
AGENTS
Claude Code · Codex · Gemini
MEMORY / STATE
CAPABILITIES · SECRETS · PAYMENTS
ISOLATED RUNTIME
k3s · gVisor · OpenSandbox · default-deny egress

Create an API key.
Ship an agent today.

Self-service from the first minute. No demo call, no sales gate, no waitlist.

$ pip install ovrin