Scalable Sandbox and Orchestration Infrastructure for Agents at tensorlake.ai
San Francisco, CA
- Tweets 449
- Following 67
- Followers 1,540
- Likes 371
Tensorlake retweeted
We are ahead of the market here with TLFS. In the long term state of agents in a versioned file system which can be attached to compute on demand feels inevitable.
TLFS has a lot of traction and getting love from users who are trying it out and figuring out what they could do with a file system that can be distributed between sandboxes, local machines and also versioned.
1
1
12
1,352
Coding agents need their own Git workspaces, not just sandboxes.
@sebuzdugan tested Tensorlake Git:
- fork a repository in ~160 ms,
- catch broken changes before merging,
- roll back a bad refactor in ~1 second. No running sandbox needed
A hands-on look at Git built for agents 👇
your agent made a mistake.
the file changed.
the database changed.
the tool already ran.
git can't help.
forking the whole environment can.
here's why the "undo button" for agents isn't actually a fork ↓
1
367
@tensorlake sandboxes now support streaming in Harbor 🎉
Just add:
`-e tensorlake --stream`
Check out @harborframework 's latest docs:
docs.harborframework.com/cor…
pr merged. congrats to @tensorlake on adding streaming support in harbor.
streaming now supports 4 providers: @daytonaio, @modal, @tensorlake and @Docker. If you want to merge yours, comment or DM me.
2
324
Tensorlake retweeted
This is why Tensorlake sandboxes are nothing but VMs, containers are not even an option you can chose on our platform.
We escaped Docker's hypervisor with three lines of bash. CVE-2026-77179: A container gets complete read and write access to the host filesystem.
When you mount a folder into a container, Docker's VMM uses virtio-fs, and the file server runs on the host.
Because of a TOCTOU bug, if a container opens a file, deletes it while holding its file handle open, and replaces the parent folder with a symlink, the kernel will follow the symlink to anywhere on the host.
Full technical breakdown:
accomplish.ai/blog/escaping-…
Community note
This affects Docker Sandboxes on macOS and Docker Desktop only if the new Docker VMM (beta, not default) is enabled; it is a virtio-fs shared workspace symlink/TOCTOU issue, not a general container or hypervisor escape.
docs.docker.com/security/secur…
cve.org/CVERecord?id=C…
docs.docker.com/ai/sandboxes/r…
4
2
19
2,474
Tensorlake retweeted
FoundationDB is now powering all the major services in @tensorlake.
1. Our new sandbox orchestrator uses FoundationDB for storing the WAL for the cluster scheduler, route tables of sandboxes, watches for replicas which replays the WAL to in-memory indexes for fast responses to API calls.
2. Durable functions (which hasn't been released) uses FDB for storing the current execution graph of a request.
3. Versioned File System and SCM infra uses it for storing metadata of file systems and git repositories.
We use the K8s operator, and it's been working pretty well.
10
11
148
9,523
Tensorlake retweeted
Other than the sandboxes, every @tensorlake service now runs on ARM servers on GCP and AWS.
We really want to launch ARM sandboxes too, waiting on someone to ask us for them!
6
1
14
1,986
Love seeing Tensorlake benchmarked in the wild. The numbers speak for themselves 🔥 Thanks, @Offloop, for putting this together!
Just ran some benchmarks on @Offloop's sandbox providers and @tensorlake is crushing it.
Absolutely love what @diptanu and his team is doing!
1
4
665
Tensorlake retweeted
Just ran some benchmarks on @Offloop's sandbox providers and @tensorlake is crushing it.
Absolutely love what @diptanu and his team is doing!
1
1
9
2,966
Tensorlake retweeted
Got streaming working with @tensorlake sandboxes on Harbor too. So you can see the agent's trajectory and files while it runs. PR is on the way.
One of the first features we built into Terminal-Bench (long before Harbor existed) was --livestream to watch the tmux session.
Glad to see @kobe0938 cooking up the better, more generalized version for Harbor :)
1
1
13
3,893
How does traffic actually get from a public URL into an AI sandbox?
A new deep dive from @aiwithme0001 compares Tensorlake, E2B, Daytona, and Fly.io, including why Tensorlake moved part of its dataplane from L7 to L4.
Full comparison 👇
The full breakdown covers the mechanisms, trade-offs, and 4 questions to ask about any sandbox ingress hop.
Save or read on @towards_ai:
yadavdivy296.medium.com/ai-s…
1
1
3
426
In the latest @harborframework release, dynamic network policies now work with Tensorlake sandboxes.
Harbor lets an eval change network access across different phases of a trial:
setup → public network
agent → allowlist
verifier → no network
We updated the Tensorlake Harbor implementation to support this directly, so the same sandbox can move through each phase with a different network boundary without restarting or losing state.
More on how it works 👇
1
1
4
280
We now support running @cursor_ai Cloud Agents on Tensorlake sandboxes.
Check out the docs to get set up. docs.tensorlake.ai/sandboxes…
You can now run Cursor cloud agents on your infrastructure, including pools of machines that automatically scale with demand.
This lets you give agents access to internal services or specialized hardware, while the agent loop stays in Cursor.
2
385
Tensorlake retweeted
The full breakdown covers the mechanisms, trade-offs, and 4 questions to ask about any sandbox ingress hop.
Save or read on @towards_ai:
yadavdivy296.medium.com/ai-s…
4
4
675
Tensorlake retweeted
Every AI sandbox has the same Day 1 problem: getting untrusted traffic into an isolated container.
How 4 platforms document their ingress:
• E2B
• Daytona
• Flyio
• @Tensorlake
4 completely different architectures between L7 and L4 routing.
2
3
3
104
Tensorlake retweeted
We’re building a cluster autoscaler for the second time at @tensorlake.
Previously, we scaled up nodes when there were pending sandboxes, and scaled them down when there were no more sandboxes running on them.
But our users run long-horizon tasks on these sandboxes, so we could never really scale down machines, there were always a couple of sandboxes still running. The scheduler is designed to avoid tight bin packing to prevent hot spots.
So we turned off autoscaling and started running clusters with fixed capacity.
As we scale up RL use cases on our platform, the workload looks very different from steady-state background agents. During rollouts, users want to scale from 0 to 100k–1M sandboxes, and then scale back down.
Now we have an opportunity to bring up nodes when we need them, and schedule in a way that increases density by placing more sandboxes from the same user on each node. Capacity gets released around the same time, and we can stop the machines.
This is what our new autoscaler will do, and we will also be able to offer better pricing models to Neolabs running on Tensorlake.
4
2
33
1,987
@cursor_ai Cloud Agents now run on @tensorlake sandboxes.
Start 1 worker or fan out many. Each gets its own fast, isolated sandbox.
Enterprise teams can also run Tensorlake in their own VPC, so agents can reach private repos, APIs & internal services.
1
1
4
327
Check out the guide to get started!
docs.tensorlake.ai/sandboxes…
1
48
