Spoond

A sandbox in three lines

Lease one over HTTP, run a command over SSH, hand it back. Or skip the API entirely: ssh new@sandbox.example.com creates a persistent dev sandbox and drops you into tmux.

# lease a sandbox for ten minutes
$ curl -s -X POST https://sandbox.example.com/api/leases \
    -H "Authorization: Bearer $TOKEN" \
    -d '{"image":"dev-base","size":"medium","ttl":600}'
# → {"id":"…","address":"10.11.0.7","expires_at":"…"}

$ ssh <id>@sandbox.example.com "uname -a"   # run something
$ ssh ctl@sandbox.example.com "rm <id>"    # release it

How it fits together

Spoond owns leases, identity and every way in. A patch-queue fork of E2B's orchestrator owns the microVMs.

Images are one Dockerfile per capability, built into E2B templates with spoond images build.

Watching it run

spoond dash is a read-only, live view of the host: capacity, host meters, throughput, every lease and what holds it, the images in order of use, the systemd units, all-time records and the newest lease events, with a notifications panel when something on the host needs a person. It counts the leases taken back for fair shares and shows how much snapshot disk is reserved and usable. A long image catalog folds into a link to its own live page. spoond top draws the same grid in a terminal, and on a private network the web dashboard can go without a login.

What you get

• New in 3.10

  Self-protection

  Spoond never lets the host run out of memory under its VMs. Every 15 seconds it checks free hugepages. Below the floor (MEMORY_FLOOR_MIB, 2 GiB by default) it first drops an idle warm-pool VM, then pauses one lease of the owner furthest over their fair share, passing over pinned and busy leases. Since 3.10 spoond resumes every lease it paused this way once there is room again, longest-paused first, so unattended work picks up on its own; a lease you paused yourself still waits for your next call. Admission keeps the floor free as well, and a host that still runs short answers a retryable 503.

• New in 3.8

  Lease history and records

  Every lease that ends leaves a row behind: owner, image, size, start and end, whether it was released or lost, its peak memory and how long it took to start. The dashboard turns that into all-time records: the busiest moment and day, the longest and shortest runs, the fastest start, the biggest fleet, the no-losses streak and lifetime lease-hours, with test owners left out. spoond history import fills in the past from the lease journal.

• New in 3.7

  Self-description

  GET /api/capabilities, or spoond capabilities, lists every route, image, size and network policy this host offers, and the ways in it has turned on, so a client or agent can find its way without the docs.

• Settings and secrets

  Every setting is checked against its type at startup, and one bad value stops the backend with a message naming every problem. Any secret can live in a 0600 file instead of the environment, read once at startup.

• Measured memory

  Every running lease reports the memory its VM uses now and its peak, and a size hint names the smallest size that holds the peak with 25% headroom, so a lease can come back smaller. A released lease records the peak it reached.

• Lease sizes

  A create picks its VM's size by preset or by vcpu and memory_mb. Sizes with a warm build start in milliseconds from a memory snapshot; any other size boots in about a second. A lease keeps its size through pause, clone, fork, restore and recovery, and is charged its memory for fair shares, never its vCPU.

  • small1 vCPU · 2 GiB
  • medium2 vCPU · 4 GiB
  • large4 vCPU · 8 GiB
  • xlarge8 vCPU · 16 GiB

• Your usage

  GET /api/usage shows your slice and ratio, lease and job counts, your creates waiting for room with their place in the queue, and your recent refusals and take-backs, with 7 days of 15-minute history.

• Lease API

  Create, exec, stream a PTY, keep alive, suspend and resume, checkpoint, restore, fork, clone and release. State lives in SQLite, so a restart loses nothing.

• Work inside a lease

  Put and get files, run background jobs and follow their output, dial any guest port over a WebSocket, pass secrets as 0600 files, and follow lifecycle events over SSE.

• Named snapshots

  Save a live lease as a named, versioned snapshot that outlives it, with its secrets scrubbed, and start new leases from it. A snapshot from a lease that never held a secret can be granted to another user.

• SSH gateway & ctl

  ssh new@ for a fresh sandbox, ssh <id>@ to re-attach, and a control plane over SSH with tables or JSON.

• HTTP proxy & LLM gateway

  Public URLs for web servers in a sandbox, per lease and per port, and a per-lease, OpenAI-compatible LLM endpoint whose upstream keys never enter a sandbox.

• Agent access

  spoond mcp exposes shell and file tools, so any MCP-capable agent can work inside a lease.

• Network policy

  none, lan, internet or restricted with an egress allowlist, enforced per sandbox.

• Multi-user tenancy

  People and agents as identities: SSH keys, named tokens that can expire and be revoked, an equal fair share of the box each, admin users, lease sharing and per-user proxy hostnames.

• Resume on use

  A paused lease, whatever paused it, comes back on its holder's next call, memory intact. A resume that can't happen yet says when to retry, and the lease is never lost.

• Wait for room

  A create on a full host can wait instead of failing, lowest fair-share ratio first, with its queue position on the event stream. New work also waits while the host's CPU or I/O is saturated, or while granting it would promise running leases more memory than the host can back; running leases are never held. Idle leases can opt in to suspending themselves to give memory back.

• CI runner

  spoond runner leases sandboxes as Forgejo Actions workers. Jobs wait for room on a full host instead of failing, honour timeout-minutes, and can lease databases from inside.

• Operations

  Prometheus metrics, /readyz for uptime monitors, which also trips on a filling snapshot or root disk, webhook alerts, spoond doctor health checks, spoond config show for each setting's value and source and whether the running backend has it, and a lease journal that says what happened to every lease. Lost leases, orphaned sandboxes and stalled drains clean themselves up.

Recent releases

1. v3.10 Oct 17, 2026

   Give-back

   A lease spoond paused to protect itself, for a fair-share take-back or the memory floor, now comes back by itself once the host has room, longest-paused first and never at another lease's expense. The Forgejo Actions runner waits out a box_full refusal instead of failing the job. No breaking changes.

2. v3.9 Oct 14, 2026

   Self-protection

   Below a free-memory floor, spoond pauses one lease of the owner furthest over their share instead of letting a VM crash, and the lease resumes on its next use. Fair shares count active owners only, and a box_full refusal lists the caller's own running leases. 3.9.1 counts warm-pool VMs toward the memory cap, sheds idle pool VMs before pausing anyone's lease, and answers a host out of memory with a retryable 503 instead of a 500. No breaking changes.

3. v3.8 Oct 14, 2026

   Lease history

   Every ended lease is kept in a durable history, and the dashboard gains a panel of all-time records. The images panel sorts by use and folds a long catalog into a link to a full images page. elixir-base moves to Elixir 1.19 and OTP 28 with PostgreSQL 17 running in the guest. 3.8.1 stops admission from lending out memory a running VM handed back and may need again, which could crash it on a full host. No breaking changes.

4. v3.7 Oct 12, 2026

   Self-description

   GET /api/capabilities describes everything a host offers. A released lease's event names its peak memory, CI jobs show up on the dashboard as jobs, and the old /api/sandboxes path and keyless LLM access, both going in 4.0, answer with deprecation headers. /readyz watches the root disk as well (3.7.1), and image builds clean up their cache and local copies so they no longer fill it (3.7.2). No breaking changes.

5. v3.6 Oct 11, 2026

   Secrets from files

   Any secret setting can name a 0600 file instead of holding its value in the environment, and the size hint keeps a lease's vCPUs, with a memory-only hint beside it. 3.6.1 fixes file writes into /tmp on Arch-based images. No breaking changes.

6. v3.5 Oct 11, 2026

   Measured memory

   Each running lease reports its VM's current and peak memory, and a size hint names the smallest preset that would hold its peak with headroom. Owners see their measured memory in /api/usage. The backend checks every setting's type at startup and refuses to start on a bad value, naming each one. No breaking changes.

7. v3.4 Oct 11, 2026

   Config at a glance

   spoond config show lists a unit's settings with their source, secrets masked, and flags any the running backend doesn't have yet, so a change waiting for a restart stands out. Image builds prune old Docker build cache.

8. v3.3 Oct 11, 2026

   One authorization model

   Users and admin users, two read-only service tokens and the host's break-glass token. Admin users reach the admin routes with their own token, users mint named tokens that can expire and be revoked, and root on the host can mint a short-lived token for any user during a maintenance window.

9. v3.2 Oct 11, 2026

   Shared snapshots and saturation

   New work waits while the host's CPU or I/O is saturated, without holding running leases. An owner can grant a secret-free named snapshot to another user, a create that will expire says so, and the dashboard shows each lease's size.

10. v3.1 Oct 11, 2026

    Sizes and usage

    A create chooses its lease's size by preset or by vCPU and memory, starting warm where an image has a build for that size and booting cold in about a second otherwise. Clone, fork, restore and recovery now charge the size the VM really runs. Owners see their lease counts, waiting creates, recent refusals and 7 days of usage history. No breaking changes.

11. v3.0 Oct 10, 2026

    Fair shares

    Every owner gets an equal, floating slice of memory and snapshot disk, and room comes back from the biggest borrower. Pins replace holds, one 30-day clock releases every paused lease, and every capacity refusal is 503 capacity_wait or 429 box_full. Classes, preemption and per-owner caps are gone; the Go module path is now /v3. Upgrading from 2.9.

12. v2.9 Oct 9, 2026

    Resume on use

    A suspended lease comes back on its holder's next call, whatever suspended it, and a resume that can't happen yet says when to retry instead of losing the lease. CI jobs wait for room on a full host, deleting a user cleans up everything they held, and a lease journal records every lease's life. 2.9.3 lets a dashboard on a private network go without a login.

13. v2.8 Oct 8, 2026

    No loose ends

    A lost lease's guest is always stopped, sandboxes nothing claims are swept away, and a late checkpoint or restore can no longer bring a released lease back. Drain and undrain recover on their own, and guests resolve through both LAN resolvers.

14. v2.7 Oct 7, 2026

    Named snapshots

    Save a lease as a named, versioned snapshot and start new leases from it. Snapshot writes are paced, a guest whose root disk dies is recovered, and built-in defaults are now generic settings.

15. v2.6 Oct 6, 2026

    Background jobs

    Detached exec jobs that survive a restart or suspend, an on-demand crash test for recovery suites, a GC for orphaned builds, and hot-reloaded TLS certificates.

16. v2.5 Oct 6, 2026

    Waiting and idle reclamation

    Creates can wait for room in a fair-share queue instead of failing on a full host, and persistent leases can suspend themselves when idle and resume on the next call.

17. v2.4 Oct 5, 2026

    Capacity on shared hosts

    Memory quotas per user, guaranteed and burst leases, and preemption of burst leases by suspend, with an automatic resume queue. BSD-3-Clause from this release.

18. v2.3 Oct 5, 2026

    Checkpoints on the lease's terms

    Opt-in periodic checkpoints, kept checkpoints with in-place restore, and cold restarts that keep the lease id.

19. v2.2 Oct 4, 2026

    Driving work inside a lease

    Lease files, guest port dial, secrets as files, the event stream and generations; /readyz and webhook notifications.

20. v2.1 Oct 4, 2026

    A plain microVM utility

    Agent workflow moved to the separate Honey project; the character-grid dashboard and lease holders arrived.

21. v2.0 Oct 3, 2026

    The E2B substrate

    Warm memory-snapshot starts, native fork and checkpoint, SQLite state and a template-based image pipeline.

Read more

• Usage guide SSH, exec, clones, proxy, LLM, agents, policies
• API reference Every endpoint, request and error
• Upgrading to 3.0 What clients change moving from 2.9
• ctl reference Control-plane verbs and output
• Security Threat model and hardening
• Install Bringing up an E2B host and Spoond
• Operations Doctor, drain, GC, backups, capacity settings
• Architecture The E2B substrate design and decisions