box - Simple computers for agent w/ full VMs

Cool to see pricing finally getting competitive for agent VMs. One thing that would really help builders like me: a built-in snapshot or image registry so I can prebake a box with my project's tooling and spin up ready-to-go environments instead of installing dependencies every time. Would save a ton of time and make the 2s boot claim even more useful.

Congrats on the launch!

As agents move into enterprise workflows, how are you thinking about secure access to private networks, internal systems, identity, and policy, not just the execution environment itself?

I’ve been using box for a few weeks now. By far the best provider and it’s not even close. Great prices, super fast and the founder proactively reached out when they saw I had an issue. My preferred sandbox provider! 📦📦

Full VM per agent is smart approach. Isolation at that level removes a lot of headaches with shared state. Whats the cold start time like when spinning up a new box?

Congrats on the launch @anic_dev

I’ll give box a spin! btw the branding is goated 📦

Brandon's "procurement cycles don't care how fast your model iterates" line hit hard — that's WinBidIQ's whole world, just for federal contracts instead of compute. Skipping procurement is the pitch here, but does any customer ever need a security review anyway before spinning up VMs with admin rights?

Full VMs with admin + ssh instead of ephemeral containers is the right tradeoff for agents that install system deps or spawn nested processes — that is exactly where container sandboxes fall over. Two things I would verify before running many concurrent: what is the isolation boundary between boxes on the same host (separate kernels/hypervisor vs shared), and can I lock down egress per box or do agents get open outbound by default? Also, does box state persist across runs or is every "box new" a clean image?

The safety half of Brandon's question never got answered, and it is the more interesting half.

Snapshot and fork is recovery, not prevention. Restoring the machine undoes what the agent did to the machine. It does not undo what already left it. A pushed commit, a sent email, a dropped table on a managed database, a paid API call, none of those roll back when you restore the box.

Isolation bounds the blast radius to the VM. It does not bound it to the world, because the thing that makes an agent useful is the credentials you put inside the box with it.

So which is it today: is egress the customer's problem to govern above box, or is there something at the boundary? That answer changes who box is safe to hand to.

Using box to offload large tasks from strawberry.computer phone prototype - works pretty well for me!

The admin-rights VM detail matters. A lot of agent workflows fail in the messy middle between “clean sandbox” and “real developer machine”: credentials, GUI state, build artifacts, package caches, long-running processes. Cheap is useful, but realistic state is what makes debugging and delegation practical.