Krova Cloud Platform: Complete Developer Guide 2026

If you're running AI agents, testing untrusted code, or spinning up ephemeral CI environments, you know the problem: shared infrastructure and slow provisioning cut into speed and trust. Krova Cloud solves this with isolated microVMs called Cubes, each with its own Linux kernel, booted in seconds, and billed by the minute. No shared kernel means one tenant's bug or exploit can never reach another.

Key takeaways:

• This platform runs Firecracker microVMs (the same isolation tech behind AWS Lambda) with per-minute billing and no subscriptions
• Each Cube gets full root access, its own kernel, and reserved 1:1 RAM and disk, no overselling
• AI agent sandboxes, ephemeral CI/CD, and untrusted code execution are dramatically safer and cheaper on this platform than on shared alternatives
• Pricing is 92% lower than equivalent sandbox services and up to 69% less than DigitalOcean, Vultr, or Lightsail at the same spec

What Is Krova Cloud

Krova Cloud is a developer-first infrastructure platform built around Cubes: isolated Firecracker microVMs that boot in seconds and run any Linux workload with full root access. Unlike containers, which share a single Linux kernel with every other tenant on the host, each Cube boots its own separate kernel inside a per-Cube security sandbox. That hardware-level isolation is the baseline, not an expensive add-on.

The krova cloud platform is deliberately simple. You create a Cube, pick vCPU, RAM, and disk size, get an SSH key, and you're live. Pricing is transparent: compute and storage are billed per minute, so a Cube running 5 minutes costs 5 minutes' worth, not a rounded hour. Power it off, and compute charges stop instantly. Point a CNAME at your domain and get automatic HTTPS with no configuration. Live snapshots run with zero downtime.

The platform operates its own bare-metal hypervisor in Los Angeles; it doesn't resell AWS, Azure, or GCP capacity. That vertical integration removes margin and hyperscaler lock-in, which is why pricing lands at up to 69% less than comparable Lightsail, DigitalOcean, Vultr, and Linode plans, and 92% less than dedicated sandbox providers at equivalent size.

How Cubes Work: MicroVM Isolation at Speed

A Cube is a full Linux virtual machine, not a container. It has its own kernel, its own process table, its own network namespace. When you boot a Cube, the platform provisions a Firecracker microVM (the same lightweight hypervisor AWS uses for Lambda and Fargate), spins it up, and drops you into an SSH session. The whole process takes seconds.

Firecracker wins because it's fast without sacrificing isolation. Containers boot faster but share the host kernel; one kernel exploit or misconfigured capability can leak data across every tenant. Cubes on krova cloud give you VM-grade isolation without the provisioning lag of traditional VMs. Firecracker is so lightweight it can boot thousands per host. That combination works well for ephemeral workloads like CI jobs, temporary development environments, and sandboxed user code.

Every running Cube is also wrapped in a per-Cube jailer sandbox, its own unprivileged user, chroot, and PID namespace. If a Firecracker hypervisor escape ever occurs (exceedingly rare), the attacker lands in an isolated sandbox, not as root on the host.

On the network side, Cubes are private by default: no public IP, no inbound address the internet can scan or brute-force. Traffic is default-deny until you explicitly map a port. Web apps reach the public internet through the managed ingress, which terminates HTTPS (certificates are issued and renewed automatically) and forwards to your Cube over an internal, authenticated connection. SSH, databases, game servers, and custom TCP services are reachable through port mappings you control in krova cloud and can lock to IP allowlists.

Isolation Advantages Versus AWS and Traditional VPS Providers

The platform occupies a middle ground: stronger isolation and simplicity than containers, faster and cheaper than traditional VPS, more transparent pricing than hyperscalers.

Against AWS EC2 or other public clouds: AWS gives you instances on shared hardware managed by a massive platform. You get VPCs, security groups, IAM policies, and metered egress costs that can surprise you. Krova cloud has no VPC to configure, no security groups, no IAM. Create a Cube and you're done. Billing is per-minute with no egress traps, and you own a portable snapshot you can export as a .cube file.

Against DigitalOcean, Vultr, or Linode: Those providers offer traditional VPS instances at commodity pricing. Cubes offer hardware isolation (own kernel per instance) that shared VPS cannot match. Krova cloud costs 51% less than DigitalOcean at 2 vCPU / 4 GB and 42% less than Vultr, partly because per-minute billing means you never pay for idle time. Power off a development environment at day's end and compute charges stop.

Against Docker and container platforms: Containers are lightweight and portable, but they share the host kernel. For untrusted workloads or strict multi-tenant isolation (like user-submitted code in a SaaS product), this service offers real isolation without the complexity of Kubernetes or container orchestration. You get full root, the filesystem, and the network you control, with no container runtime constraints.

Against specialized sandbox services like Daytona: Sandbox platforms are built for ephemeral code execution, which this service supports. But you get equivalent isolation at 92% lower pricing. You can also keep a Cube running indefinitely, snapshot it, export it, and ship it to production.

Running AI Agent Sandboxes

AI agents that install packages, run shell commands, and browse a filesystem need strong isolation. A compromised or badly behaved agent should never reach your host, your other workloads, or user data.

This platform's approach is direct: spin up a Cube for each agent, give it full root, let it do its job, tear it down. Cubes boot in seconds and billing is per-minute, so the cost is trivial. Spin up ten parallel agents for a batch job and tear them down when done. No subscription overhead, no fixed monthly cost for idle infrastructure.

A typical flow: snapshot a clean base image (Node.js, Python, whatever your agents need), then hand a copy of that snapshot to each new agent at boot. The agent installs its packages, runs its commands, and the sandbox keeps it isolated from your other workloads and the host. When done, the Cube is powered off and its compute charges stop. Disk storage is metered separately in krova cloud, so you can keep the snapshot around for future runs or delete it.

Because each Cube has its own kernel and network isolation, no two agents can reach each other's filesystems or processes, even if one is compromised. That's real isolation, not a flag or namespace trick.

Getting Started: Your First Cube

Signing up is free and requires no payment information. Create an account, and you land in a dashboard where you manage spaces (personal or team, billing separate per space).

To run Cubes, load prepaid credit via Stripe. Your first top-up gets $5 in bonus credit (one-time), which is enough to run a small Cube for weeks. Adding that card also activates the Starter tier automatically; higher tiers activate as you spend, with no subscription or minimum.

Pick a size (vCPU, RAM, disk), select an image (Ubuntu, Debian, etc.), add your SSH public key, and hit create. The Cube boots in seconds. Its IP, SSH port, and metrics appear on the dashboard. SSH in and you're running as root on a private Linux machine with a dedicated kernel.

From there: install packages normally (apt-get, pip, npm all work), run any Linux software, open TCP ports via the dashboard or API, point a domain at this service for HTTPS termination, or snapshot the Cube to save its state. Everything is available via the dashboard, a REST API, a TypeScript SDK, or a CLI.

For AI agent sandboxes specifically, the workflow is: create a base Cube, install your agent runtime, snapshot it, then use the API to spin up fresh copies of that snapshot for each agent run. Query the Cube's metrics and logs over SSH or the API, and tear it down when done.

FAQ

What's the Difference Between a Cube and a Container?

A Cube is a full virtual machine with its own Linux kernel; a container shares the host kernel with every other tenant on the machine. One container's kernel-level exploit can reach all others; a Cube's bugs never leave its sandbox. Cubes boot in seconds (not hours like traditional VMs) because Firecracker is lightweight.

Can I Run Docker or Kubernetes Inside a Cube?

Yes. A Cube is a real Linux server. You can install Docker, Podman, Kubernetes, or any other software you would on a regular VPS.

How Do I Know My Data Is Safe?

Each Cube runs in its own isolated Firecracker microVM with a dedicated kernel, wrapped in a per-Cube jailer sandbox. Snapshots are encrypted and stored separately from the machine running your Cube. Deleting a Cube offers to keep a backup by default, so accidental deletes are recoverable.

Does This Service Offer a Free Tier?

No subscription or free tier exists. You pay per minute for compute and storage. New accounts get $5 in bonus credit on their first top-up, enough to experiment for weeks without spending your own money.