Multi-tenant platforms
Run user & untrusted code
Give every end-user their own isolated Cube. Each one is a Firecracker microVM with its own kernel, so one tenant's code can never see or reach another's.
Why run this on a Cube
Real isolation per tenant
Every user's workload runs in its own microVM with its own kernel and a per-cube sandbox — never a shared kernel like a container. Isolated by design, multi-tenant-safe from the first line of code.
Nothing exposed
Cubes have no public IP to scan or attack. Only the ports you open are reachable, and each one is IP-allowlistable — so a tenant's code stays sealed off from the internet unless you decide otherwise.
Provision and tear down by API
Spin up a fresh Cube for a new user in seconds and delete it just as fast — all through the v1 REST API or SDK. Take a snapshot first if you want a clean, reusable base image.
Pay only while it runs
Sleep a Cube to stop compute billing the moment a session ends, and wake it in under a second when the user comes back. Billed by the minute, with RAM and disk reserved 1:1.
How it works on a Cube
Wrap Cube provisioning behind your own app and hand each user a sealed environment.
- 1
Create a Cube per user with a single API call, baking in your SSH key and a base image.
- 2
Run the user's code inside the Cube with full root — no restrictions, its own kernel underneath.
- 3
Keep every port closed except the ones your platform needs, each IP-allowlisted.
- 4
Sleep the Cube between sessions to pause billing, and delete it (with a pre-deletion backup) when the account goes away.
Frequently asked questions
How is this different from running untrusted code in a container?
A container shares the host kernel with every other tenant on the box. A Cube is a Firecracker microVM with its own kernel and a per-cube sandbox, so the isolation boundary is VM-grade — the same technology behind AWS Lambda.
Can a tenant's Cube reach another tenant's Cube?
No. Cubes have no public IP and are isolated from one another by design. You decide exactly which ports are reachable and from which IPs.
How fast can I create a Cube per user?
A Cube boots in seconds. Create and destroy them programmatically through the SDK, CLI, or REST API as users come and go.
Ready to build on a Cube?
Create your account and launch an isolated Cube in under a minute. Your first $5 top-up doubles to $10 in credit — one-time.