Private Alpha
Every agent runs in its own kernel, on a network that goes nowhere until you say so.
fynpod runs your OCI container images in Firecracker microVMs, the same virtualization behind AWS Lambda and Fargate, and records every connection in real time. That’s the entire product. Nothing else.
$ isolation: firecracker microvm · egress: allowlist-only · recorder: realtime▍
[ the problem ]
Your agent runs code you didn’t write.
A coding agent installs whatever packages the task calls for. The links a browsing agent follows, and the pages it reads, were never chosen by you. Some of them are built specifically to manipulate the agent reading them. Either way, code you never reviewed ends up executing inside your infrastructure.
Shared kernel
A container escape is a host compromise. Namespaces and cgroups weren't built to hold back a hostile process.
Open egress
If a workload can reach the internet, it can reach anywhere, including infrastructure an attacker controls.
Implicit trust
Most sandboxing is designed to catch careless mistakes. Agents introduce something it wasn't built for: a workload that might be acting on purpose.
fynpod treats every workload as adversarial by default. That’s why it gives each one its own kernel, closes the network until you open it, and records every connection that crosses it.
[ how it works ]
Three primitives. Nothing else.
fynpod does exactly three things. We’d rather do three things well than ten things adequately.
01 / Isolation
A Firecracker microVM per workload
You bring an OCI image. fynpod runs it in its own Firecracker microVM, the same virtualization technology behind AWS Lambda and Fargate, with its own kernel and its own memory. There's no faster mode that trades isolation for speed.
02 / Egress control
Network access is closed until you open it
Every sandbox starts closed to the internet. You allow specific hosts, like your model provider or your API, and that's the entire network it can reach. If an agent is manipulated into exfiltrating data, there's no path for the traffic to take.
03 / Observability
Every connection, recorded in real time
fynpod records every connection a sandbox makes or receives, as it happens. You see what left, what reached it, and what the allowlist blocked, without waiting on a log export.
host
└── fynpod
└── microVM (firecracker)
├── kernel isolated per workload
├── filesystem ephemeral
├── network allowlist only -> your api, your model, your registry
│ everything else -> denied
└── recorder every connection, in or out, logged in real timeHow a sandbox is structured, conceptually.
[ deliberately minimal ]
We left almost everything out. On purpose.
Every workload gets a microVM. There's no faster, lighter mode for workloads you happen to trust, because no AI agent should be assumed safe by default.
fynpod runs the part that executes code. Bring your own database, storage, and orchestration.
Sandboxes start closed to the network. You decide, host by host, what they're allowed to reach.
fynpod runs OCI container images today. Other formats aren't supported yet.
We're in private alpha. We're working directly with a small number of teams and want their feedback before we lock in pricing.
[ status ]
Private alpha.
fynpod is in private alpha. We’re working directly with a small number of teams running AI agents and AI-generated code in production-adjacent environments. We’re shaping the product around what breaks when a model runs code on its own.
If that’s you, we’d like to hear from you.
Apply for early accessearlyaccess.fynpod@fynovalabs.com