Agent sandboxes / Windmill AI Sandboxes and Workflows alternative

A Windmill.dev alternative for the agent’s complete Linux state

Windmill now documents AI Sandbox scripts for coding agents, combining nsjail isolation with persistent volumes. These files survive job runs through object-storage synchronization. The choice involves that job and workflow model, its selected persistent paths, and the full Linux-system lifecycle required by an agent.

Start buildingCompare capabilities ↓

Reviewed 2026-10-19 · Published by the Sandbox0 team

When Windmill AI Sandboxes and Workflows fits

Windmill fits teams combining coding-agent execution with scripts, flows, applications, queues and integrations. Its AI sandbox templates and cross-run agent files are substantive capabilities, with cloud and self-hosted options.

When to consider Sandbox0

Consider Sandbox0 for compatible Linux agents needing the complete durable writable RootFS across tasks, automatic online growth and supported files while guest compute stays paused. Retain required workflow and application services separately.

Capabilities

Windmill AI Sandboxes and Workflows and Sandbox0: what persists?

Feature comparison with documentation and verification status
Environment and runtime lifetimeWindmill AI Sandboxes and WorkflowsNot established in this reviewSandbox0ttl and hard_ttl default to 0 (disabled). Configure idle pause and deletion policies for the same persistent sandbox identity; an idle running sandbox still accrues compute charges.Read documentation →
Persistent filesWindmill AI Sandboxes and WorkflowsNamed volumes synchronize files through object storage between job runs, subject to leasing, permissions and edition limits.View evidence ↗Sandbox0The writable RootFS survives successful checkpoints, including software, system configuration, dependencies, and user data.Read documentation →
Whole RootFSWindmill AI Sandboxes and WorkflowsPersistence is scoped to annotated volume paths and synchronization, not arbitrary changes throughout the worker or sandbox OS root.View evidence ↗Sandbox0Persistence extends beyond /workspace to paths such as /usr/local, /etc, and /home. Runtime tmpfs and virtual filesystems are excluded.Read documentation →
Release compute, keep stateWindmill AI Sandboxes and WorkflowsFile/session restoration across jobs does not establish a general durable whole-machine pause/resume lifecycle.View evidence ↗Sandbox0Pause compute between tasks; resume on available capacity. Default resume starts fresh processes from the saved filesystem.Read documentation →
Memory and process stateWindmill AI Sandboxes and WorkflowsSaved agent memory files and session IDs are not documented running-process RAM checkpoints.View evidence ↗Sandbox0Experimental memory checkpoints can preserve compatible process state. Use memory: true on both pause and resume on a compatible deployment. A filesystem checkpoint alone does not preserve running processes.Read documentation →

Online RootFS growth

On growth-enabled images, Sandbox0 automatically expands the writable RootFS as free space runs low, within a configured sparse logical ceiling up to 64 TiB. Agent processes keep running. Growth is enabled in the qualified Cloud region; confirm activation for other regions. Existing images and snapshots retain their captured storage geometry. The ceiling is logical capacity, not preallocated host disk.

Windmill volumes retain selected files with object-store synchronization and bounded per-worker caching. That does not establish automatic online growth of a complete durable writable agent RootFS.

Files while compute is paused

Sandbox0's Files API reads persistent files without resuming compute. Filesystem-only pauses also permit edits; retained-memory pauses are read-only and reject mutations with 409. SSH, SFTP, file watching, and runtime-only mounts require running compute.

Windmill provides object-backed volume files and storage interfaces outside a single job. These are selected workflow data, rather than a direct complete paused-root filesystem contract. Sandbox0 supports its durable paused RootFS under filesystem-only mutation and retained-memory read rules.

See paused file operations →

Agent session files already survive job runs

An AI Sandbox script combines process/filesystem isolation with one or more named volumes for session IDs, history and artifacts. Files are restored before execution and synced to object storage afterward. This is real file-based agent continuity; it does not establish that arbitrary changes under every system path or live process memory survive between jobs.

Source 1 ↗Source 2 ↗

Volume leasing and permissions shape concurrency

Only one job can use a given volume at a time. A job may mount up to ten volumes, with allowed absolute prefixes under sandboxing and relative paths otherwise. Read-only volume access does not sync changes back. The docs describe volumes as an Enterprise feature with Community limits of twenty volumes per workspace and 50 MB per file; confirm the edition and object-storage configuration.

Source 1 ↗

Cloud and self-hosted prices must be read separately

The Cloud monthly selection prices Team seats and dedicated Enterprise resources differently from self-hosted licensing. Cloud Enterprise has a core package, provisioned-memory Compute Units and seats. Team execution credits increase with job duration: a job under one second uses one credit and additional compute seconds consume more. Ten thousand credits are not ten thousand arbitrarily long runs. Community software is free to self-host, with infrastructure and operations still required.

Source 1 ↗

Pricing

Compare billing models, then price your workload

CPU allocation, memory, billing minimums, disk, plan fees, and supported workload differ. These meters are not equal-performance machine quotes. Confirm region, resource units, and included allowances before estimating a total.

Windmill AI Sandboxes and Workflows

Pricing reviewed 2026-10-19

Cloud Team monthly developer seat
$10 per developer/month
One developer or two operators per seat; 10,000 execution credits per seat-month, scaled by runtime; up to 10 seats.
Rate source ↗
Cloud Enterprise monthly core package
$600/month
Workers and seats are additional.
Rate source ↗
Cloud Enterprise standard Compute Unit
$100 per CU-month
One CU is 2 worker-GB-month of provisioned memory; native workers have their own conversion.
Rate source ↗
Cloud Enterprise monthly developer seat
$40 per developer/month
Operators are $20/month.
Rate source ↗
Community self-hosted software
$0 software fee
Infrastructure and operational costs are separate.
Rate source ↗

These Cloud rates use monthly billing; self-hosted licensing has separate terms. Cloud Free lists 1,000 execution credits/month; Team and Enterprise have different feature and execution limits. Enterprise CUs price provisioned worker memory, not actual CPU time. Calculate core package, configured worker CUs, seats, object storage and any model-provider charges separately.

Check current Windmill AI Sandboxes and Workflows pricing ↗

Sandbox0

$0.015/GiB-hour compute (billed by the second at approximately $0.000004167/GiB-second), plus $0.02/GiB-month of retained incremental RootFS and memory checkpoint data. Shared base images and platform recovery retention are excluded; paused sandboxes accrue storage charges only.

Compute / GiB-hour
$0.015
Retained data / GiB-month
$0.02
Paused compute
$0.00

A 4 GiB agent, 100 running hours

$6.00 compute

4 GiB × 100 hours, billed by the second. Keeping 20 GiB of billable incremental data for a full billing month adds $0.40. CPU is derived from memory by the platform; choose a tier that fits your workload.

Understand storage billing →

Before migrating from Windmill AI Sandboxes and Workflows

  1. Map agent scripts, workflow steps, session files, volume paths, shared-name leases, object storage and edition limits.
  2. Retain required flows and integrations and port compatible Linux execution with verified tools and agent state.
  3. Test cross-task system retention, online growth and supported paused files separately from workflow correctness, volume concurrency and configured Cloud/self-hosted costs.

Common questions

Is Sandbox0 a drop-in Windmill AI Sandboxes and Workflows replacement?

Evaluate API compatibility and product scope. A shared sandbox category does not make SDKs, lifecycle semantics, or limits interchangeable.

Does keeping files also keep a running agent?

Filesystem state and volatile process state are separate. Sandbox0 requires explicit compatible memory checkpoints to preserve running processes; its default filesystem resume starts fresh processes.

Sources and review scope

The Boat team's Battleships directory is the discovery source. References below describe the product and plan discussed on this page. Check current availability, regional terms and billing units before migrating. Where the cited material does not establish a capability or price, the comparison identifies that uncertainty.

Battleships research record ↗www.windmill.dev/docs/core_concepts/ai_sandbox.md ↗www.windmill.dev/docs/core_concepts/volumes.md ↗www.windmill.dev/pricing ↗Sandbox0 RootFS capacity →

Related comparisons

Agent 37 vs Sandbox0 →AgentComputer vs Sandbox0 →ainclave vs Sandbox0 →Alibaba Cloud Agent Sandbox / FC / AgentRun vs Sandbox0 →Alibaba Cloud AgentBay vs Sandbox0 →Amika vs Sandbox0 →