Skip to main content
Azure Container Apps Sandboxes

Isolated microVMs,
on demand.

Start with CLIClone samplesOpen portal
Sub-second startup. Start a sandbox, run commands, and delete it in seconds.
Strong isolation. Each sandbox runs in its own secure boundary, so you can run untrusted code safely.
Suspend and resume. Capture full memory and disk state, resume in under a second, and scale to zero between runs.
OCI disk images. Use any container image as a sandbox root filesystem.
Secure egress. Built-in egress proxy with configurable deny policies, host allowlists, and credential injection.
Built for AI apps and agents. Control sandboxes from the CLI, SDKs, or MCP for agent-ready workflows.

Anatomy of a sandbox​

Portalpoint & clickACA CLIaca sandbox createSDKscontrol plane (ARM) · data planeSANDBOX GROUPSANDBOXESsandbox-webappRUNNINGper-user previewM · port 8080 · ingresssandbox-copilotSTOPPEDagent workspaceM · port 8080 · memory persistedsandbox-swarmRUNNINGmulti-agent fan-outL · 2 vCPU · 4 GiBsnapshot-mcpSTOPPEDtool serverS · fork from snapshot… and thousands more per groupSHARED RESOURCESDisk Imagesroot filesystemsSandbox Snapshotsmemory + diskData Volumesblob · data diskSecretsenvironment variablesIdentitymanaged identityInternet / VNetpublic or private endpointIngress proxyoff by default · opt-in persandbox and per portwake onrequestEgress proxydefault on · host allowlist+ deny policiesInternet / VNetpublic internet or your VNet

A sandbox group is a regional Azure Resource Manager (ARM) resource that can contain thousands of sandboxes. Each sandbox starts from a disk image, can mount data volumes, and has one of two lifecycle states: Running or Stopped. Stopped sandboxes don't incur compute charges. Snapshots capture memory and disk so you can clone a sandbox or restore its state. Public ingress routes each port-specific hostname through an ingress proxy to one sandbox and can wake a stopped sandbox on request. Sandboxes use Microsoft Entra managed identities and reach external services through an egress proxy with host allowlists, deny policies, and credential injection. Both directions can be private: a sandbox group can join an Azure virtual network (VNet) so sandboxes reach private resources over your subnet, and it can accept inbound traffic through a private endpoint in your VNet instead of the public internet.

What you can build​

Traditional apps. Move workloads that need stateful compute, OS-level dependencies, or per-tenant isolation without a rewrite.
AI apps and agents. Give agents persistent, isolated workspaces that survive across task boundaries. Suspend between turns and resume with full context.
Code execution. Run untrusted code in seconds with strong isolation. Capture state with snapshots and replay it deterministically.
Dev environments. Provide per-user compute that scales from zero to thousands on demand and preserves state across sessions.
More scenarios. CI runners, browser automation, data prep, and reproducible experiments — anywhere a fast, isolated VM helps.

Building blocks​

Sandbox groups. Regional ARM resource that contains your sandboxes and the VNet, identity, and quota they share.
Sandboxes. Start, run commands, label, tune CPU and memory, suspend, resume, and delete individual microVMs.
Disk images. Import OCI container images and use them as the root filesystem for new sandboxes.
Volumes. Azure Blob for shared, multi-attach data. Azure Data Disk for high-performance single-attach.
Secrets. Inject configuration and credentials into a sandbox as environment variables at boot.
Identity. Attach managed identities at the group level for token-broker access to Azure services.
Boot, suspend, resume. Bring up a sandbox in under a second. Suspend full memory and disk, then resume in place.
Snapshots. Fork a primed sandbox into many replicas, restoring full memory and disk in under a second.
Exec & interactive shell. Run commands inside a sandbox over the data plane, stream stdout/stderr, and attach a PTY.
File access. Upload, download, and stream files in and out of a running sandbox over the data plane.
Ports. Expose HTTP ports from a sandbox for inbound connections and previews.
Egress proxy. Control outbound traffic with deny policies, host allowlists, and credential injection - no secrets inside the sandbox.
Labels & metadata. Tag sandboxes for routing, billing, and per-tenant filtering when you list or query them.
Sandboxes or dynamic sessions?

Dynamic sessions route HTTP requests through a managed pool - best for stateless code execution at request scope. Sandboxes give you direct CLI / SDK control over individual microVMs, with suspend, snapshots, persistent volumes, and egress policy. Reach for sandboxes anytime state, lifecycle, or networking control matters.

Get started​

Quickstart: Portal

Use the portal to provision a group and launch your first sandbox.

Learn more →

Quickstart: CLI

Sign in, create a group, and start your first sandbox in under five minutes.

Learn more →

Quickstart: Python

Boot, exec, snapshot, and tear down from a script.

Learn more →

Quickstart: Agent Skills

Connect sandboxes to Copilot, Claude Code, or any agent.

Learn more →
Last updated on