boxd vs Unikraft (2026)

Agents on a machine act in outside systems through 128 integrations, including GitHub, Linear, Slack, Notion, Jira, Salesforce, HubSpot, Stripe and Zendesk, each with typed tools such as creating an issue or sending a message.

A person connects an account once through the provider's consent screen, personally or as a shared connection for the whole organization, and the platform then makes each call on the machine's behalf, so the credential never enters the machine.

The in machine run CLI and the @boxd/run SDK call these tools, and scripts reach any other API, database or cloud account with ordinary libraries.

Sourcedocs.boxd.sh/guides/integrations/connectionsread 2026-11-05

Agents' tools run on Unikraft instead of coming from it. MCP servers run as microVMs that wake when an agent calls them, alongside webhook receivers and API gateways, and workloads connect to hyperscaler services such as S3. One customer keeps its credentials outside the VM. Unikraft names no connector catalog, OAuth actions or credential brokering of its own, so the read and write integrations are the customer's code.

Sourceunikraft.com/docs/use-cases/mcp-serversread 2026-09-22

Background jobs give automations a managed lifecycle.

A script that registers a schedule or trigger runs as a job that survives reboots, waits for a missing connection instead of failing, and restarts with exponential backoff for up to five attempts before it is marked failed. boxd's fan out pattern has a coordinator create one machine per worker, run a coding agent headless in each and let a lead agent merge the reports, and a fork brings a machine's jobs along paused so nothing runs twice.

The sequencing, branching and hand offs in that pattern are code the customer writes against the SDK, and boxd has no workflow graph, step model or multi agent runtime of its own.

Sourcedocs.boxd.sh/guides/automations/jobsread 2026-11-05

The platform schedules and scales microVMs, with autoscale, load balancing and forking a live VM for parallel sub agents. It does not sequence, branch, retry or route an agent's steps, and that logic lives in the customer's code. Unikraft offers no workflow logic that mixes deterministic nodes with agent steps. Scheduling across metros decides where compute runs, not how a workflow proceeds.

Sourceunikraft.com/llms-full.txtread 2026-09-22

Work reaches a machine on schedules, events and inbound requests. An automation registers durations or cron expressions with every() and subscribes to integration events with .on(), such as a new Linear issue or a pull request through the boxd GitHub App, and 36 integrations emit triggers.

The platform holds the next due time and wakes a hibernated machine shortly before it, holds events that arrive while a machine wakes for up to 15 minutes, and fires a missed cron slot once on wake. A hibernated machine also wakes on the next HTTPS request, so an agent served from it answers webhooks at its own address.

Sourcedocs.boxd.sh/guides/automations/scriptsread 2026-11-05

Incoming connections wake work without the customer's code starting it. An instance scaled to zero consumes nothing until the next connection arrives. The platform then boots or resumes it in milliseconds and answers, so an MCP server wakes when an agent calls it and a webhook receiver wakes on the incoming event. A tutorial walks through scale to zero triggers. Unikraft names no scheduler.

Sourceunikraft.com/docs/features/scale-to-zeroread 2026-09-22

No retrieval index, vector store or knowledge base over the customer's content comes with the platform. Files on a machine's disk, standalone disks that outlive a machine and data sets saved into a snapshot are storage the agent's code reads, not an index a query returns. Tools such as Notion, Confluence or Google Drive are searched through their own integrations, and any grounding layer is something the customer installs on the machine.

Sourcedocs.boxd.sh/llms.txtread 2026-11-05

The platform runs the customer's workloads, including databases and MCP servers, but keeps no retrieval structure over the customer's content for an agent to query. Volumes and databases hosted on it are the customer's own storage. There are no sources that Unikraft indexes, refreshes or permissions.

Sourceunikraft.com/llms-full.txtread 2026-09-22

Machines keep their working state between sessions. A machine on standby resumes in under a millisecond and a hibernated one wakes with its memory and processes intact, and coding agent sessions live on the persistent disk, so a job delegated in the morning can be resumed interactively later. Forks, checkpoints and snapshots copy or rewind that state.

Automations also get object(name), a named JSON store written on every assignment and restored on the next run, meant for cursors, dedup sets and counters. All of it is machine and script state the developer manages, with no memory layer of stated scope and lifetime that a buyer can review, edit or delete as memory.

Sourcedocs.boxd.sh/guides/automations/scriptsread 2026-11-05

A workload's state carries across sessions. Instances snapshot and resume in milliseconds with their state intact, a live VM and its children fork in about ten milliseconds, managed volumes persist data, and paid plans add snapshot history and rollback. The agent's code reads that restored state to carry on.

Volumes are storage the code reads, and restored process state belongs to the machine. The customer can resume, roll back or delete that state but cannot review or edit what it holds. Unikraft offers no separate memory layer for agents. A browser session ROM keeps its own cookies and profile, much like a saved login.

Sourceunikraft.com/docs/features/snapshotsread 2026-09-22

A person can step into an agent's work while it runs. Every machine has a live desktop in the browser where its owner watches the agent's browser, takes over the keyboard to enter a password, solve a captcha or fix a form, and hands control back without stopping the agent. The preinstalled coding agents are told to share that desktop link whenever they need someone, so a login or approval happens in the browser the agent already opened. There is no approval gate, pause primitive or policy that holds an agent's action until a person reviews it.

Sourcedocs.boxd.sh/guides/desktopread 2026-11-05

Unikraft names no approval step, consent checkpoint or escalation to a person for the work it runs, and no place to insert one. The network shield and relay, an Enterprise feature, routes an instance's traffic through a relay VM, and delete locks stop instances being removed. The developer configures both for isolation and protection, and neither has a person review an agent's action.

Sourceunikraft.com/docs/features/network-shieldread 2026-09-22

Organizations have three roles. Members use shared machines and create org billed ones, admins also invite and remove members, change roles, set defaults, create teams and revoke org API keys, and the single owner can demote admins. Admin invites need an interactive login, so an API key or a token minted inside a machine cannot send one.

People sign in with GitHub or Google, with SAML single sign on offered to enterprise customers on request. A DPA is available, and SOC 2 Type II and ISO 27001 are both in progress, not held. Each machine is a KVM microVM with its own kernel, and egress allowlists and host bound secrets are enforced on the host, outside the machine.

Sourcedocs.boxd.sh/guides/organizationsread 2026-11-05

The company holds SOC 2 Type II against the Security criteria and is HIPAA compliant, with BAAs available. An independent penetration test by DEFION Security found no exploitable cross VM, hypervisor, filesystem or host agent issues. Alongside these, every workload is its own Firecracker based microVM with per tenant filesystem boundaries, delete locks protect instances from removal, and on Enterprise a network shield and relay route an instance's traffic through a relay VM.

Unikraft names no SSO, roles or identity provider support.

Sourceunikraft.com/llms-full.txtread 2026-09-22

Automations are visible and the agent's own steps are not. The console's Automations page lists every background job with its triggers in plain English, the integrations it uses, its state, last run and last error, plus a generated write up and flow diagram for each script, and run logs prints or follows a job's log from inside the machine. Regional uptime and incidents appear on a public status page. A coding agent's prompts, tool calls and outputs are not traced by the platform, and no audit trail of member actions is offered.

Sourcedocs.boxd.sh/guides/automations/jobsread 2026-11-05

Logs and metrics follow the instance, not the agent. Every user gets full stdout and stderr logs, paying customers get Prometheus metrics, and a metrics API reports CPU time, memory, network I/O, connection counts and scale to zero wake latency per instance. The metrics export to monitoring systems. Inspecting prompts, tool calls, retrieved knowledge and outputs step by step is left to the customer's own code. Unikraft names no audit log separate from the runtime logs and no retention by plan.

Sourceunikraft.com/docs/platform/metricsread 2026-09-22

Each machine runs in Frankfurt or New York, picked per machine from the CLI, console or SDK or set as an organization default, and its disk, memory, snapshots, checkpoints and backups stay in that region on Latitude.sh bare metal. Scale customers can have boxd operate the cluster inside their own cloud account, and the same release self hosts on AWS, Google Cloud or any KVM host, free up to 16 worker vCPUs and licensed above that, with air gapped installs supported. boxd gives conflicting accounts of its US region, with New York live in some places and coming soon with a waitlist in others.

Sourcedocs.boxd.sh/guides/regionsread 2026-11-05

Customers choose the named metros where Unikraft Cloud runs. Dallas, Frankfurt, San Francisco, Singapore and Washington DC are the defaults, and the list is set per account. Deployment can be hosted, dedicated hosted, on premises or BYOC, on bare metal or on AWS EC2, GCP Compute Engine or Azure VMs. A Kubernetes integration adds Unikraft Cloud as a node in EKS, GKE, AKS or the customer's own cluster.

Sourceunikraft.com/docs/platform/metrosread 2026-09-22

Machines arrive with Claude Code, Codex and OpenCode installed and configured through an instructions file that teaches each agent the platform, plus three preinstalled skills covering the in machine CLI, automations and the desktop, and a CLI skill for the laptop.

Guides walk through development workspaces, preview environments, CI runners, personal assistants, sandboxes, agentic SaaS, RL environments and agent swarms, and connectors exist for open source tools such as TanStack AI, Pydantic AI, Harbor and Scale AI AgentEnv. These are configured third party agents and recipes a developer builds from, not prebuilt agents of boxd's own.

Sourcedocs.boxd.sh/use-cases/coding-agentsread 2026-11-05

Templates here are snapshots of the customer's own warmed up workload that new instances boot from, not ready made starting points from Unikraft. Unikraft covers patterns for sandboxes, headless browsers, MCP servers and remote desktops, but ships no working agents, production ready templates or role specific agents for a customer to adopt.

Sourceunikraft.com/docs/features/on-demand-templatesread 2026-09-22

The customer decides which agents and models run. Claude Code and Codex use the customer's own subscription, signed in once and served to every private machine in the organization, or an API key stored as a secret, OpenCode signs in on each machine, and any other agent or model that runs on Linux can be installed. boxd adds no model of its own and does not route between providers, and it does not use customer data to train or improve any model.

Sourcedocs.boxd.sh/use-cases/coding-agentsread 2026-11-05

Any Dockerfile workload runs here, and nothing in the platform is specific to language models. There is no model selection, routing, provider keys or guidance for connecting the customer's own models. GPUs appear only for rendering in headful browsers. The platform imposes no model of its own either.

Sourceunikraft.com/llms-full.txtread 2026-09-22

Outside code drives the platform through TypeScript and Python SDKs, a gRPC API whose full api.proto service definition is public for generating stubs in any language, and a CLI that returns JSON from its commands. Each region has its own API endpoint, and organization API keys keep working after the person who created them leaves. The SDKs cover machines, forks, snapshots, checkpoints, disks, egress, secrets, domains, organizations and teams, and a filesystem API reads and writes files inside a machine from code.

Sourcedocs.boxd.sh/reference/grpc-apiread 2026-11-05

From outside, a platform REST API drives Unikraft Cloud, covering instances, templates, volumes, services and metrics. The unikraft CLI adds a raw API passthrough, and a Kraftfile specification and Kubernetes and Karpenter integrations round it out. Unikraft names no SDK or MCP server of its own. Some newer features, such as plugins and the network shield, are available only through the API for now.

Sourceunikraft.com/docs/llms.txtread 2026-09-22

There are no test cases, scoring or quality gates for an agent's behavior. The platform is where evaluations run, not how they are scored. Forks give every reinforcement learning rollout or benchmark trial a byte identical starting state, Moyai ran 279,577 Harbor benchmark machines on it, and a reproducibility check compares two forks run with the same seed, but rewards, datasets and scoring belong to the customer's own framework.

Sourcedocs.boxd.sh/use-cases/reproducible-rl-environmentsread 2026-11-05

Tests get somewhere to run, but Unikraft does not test agents. Forking and the build and test environments pattern give the customer disposable, parallel VMs. The platform has no fixtures, scoring, quality gates or comparison of agent runs.

Sourceunikraft.com/docs/llms.txtread 2026-09-22

Agents drive a real browser on the machine's own desktop. Every machine ships a browser automation CLI built for agents, backed by Chromium with anti bot fingerprinting and a persistent profile so logins stick, and scripts get the same browser through Playwright. A machine can also drive a Chrome window on the user's laptop over the DevTools protocol, for sites that only accept the user's own network, and the preinstalled agents get a browser tool for it automatically. Any GUI app installed on the machine opens on the same desktop.

Sourcedocs.boxd.sh/guides/launch-a-browserread 2026-11-05

Browser and desktop agents get their machines here. Every browser session can run in its own disposable headless or headful microVM with GPU rendering, booted from a snapshotted template, and whole desktop sessions snapshot after login and resume on connect. Browser agent companies run on it. The platform works with any browser, so the customer brings the browser and drives it with its own tooling. Unikraft offers no API of its own for screenshots, clicks or typing. It supplies the environment for operating web interfaces and desktops, and the customer supplies the control.

Sourceunikraft.com/docs/use-cases/headless-browsersread 2026-09-22