Compute
Time traveling agent sandboxes
Evaluate agents with knowledge cut-offs. Generate temporally-consistent context in your cloud.
Book Demo
Trusted by teams building the next generation of AI + ML
It all runs in your cloud.
It all runs in your cloud.
Chalk Compute and the Chalk Context Engine deploy entirely inside your AWS, GCP, or Azure account.
Hardened at the kernel. Locked at the network.
Identified at the workload.
Every sandbox runs under gVisor — a user-space kernel that intercepts syscalls before they reach the host. Inside the sandbox, root has no effective capabilities, no-new-privs is on, and the kernel interfaces with the worst historical bug count are sealed off. We run a probe suite against every build to verify the sandbox holds.
gVisor isolation
Every workload runs under gVisor — a user-space kernel that mediates syscalls before they reach the host. Inside the sandbox, CapEff and CapBnd are zero, no-new-privs is on, and securebits (secure-noroot, secure-no-suid-fixup, secure-keep-caps) are locked. Root inside the container has nothing to escalate to.
Kernel surface unreachable
The interfaces with the largest historical bug count are blocked entirely: io_uring, bpf, perf_event_open, userfaultfd, fanotify, and kexec_load all return permission denied. /dev/kcore, /dev/mem, and /dev/port don't exist; /sys/kernel is empty; host block-device mounts aren't visible.
Workload Identity Federation
Every sandbox launches with its own OIDC-compliant cloud identity, scoped to that workload alone. When self-hosted on Kubernetes, no service account token is mounted into the workload — it cannot authenticate to the cluster API by default.
Network Policy
Restrict outbound egress to a hostname or CIDR allowlist; off-list traffic is dropped silently at the network layer. Raw packet sockets (AF_PACKET) and link-level admin (ip link) are blocked outright — a compromised agent can't sniff the wire or reconfigure interfaces.
MCP Gateway
Sandboxes call MCP servers through the gateway, authenticated by their workload identity. The gateway holds the real credential and proxies the call — agents get tool access without ever seeing the upstream key.
WireGuard Tunnels
Per-session WireGuard tunnels with dynamically negotiated keys, scoped to a single workload. Connect sandboxes to each other or bridge to on-prem databases without exposing them to the public internet.
Compute that knows your data.
See what your team can ship when sandboxes, models, and agents all run on the same engine — inside your cloud.
TALK TO AN ENGINEER
