Tako VM

File system and Python execution for your agents: run untrusted code in gVisor-isolated containers, with the queue, workers, execution history, retries, and replay you'd otherwise build yourself.

job_id = tako_vm . submit_code ( "print(sum(i * i for i in range(10**6)))" )

Install, run the server, and execute your first sandboxed job.

gVisor isolation, seccomp, the threat model, and how to harden for production.

Wire Tako VM into LangChain or OpenAI tool-calling as a code-execution tool.

Every endpoint and SDK method: sync execution, async jobs, replay, artifacts.

Sandbox-only tools (e2b, microsandbox) give you isolated execution. You still need to build the job system yourself.

Tako VM exists to run untrusted, often AI-generated, code, so isolation is layered: each job runs in its own ephemeral Docker container behind gVisor 's userspace kernel, with a default-deny seccomp profile, no network, dropped capabilities, and a non-root user. Even a kernel exploit stays inside the sandbox.

For production with untrusted code, set security_mode: strict so execution fails rather than silently falling back to standard runc when gVisor is unavailable.

Sandbox : a gVisor-backed, single-use container that executes one job and is destroyed.

Job : an asynchronous unit of work with a persisted ExecutionRecord lifecycle ( queued → running → succeeded/failed/timeout/oom/cancelled ).