Perplexity ওপেন-সোর্স করেছে SPACE, একটি ফায়ারক্র্যাকার মাইক্রোVM স্যান্ডবক্স AI এজেন্টদের জন্য

এটি ফিডে পাওয়া অংশবিশেষ। এটি সংক্ষিপ্ত বা প্রকাশকের মূল ভাষায় হতে পারে।

Perplexity has open-sourced SPACE, the sandbox platform behind every task in Perplexity Computer. The Perplexity SPACE sandbox gives each agent task its own Firecracker microVM. Credentials and outbound traffic are controlled from outside that VM. The code ships under Apache 2.0 on GitHub. For teams building coding or browsing agents, this is a production-tested isolation layer they can self-host. TL;DR Size: Rust codebase, release 0.8.0, the public baseline. HTTP API plus server-sent events. Runs on: A Linux x86_64 host with KVM, /dev/kvm, btrfs and Docker. Local Kind (Kubernetes) or direct mode. No macOS. Performance: In production, median create latency fell from 185 ms to 60 ms versus Perplexity’s previous provider. Best: 0 of 108 VM-to-host escape attempts succeeded across 9 frontier models. Worst: Before fixes, agents bypassed the egress policy in 11 of 54 partial-network runs. What is Perplexity SPACE? SPACE (Sandboxed Platform for Agentic Code Execution) is Perplexity’s platform for running agent code in isolated microVMs. Applications call its HTTP API to create Linux environments, run commands and stream output. A template supplies the starting filesystem. A sandbox is one instance of that template, with its own VM and writable disk. Many commands can run inside one sandbox. Perplexity’s launch thread explains the design goal. Agents run commands, install packages and call services with root inside the sandbox. The host stays outside the guest’s control. Agent work is long-running, stateful and branching, so it must survive restarts. How does SPACE isolate agents? Each sandbox is a Firecracker microVM with its own guest kernel. A per-sandbox network gateway on the host enforces egress policy on every outbound connection. Secrets never enter the guest. Per Perplexity’s July engineering post, credentials are injected at the network layer. The credential store adds hierarchical scoping, rate limits and audit logging. The architecture guide split