Autonomous agents. Isolated by default.
The first question every engineering leader asks: "is it safe to let an agent run code?" Here is exactly how Sweet contains it.
Isolated by default
Each web session runs in its own Firecracker microVM — not a shared cloud box.
Unprivileged
The VM runs as an unprivileged user in a chroot — no host root, no host filesystem.
Egress-restricted
Guests can't reach internal systems or private networks. Outbound is locked down.
Isolated execution
For teams, agents run in isolated Firecracker microVMs. For the CLI, the agent runs locally on your machine.
Reviewable
Standard git — agents open normal PRs your engineers review.
Hard-capped cost
Usage is hard-capped; you can never be surprise-billed.
The trust question, answered
Sweet does not hand your code to a shared cloud agent. For teams it runs in your infrastructure, in isolated microVMs, with egress restrictions and no host privileges. You review every diff like any PR. SOC 2 is on our roadmap (not yet complete); a DPA is available for Enterprise.
Where does my code run?
CLI — on your machine. The terminal app runs locally; it executes git, tests, and your tools right where you are. Your workspace stays on your machine.
Web app — in Sweet's isolated microVMs. Each web session runs in its own Firecracker microVM on our infrastructure — unprivileged, egress-restricted, one per session (not a shared container). It's isolated from other users and from our internal systems.
Self-hosting / private deployment (agents running in your cloud) is on the Enterprise roadmap — ask us.