All features

Isolated by default. Every workspace runs in its own microVM.

Candidate code runs in a Firecracker microVM with no network, no shared filesystem, and hard CPU and memory caps. The host and other workspaces are unreachable. The VM is destroyed on idle.

Start freeSee pricing

Screenshot coming soon

Use cases

When this feature earns its keep.

Three concrete patterns. Use them as templates for your own setup.

Let a candidate run untrusted code without fear

The Firecracker microVM boundary means candidate code cannot reach the host operating system, other workspaces, or the internet. An interviewer can hand a candidate a blank editor and say "go" without any additional sandboxing setup.

Run hidden test cases against submitted code safely

Hidden tests execute inside the same VM as the candidate code. A misbehaving solution that tries to read test inputs from the filesystem or environment variables is blocked at the VM boundary.

Accept take-home submissions and run them without a reviewer on call

Because execution is sandboxed and capped, you can run submitted code automatically and record the results without worrying about a rogue script consuming infrastructure or exfiltrating data.

Setup

How the setup looks.

Sandboxing is automatic. Every workspace gets its own microVM. There is nothing to configure.

Same workspace, same auth, same collaboration features as every other Typelets workspace. See all features

  1. Create a workspace and select a language

    Each language (Python, Node, Go, Java, C, C++, Ruby) runs in its own pre-built microVM image. The image boots when the workspace is first opened.

  2. Write code in the editor and hit Run

    Typelets sends the file contents to the microVM, executes the entry point, and streams stdout and stderr back to the terminal panel. The VM never touches the network or the host filesystem.

  3. Review the output in the shared terminal

    Both the interviewer and candidate see the same output at the same time. The 20-second wall-clock cap stops runaway loops automatically without requiring any manual intervention.

FAQ

What exactly is a Firecracker microVM?
Firecracker is an open-source VMM developed by AWS and used in production for Lambda and Fargate. Each microVM has its own kernel, a private filesystem, and hardware-enforced isolation from the host. It boots in under 125ms and has a much smaller attack surface than a full VM or a container without seccomp/namespaces.
Can candidate code access the internet?
No. The microVM is started with no network interface. Attempts to open sockets, make HTTP requests, or resolve DNS names fail immediately. This blocks both accidental internet dependencies and intentional exfiltration.
What are the CPU and memory limits?
Limits are set per workspace and visible in the workspace settings dialog. During beta the defaults are 1 vCPU and 512 MB RAM. These are hard limits enforced at the hypervisor level, not soft ulimits that can be bypassed from inside the VM.
What happens to the VM when the workspace is idle?
After 15 minutes of inactivity the VM is shut down and its filesystem is discarded. Any files written inside the VM during that session are gone unless they were also written to the workspace file tree (which is persisted separately in Postgres and Tigris).

Start interviewing in under a minute.

No card, no install, no yaml. Sign up, create a workspace, share the link. That's it.

Free during beta · No credit card · Cancel anytime