Token Factory Sandboxes
Public repositories and dry runs are verified on Nebius Token Factory Sandboxes, microVMs Teire builds its own images in. Private repositories stay on Cloudflare Containers.
Teire verifies a public repository's upgrade, and every dry run, on Nebius Token Factory Sandboxes: each command runs in its own microVM, a virtual machine with its own kernel. The same install, typecheck and tests run as on Cloudflare Containers, with the same evidence rules (Verification).
Which runs go where
| Repository | Backend | Why |
|---|---|---|
| Public | Token Factory Sandboxes | A run's saved sandbox images hold the repository's files for 180 days; after that, Token Factory may delete the ones nothing tags or references, and there is no call to delete them sooner. For public code that is no exposure. |
| Dry run of a public repository | Token Factory Sandboxes | The same reason |
| Private | Cloudflare Containers | A private repository's files never land in an image that outlives the run |
When Token Factory isn't available to the worker (no project, or whoami grants no spawn), a public run verifies on Cloudflare Containers instead. The run page and its receipt name the backend each run used.
How a run works there
Token Factory Sandboxes runs one command per microVM. A microVM that is kept saves what it changed as a new image, and the next command starts from that image. Teire chains them:
Imagebuilt onceby recipe hash- Checkout≤200 MB
- Installnetwork on
- Checksno network
The image. Teire builds its sandbox images inside Token Factory, from the same Dockerfiles as the Cloudflare images: it imports the public base image, runs the build steps in one microVM, and tags the result by the recipe's hash, so each image is built once.
The checkout. The worker streams the commit's tarball into Token Factory's upload as it arrives (no repository code runs on the worker, and the tarball is never held in its memory; it stops past 200 MB), then unpacks it into /work in a kept microVM.
The install, with the network on. Your package manager installs from its registries. The result is the image the checks start from.
The checks, with the network off. Each check runs in a microVM with no network interface at all, as the unprivileged user teire (uid 10001), as CI runs them. The first check starts from the install's image and each later check from the image the one before it left, so a build's output (generated files, compiled code) reaches the tests, as it does in a single container. Each command runs under GNU timeout, so a check that hangs ends with exit 124 inside the microVM. The agent's edits between attempts are uploaded and placed into each check's microVM.
Measured on teire-dev/examples (2026-10-28), each baseline on its own image built inside Token Factory:
| Folder | Ecosystem | Install | Checks |
|---|---|---|---|
npm-zod | npm | 4.9 s | typecheck, 4/4 tests |
py-major | Python (uv) | 4.9 s | 2/2 tests |
go-major | Go | 2.6 s | build, go vet, 4/4 tests |
rust-major | Cargo | 4.9 s | build, 5/5 tests |
ruby-major | Bundler | 4.9 s | 6/6 tests |
jvm-major | Maven, JDK 17 | 51.9 s | compile, 4/4 tests |
Limits come from Token Factory's own whoami call, never assumed: an hour per microVM, 50 at a time and 8 image imports at a time, which Teire keeps to (spawns and imports wait for a free slot, shared by every run on the worker); whoami also reports 12 GB per image layer. Measured from inside a microVM: 4 CPUs, 3.9 GB of memory, a 2 GB /dev/shm. A failed spawn is not retried, because spawns carry no idempotency key. Teire follows each command through the operation's server-sent events (a quiet stream is checked against the operation's state); a run that is closed cancels the operations it still has running.
What differs from Cloudflare Containers
| Token Factory Sandboxes | Cloudflare Containers | |
|---|---|---|
| Isolation | A microVM per command | A container per side, driven by a Durable Object |
| Install network | Open (no allowlist exists) | Package registries only, GET only |
| Check network | None: no network interface | Off; any request is denied and recorded |
| Egress record | None kept by Token Factory | Every request the sandbox refused |
| After the run | Images kept 180 days, then may be deleted if untagged; no call to delete sooner | The container is destroyed |
Gaps that shape how Teire uses it
Token Factory Sandboxes has no call to delete an image, no idempotency key on spawns, no egress log and no allowlist for the install's network. Each shapes how Teire uses it: public repositories only, spawns never retried, and checks with no network interface.
One more, found on a real fork (teire-dev/bristow): the microVM's root filesystem (virtiofs) loses a file a Ruby native-extension build writes while the compiler it started holds it open, so every native gem failed with Errno::EBADF on mkmf.log. The same build passes on the microVM's tmpfs, so on Token Factory Teire builds gems there and copies them into place.
Verification
Two sandboxes from the same commit, your own checks with the network off, compared check by check and by test counts. Rules decide the evidence, never a model.
Security and trust
Your code runs only in an isolated sandbox with the network off for checks. No secret enters it. Only Nemotron on Token Factory reads code, and nothing reaches your default branch without your merge.