sandboxd

Sandbox execution service for AI agents.

The service token can start containers on the host, so treat it as a root credential. Only use this page over localhost or a private network.

sandboxd
connecting

  • Sessions

    –

     

  • Memory in use

    –

    across live sandboxes

  • Processes

    –

    summed across sandboxes

  • Runtimes allowed

    –

    on the server-side allowlist

Open sessions

— set per runtime by the operator, not per session. Pick a different runtime to change them.

Session Runtime Tenant State Idle Memory PIDs Actions

No open sessions.

Create one here, or let an agent open its own.

No session selected.

Pick one on the Sessions tab to get a terminal, its files and its activity.

Each command is its own process — a cd does not carry to the next one. Chain with && instead.

Source 


                

              

            

          


          
          

            

              Every operation on this sandbox, an agent's included. Payloads are never
              recorded — only what was addressed and how it went. The service keeps the
              most recent 200 entries per session.
            

            

          


          
          

            

          

        

      

    


    
    

      

        

          
Runtime allowlist

          

          a request may name an alias, nothing else
        

        

          

            A client picks one of these by name. The image, the ceilings and whether the
            sandbox gets a network are the operator's decision, per runtime — which is what
            stops a caller from running an image of its choosing.
          

          

        

      


      

        

          
Where these are set

          

          read-only here, on purpose
        

        

          

            Memory, CPU, processes and network come from SandboxdConfig
            where the service is started — per runtime through
            SandboxRuntime, and service-wide as the default any runtime
            that names none inherits. Changing one is a config change and a restart, deliberately:
            a ceiling edited in a browser would revert on the next restart with nobody able to say
            why. This page shows what is in force, not a form.
          

          
SandboxdConfig(
    token=...,
    runtimes={
        "python": SandboxRuntime(
            image="python:3.12-slim",
            mem_limit="1g", cpus=1.0, pids_limit=512,
        ),
        "datascience": SandboxRuntime(
            runtime="python-datascience",  # built on first use
            mem_limit="4g", cpus=2.0,
        ),
        "scraping": SandboxRuntime(
            runtime="python-scraping",
            network_mode="bridge",   # the one runtime given the network
        ),
    },
    default_runtime="python",
    # Defaults for any runtime above that names none of its own.
    mem_limit="1g", cpus=1.0, network_mode="none",
    # What actually bounds the host: this times the largest runtime ceiling.
    max_sessions=20,
)

          

            A service-wide value is a default, not a maximum — a runtime may name
            more. There is also SUGGESTED_RUNTIMES, a fuller catalogue to
            adopt or copy from.
          

        

      


      

        

          
Service policy

          

          defaults, and the limits nothing can raise