A separate machine for code you do not trust.

Your app stays outside the machine

Untrusted code and agent tools run in a separate Linux machine for the job. They do not share a process with your application. When the job ends, the machine goes away with it.

• Time — stop the process when the budget is spent
• Memory — bound RAM for the machine
• Disk — bound the writable workspace
• CPU — size the machine for the workload

You set the limits when you provision the sandbox. The guest cannot raise them.

Closed by default. Open the hosts the job actually needs.

Egress is a policy you choose per sandbox: closed, a host allowlist, or open when the job truly needs the public internet. Keep model endpoints, package registries, and your own APIs as separate decisions — not one blanket “online” switch.

• Closed — no outbound path for the job
• Allowlist — only the hosts you name
• Open — full egress when you explicitly choose it

Names such as closed, allowlist, and open describe the choice. Whether the product exposes those names as presets is still to be confirmed.

The secret reaches the process. It does not travel in the command line.

Pass credentials in the process environment. Keep them out of argv and out of the command log your operators read. Your application decides which keys exist. The sandbox receives what you pass in. This page does not describe a secrets panel or a proxy outside the machine.

The model key follows the same rule: process environment, not the command line.

Files go in on purpose. Results come out on purpose.

Mount or upload inputs. Collect outputs as files or a directory when the job finishes. A volume can be detached and attached to the next machine when the workflow needs continuity without copying the whole tree every time. Cloud volume credentials are not returned in the SDK HTTP response.