Security
Safe to hand to an agent. With keys, allowlists, and no runaway machines.
Each agent runs in a VM of its own, with its own kernel. You decide what it may reach, and the rule is kept on the server, outside the VM, where its code cannot change it.
Decide what it may reach.
A template holds the sandboxes on it to a rule about what leaves them: everything, nothing, or a list of addresses. A sandbox can add addresses of its own.
- Enforced on the server, outside the virtual machine. Nothing running in the sandbox can change it, root included.
- A sandbox made from the template is held from its first boot, so it never runs open first. Running ones take a change when you apply it, without a restart.
- A sandbox's own addresses add to its template's rule and take nothing away. They hold at once, running or stopped.
- What a rule refuses is refused at once, so a program is told and does not hang.
- It is about what leaves. Commands, files, public URLs and SSH still reach the sandbox.
- A list takes IPv4 addresses and ranges, 100 at most for a sandbox. Names are not taken.
EverythingNothingA list
github.comregistry.npmjs.orgpypi.orgapi.openai.com
Held on the server, outside the VM: root in the sandbox cannot change it.
Keep the key out of the sandbox.
Its commands see a stand-in. The server it runs on puts the real value in only on HTTPS requests to the hosts you name.
- Send it only to the hosts you list: up to 10 names, such as api.github.com, or a wildcard, such as *.example.com.
- It goes into the headers and the URL, Basic credentials included, so git push over HTTPS works. In what comes back, the value is turned into the stand-in again.
- Sent anywhere else, or over plain HTTP, the stand-in is worth nothing. Every other connection passes through untouched and is never decrypted.
- The value is never shown again, to anyone, you included. It is never on the sandbox's disk, so snapshots and forks hold only the stand-in.
- The stand-in stays the same when you replace the value, so .npmrc and ~/.git-credentials keep working, and a running agent picks up the new key without a restart.
- Listing a host does not open the outbound rule: a template that blocks everything still blocks it.
- It costs nothing, on every plan.
GITHUB_TOKENkept out · github.com, api.github.com
NPM_TOKENin the sandbox
$ echo $GITHUB_TOKEN
agental_hidden_7hq2xk9mw4rz3st8vn1bq5c0dle6fy2p
$ gh repo clone acme/app
✓ cloned: the real key was added on the way out
Give each agent a key that can do only its job.
A key says what it may do, which sandboxes it reaches, when it stops working and where it may be used from.
- Four ready sets, read-only, full-sandbox, ci and admin, or any of 28 actions. A key keeps what it was made with.
- Limit it to some sandboxes or templates. Everything else of the account answers as if it were not there. It always reaches the sandboxes it makes.
- Limit where it may be used from, by IPv4 and IPv6 addresses and ranges, 100 at most. The list is the one thing that can change later.
- Give it a last day, or none. See when each key was last used, and from where.
- A key makes only keys weaker than itself. A refusal says why: expired, the address it came from, or the action the key lacks.
Nameci-runner
Maycreate, exec, ssh
Sandboxesonly its own
Last day31 Dec 2026
From10.0.0.0/8
Safe to hand to an agent.
Agents retry, crash and forget. The API is built so that none of that costs you a second machine.
- Every create carries an Idempotency-Key: a retry returns the same sandbox.
- A create that times out halfway is adopted, never orphaned.
- A delete has to name the sandbox twice, so none happens by accident.
POST /v1/sandboxes
Idempotency-Key: task-42
201 · sbx_7f3e2a9c41d0b8e6
POST /v1/sandboxes
Idempotency-Key: task-42
200 · sbx_7f3e2a9c41d0b8e6 · the same one
Also part of Security:Templates and secrets, written up under Persistence
The five pillars
All features, on one page→Give your agent somewhere to work.
Free to start, with +$10 credit.