sanbox

Give every agent
its own world.

Sanbox is a self-hostable execution plane for AI agents. Fan work out into isolated runtimes, see what every agent does, and bring back only the artifacts you asked for.

Request access See the run model
4 sandboxes running
CONTROL PLANE sanbox
FFinancialsGPT 5.6
18 reports checked03:12
CContract risksGLM-OCR
12 clauses flagged02:47
MMarket scanKimi 2.7
36 sources read04:08
SSecurity postureGLM 5.2
8 controls checked01:54
Goal: evaluate an acquisition.Four agents. Four isolated workspaces.

01 / The premise

Agents need more
than a prompt.

Useful agents need files, tools, credentials, state, and network access. That makes the environment around the model part of the product and part of the risk.

Sanbox turns each delegation into a run-shaped contract: selected inputs, an approved template, explicit policy, retained outputs, and an execution trail.

01Delegatetask + inputs
→
02Containruntime + policy
→
03Observeevents + effects
→
04Returnartifacts + evidence

02 / Orchestrate

Fan out without
losing the plot.

One clean CLI for dispatch, live activity, and outputs. It works from your terminal, CI, or coding agent.

~/product ⌁ sanbox
connected to eu-central-01 policy / engineering-default
↗

Agent-native onboardingsanbox init adds the right instructions for coding agents.

⌘

Portable run bundlesInspect exactly which task and files leave your machine.

◫

Retained workspacesReview results, continue a run, or collect artifacts later.

03 / Run controls

Set the limits before
the agent starts.

Each run starts from an approved template with configured CPU, memory, and timeout limits. It gets its own workspace, while Sanbox records tool calls, file changes, model usage, and status.

RUN / 8fc2 · opencode-runner running

RUN SETTINGS

Templateopencode-runner
Modelkimi-k2.7-code
CPU2
Memory4 GB
Timeout15 min
Retention24 h
ROOTLESS PODMAN
READ-ONLY ROOTFS
RETAINED WORKSPACE
run 8fc2
no-new-privileges on capabilities none /workspace/output write

RUN EVENTS

  1. harness.input.readyInput dossier extracted
  2. agent.turn.startedAgent turn started
  3. agent.tool.completedrg "refreshToken" src/
  4. agent.file.changedModified src/auth/session.ts
  5. agent.usage.updated1,834 input · 412 output
  6. run.completedSandbox run completed

04 / Capability map

One plane.
Every boundary.

01

Fan-out CLI

Delegate parallel work from any coding agent, terminal, or CI job. Package only the files each run needs.

02

Model-selectable runners

Choose from supported models in the OpenCode runner today, with a stable adapter contract for more agents and endpoints.

03

Run templates

Register an approved OpenCode image, model, limits, and web-tool policy for repeatable agent work.

04

MicroVM isolation

A provider path from hardened containers to dedicated guest kernels for stronger multi-tenant isolation.

05

Network ACL

Default-deny egress with explicit destination grants, private-IP blocking, and decisions tied back to a run.

06

Scoped secrets

Keep long-lived credentials outside the sandbox. Issue only the capability and lifetime a run requires.

07

Run event stream

Keep agent turns, tool calls, file changes, model usage, logs, and output references in the run record.

05 / Sovereignty

Your metal.
Your cloud.
Your rules.

Run Sanbox where your data belongs. Keep the control plane, workspaces, credentials, and audit trail inside infrastructure you govern.

Dedicated deployment on EU infrastructure, operated with you.

EU / CUSTOMER BOUNDARY
1Your teamCLI · API · console
sanboxcontrol plane
3Runnersisolated · ephemeral

Germanyeu-central · dedicated host

06 / Built in

The complete
run loop.

Sanbox handles the work around the model, from packaging context and launching isolated runners to governing access, streaming activity, and retaining results.

ORCHESTRATE

Fan out from one command.

Launch one task or a bounded parallel task list from your terminal, CI, or coding agent. Include only the files each run needs.

ISOLATE

A workspace for every agent.

Run each task in its own resource-bounded workspace, with a provider path from hardened containers to microVM-backed isolation.

CONFIGURE

Bring your model and template.

Use OpenCode with your preferred model and reusable templates for tools, permissions, and resource defaults.

CONTROL

Fix the limits up front.

Set CPU, memory, timeout, workspace retention, and approved runner defaults for each run.

OBSERVE

See what the runner did.

Stream agent turns, tool calls, file changes, model usage, logs, and errors as they happen.

RETAIN

Keep the result inspectable.

Keep artifacts, logs, state, and the workspace available for inspection, continuation, or export.

AGENT EXECUTION PLANE

Put agents to work.
Keep the boundary.

We’re working with teams that want useful agent automation without handing the operating model to a black box.

Talk to us