Sandboxes
A sandbox is an isolated Linux container where your agent runs shell commands, reads and writes files, and drives a Chromium browser. Sandboxes are the compute environment behind coding, browser automation, and file-based workflows.
Key behavior: Each agent gets one reused sandbox session per organization. Files and environment state in /workspace carry over between runs. An idle sandbox pauses, and it resumes where it left off the next time the agent needs it.
What’s inside a sandbox
Section titled “What’s inside a sandbox”- Filesystem — read/write under
/workspace - Terminal — bash shell for commands and scripts
- Browser — Chromium for navigation and Computer Use (when the Browser capability is enabled)
- Network — outbound access for APIs, git, and web requests
Sandboxes are managed cloud containers: Auteryn runs them for you, and there is nothing to install or host.
Session lifecycle
Section titled “Session lifecycle”| Stage | What happens |
|---|---|
| Run start | Each run of an Internal agent starts getting its sandbox ready in the background, so it is usually ready by the first shell, file or browser step. A cold start shows Preparing computer… |
| Reuse | Subsequent runs for the same agent reuse the existing session |
| Locking | One run at a time uses the sandbox. Other conversations with the agent keep going; their sandbox steps wait for their turn |
| Pause | After 5 idle minutes the sandbox saves a checkpoint of its files and pauses with its open apps (see Pause and resume) |
| Resume | The next time the agent needs the sandbox, it resumes where it left off |
| Stop | Sessions can be stopped from the workspace; their files may come back from a checkpoint the next time the agent needs the sandbox. Save & stop pauses the sandbox the same way an idle pause does |
Pause and resume
Section titled “Pause and resume”An idle sandbox (the agent’s Computer in the workspace) pauses with its open apps. The next time the agent needs it, it resumes where it left off, and the workspace shows Restored as you left it.
The sandbox pauses after 5 minutes in which no run uses it. It stays awake while you watch it: the workspace is the tab in front in your browser, with the sandbox panel open on any tab except Canvas. Save & stop in the workspace pauses it the same way.
Kept across a pause
Section titled “Kept across a pause”- Open browser pages
- Running commands, including background ones such as a dev server
- Your files
Changed by a pause
Section titled “Changed by a pause”- Connections to other machines close during the pause: a download in progress has to start again, and an SSH session or a database connection has to reconnect.
- The clock jumps forward by the length of the pause.
- The sandbox gets a new IP address and hostname.
- Sign-ins that come from your Connections are put back when the sandbox resumes; a sign-in you made by hand has to be made again.
How long open apps are kept
Section titled “How long open apps are kept”A paused sandbox keeps its open apps for 7 days. Only the latest pause is kept: each new pause replaces the one before.
If the sandbox cannot resume with its open apps (after 7 days, or if the resume fails), it starts fresh with your files from the last checkpoint. The workspace then shows Restored your files. Open apps restarted. It also lists what did not come back (see Undo & branches).
In the workspace, click the pill at the right of the sandbox panel’s tabs (on a phone, tap Open the computer in the message box, then tap the pill at the top). Under Checkpoints, the checkpoint whose line ends apps and files is the one the next resume uses; the others say files only. Restore on any checkpoint brings back what it saved, never its open apps or running commands.
Disconnecting one of the agent’s Connections discards the open apps saved with its paused sandbox; the next resume brings back files only. Deleting the agent discards them too.
An agent that runs on your own machine does not pause this way.
Capabilities in the Console
Section titled “Capabilities in the Console”An Internal agent always has a sandbox: its Computer section shows it as always on, with no switch. Under Capabilities you choose what it does there:
- Coding — repository-aware code editing with developer tooling on the agent’s computer
- Browser — navigate and act on web pages, including Computer Use
Changing either restarts the agent’s computer. Customer-facing agents can’t use a sandbox or a browser.
Undoing what the agent changed
Section titled “Undoing what the agent changed”Every file the agent edits directly is recorded with the version that was there before, so you can put any of it back, from one file up to every file changed since one of your messages. The workspace also shows which conversation is holding the sandbox, and tells you what did and didn’t survive when a session is restored from a snapshot.
Agents working in a code repository can each have their own branch per conversation, with Apply to main workspace and Discard branch in the sandbox panel’s git tab.
See Undo & branches.
Security boundary
Section titled “Security boundary”The sandbox container is the security boundary. Destructive host operations (sudo, rm -rf /, etc.) are blocked. The sandbox cannot reach your local machine or private network unless you configure integrations for that purpose.
Your own machine
Section titled “Your own machine”On paid plans, Internal agents can run on your own Ubuntu or Debian machine instead of the managed cloud container, working in your repository with your own tools. On Business and Enterprise they can also read the web through your machine’s connection. See Run agents on your machine.