Sandboxes
Sandboxes
Section titled “Sandboxes”A sandbox is an isolated Linux container where your agent runs shell commands, reads and writes files, and drives a Chromium browser. Sandboxes are the compute environment behind coding, browser automation, and file-based workflows.
Key behavior: Each agent gets one reused sandbox session per organization. Files and environment state in /workspace carry over between runs until the session is stopped or restored from a snapshot.
What’s inside a sandbox
Section titled “What’s inside a sandbox”- Filesystem — read/write under
/workspace - Terminal — bash shell for commands and scripts
- Browser — Chromium for navigation and Computer Use (when the Browser capability is enabled)
- Network — outbound access for APIs, git, and web requests
Sandboxes run on GKE Autopilot (GCP), orchestrated by the device-service control plane.
Session lifecycle
Section titled “Session lifecycle”| Stage | What happens |
|---|---|
| First tool call | Agent acquires a sandbox on first sandbox/browser/shell tool use (lazy creation) |
| Reuse | Subsequent runs for the same agent reuse the existing session |
| Locking | One run at a time per agent — concurrent runs are serialized |
| Snapshots | Filesystem snapshots support restore after restarts (idle snapshot policy applies) |
| Stop | Sessions can be stopped from the workspace; workspace state may be restored from snapshot on next acquire |
Capabilities in the Console
Section titled “Capabilities in the Console”Enable sandbox access per agent under Capabilities:
- Run code / shell in a sandbox — file ops, git, terminal
- Drive a real browser (Chromium) — browser automation and Computer Use
Internal agents include both by default. Customer-facing agents do not receive sandbox or browser tools.
Undoing what the agent changed
Section titled “Undoing what the agent changed”Every file the agent edits directly is recorded with the version that was there before, so you can put any of it back — one file, a whole run, or every file changed since a particular message. The sandbox panel also names the conversation currently holding the sandbox, and tells you what did and didn’t survive when a session is restored from a snapshot.
Agents working in a code repository can each have their own branch per conversation, with Apply to main workspace and Discard branch in the Git tab.
See Undo & branches.
Security boundary
Section titled “Security boundary”The sandbox container is the security boundary. Destructive host operations (sudo, rm -rf /, etc.) are blocked. The sandbox cannot reach your local machine or private network unless you configure integrations for that purpose.
Bring your own computer
Section titled “Bring your own computer”On paid plans, Internal agents can use your own Ubuntu/Debian machine as the sandbox instead of the managed cloud container — your environment, your credentials, your network egress, plus optional residential-IP web fetch. See Bring Your Own Computer.