Skip to main content
Sandboxes are isolated cloud environments built to scale with your agentic needs. Sandboxes have real runtime urls that you can call to run any kind of workflow you need. Batteries are included.
Get started instantly with common use cases covered by Base Images. For more custom use cases, learn how to Build And Upload A Custom Image.

Quick Start

Create a sandbox from an image:
Provide exactly one start source when creating a sandbox: imageName or snapshotName.

Start From a Snapshot

Start a new sandbox from a memory snapshot:

Configuration Options

Customize the sandbox region, timeout, and recording settings:

Resource Configuration

Set vCPU, memory, and disk size when launching from an image:
For image launches, the default resource configuration is 2 vCPUs, 2048 MiB of memory, and 8192 MiB of disk if you omit these fields.
Resource configuration is only supported when started from an image. Snapshot launches use the snapshot’s saved resource baseline.

Mount Volumes

Attach persistent volumes at sandbox launch using the mounts field.
See Managing Volumes and Mounting Volumes for API details and mount constraints.

Common Parameters

string
Name of the sandbox image to start from. Provide this or snapshotName. See Base Images for built-in values.
string
Optional specific image ID. Requires imageName.
number
Requested vCPU count for image launches. In the raw API, this field is vcpus.
number
Requested memory in MiB for image launches. In the raw API, this field is memMiB.
number
Requested disk size in MiB for image launches. In the raw API, this field is diskSizeMiB.
string
Name of the snapshot to restore from. Provide this or imageName.
string
Optional specific snapshot ID. Requires snapshotName.
string
default:"us"
Region where the sandbox should start.
number
Maximum sandbox lifetime in minutes.
boolean
default:false
Enable sandbox recording.
object
Optional raw-API map of mount path to volume reference. Each key is the mount path inside the sandbox (for example /mnt/workspace). Each value includes: id (volume UUID), type (rw or ro, default rw), and optional shared (currently reserved). This is available in the SDKs, via REST, and via CLI mount flags.
boolean
default:true
Sets the fallback for outbound destinations that do not match an allow or deny rule. Set it to false for a default-deny policy.
string[]
IPv4 addresses, IPv4 CIDRs, exact domains, or wildcard domains to allow.
string[]
IPv4 addresses or IPv4 CIDRs to deny. See Network Policies for precedence and domain rules.

Sandbox Response

The create API returns a detailed sandbox object:
string
Unique sandbox identifier.
string
Current sandbox status.
string
Region where the sandbox is running.
string
Dashboard URL for the sandbox.
object
Runtime target used for direct runtime operations. Includes transport, host, and baseUrl.
object
Effective outbound network policy. Includes allowInternetAccess, allowOut, and denyOut.
string | null
Sandbox runtime bearer token.
string | null
Token expiration time in ISO 8601 format.

Explore Sandbox Features

Manage running sandboxes, refresh handles, reconnect, and stop them cleanly with Sandbox Lifecycle.
Expose HTTP services, understand how sandbox URLs route to ports, and use authenticated browser access with Sandbox Runtime URLs.
Restrict outbound traffic with IPv4, CIDR, and domain rules using Network Policies.
Run one-shot commands, start background work, stream output, and manage process state with Sandbox Processes.
Read, write, watch, upload, download, and presign file transfers with Local Filesystem.
Create persistent volumes and mount them at launch with Volumes.
Capture memory state and restore new sandboxes from it with Sandbox Snapshots.