What is Sandbox?
Also called sandboxing, isolated execution environment.
A sandbox is an isolated environment in which code runs with restricted access to the surrounding system, so that whatever happens inside cannot damage or reach what lies outside. Isolation typically covers the file system, the network, other processes, and resource consumption. It is the standard containment measure for running untrusted code or agent generated commands.
Implementations differ in strength. Operating system features such as process isolation and system call filtering are lightweight. Containers add namespacing and are convenient but share the host kernel. Virtual machines and lightweight micro virtual machines provide a stronger boundary at higher cost. Language level environments, such as WebAssembly runtimes, isolate at a different layer with their own tradeoffs.
For agents, the sandbox is what makes autonomy affordable. If generated code runs somewhere disposable, with no production credentials and no route into internal systems, a wrong command costs a rebuild rather than an incident. It also allows a much lighter approval regime, because far fewer individual actions need a person to review them first.
The most consequential error is assuming a container is a security boundary against hostile code by default. Shared kernels, mounted host paths, unrestricted outbound network access, and credentials inherited from the environment each undo the isolation. Untrusted workloads usually warrant a stronger boundary, and every sandbox needs its network egress considered explicitly, since exfiltration does not require breaking out.
A practical sandbox is disposable, minimal, and rebuilt from a definition rather than maintained by hand. Give it only the directories and secrets a task genuinely needs, cap processor time, memory, disk, and wall clock duration, deny outbound traffic except to an allow list, and destroy the whole environment when the task finishes.
Key points
- Isolated environment limiting file, network, process, and resource access.
- Strength varies: system call filters, containers, virtual machines.
- Containers alone are not a boundary against hostile code.
- Restrict network egress, since exfiltration needs no escape.
- Make sandboxes disposable, minimal, and time limited.
In practice
An agent that writes and runs data analysis scripts is given a container with the input file mounted read only, an output directory it can write to, no credentials in its environment, no outbound network access, half a gigabyte of memory, and a sixty second limit. A script with an infinite loop is killed on time, a script reaching for an external address fails, and the container is destroyed after every run.