Sandbox

A sandbox is an isolated environment where code you don't fully trust can run without reaching the host it runs on, other workloads, or networks it has no business with. When an AI agent writes code, the code it writes, and the packages it installs, belong in that category.

What it is

Isolation is a set of limits, and a good sandbox applies several:

• Process: no root, no extra Linux capabilities, no way to gain privileges.
• Resources: caps on CPU, memory, disk and run time, so one job can't starve others.
• Credentials: no tokens for the platform it runs on.
• Network: outbound traffic limited by an egress policy, or cut off entirely.

Containers, Kubernetes pods, lightweight VMs and in-browser runtimes are common ways to build one.

Why it matters

Running a change's tests means running its code, and installing its dependencies runs their install scripts. Without a sandbox, a malicious package or an injected instruction gets whatever access the build machine has.

In AI CodeOps

On the hosted platform, each terminal and each test run gets its own Kubernetes pod. The pod runs as a non-root user with every Linux capability dropped and privilege escalation blocked. It gets no service-account token, and it has CPU, memory, disk and lifetime limits.

To test a change, the session installs your dependencies, then cuts the pod off the network and confirms it's offline before your test command runs. If it can't isolate the pod, the change isn't run.