Runs code in a local Podman or Docker container, so
nothing leaves the machine and no account is needed.
Each sandbox is one long-lived container (so files persist between calls in a run), started with
no network, dropped capabilities, no-new-privileges, and memory, CPU and process limits. Code
is piped to the interpreter over stdin, never interpolated into a command line. A call that
exceeds runTimeoutMs has its processes killed; files in the workdir survive.
The container is a strong boundary, but it is on your machine: mount only what the code needs,
keep secrets out of env, and leave network at 'none' unless the task requires more.
Runs code in a local Podman or Docker container, so nothing leaves the machine and no account is needed.
Each sandbox is one long-lived container (so files persist between calls in a run), started with no network, dropped capabilities,
no-new-privileges, and memory, CPU and process limits. Code is piped to the interpreter over stdin, never interpolated into a command line. A call that exceedsrunTimeoutMshas its processes killed; files in the workdir survive.The container is a strong boundary, but it is on your machine: mount only what the code needs, keep secrets out of
env, and leavenetworkat'none'unless the task requires more.