Quick Start
Create a sandbox from an image:Provide exactly one start source when creating a sandbox:
imageName or snapshotName.Start From a Snapshot
Start a new sandbox from a memory snapshot:Configuration Options
Customize the sandbox region, timeout, and recording settings:Resource Configuration
Set vCPU, memory, and disk size when launching from an image:For image launches, the default resource configuration is
2 vCPUs,
2048 MiB of memory, and 8192 MiB of disk if you omit these fields.Resource configuration is only supported when started from an image.
Snapshot launches use the snapshot’s saved resource baseline.
Mount Volumes
Attach persistent volumes at sandbox launch using themounts field.
See Managing Volumes and
Mounting Volumes for API details and mount
constraints.
Common Parameters
string
Name of the sandbox image to start from. Provide this or
snapshotName.
See Base Images for built-in values.string
Optional specific image ID. Requires
imageName.number
Requested vCPU count for image launches. In the raw API, this field is
vcpus.number
Requested memory in MiB for image launches. In the raw API, this field is
memMiB.number
Requested disk size in MiB for image launches. In the raw API, this field is
diskSizeMiB.string
Name of the snapshot to restore from. Provide this or
imageName.string
Optional specific snapshot ID. Requires
snapshotName.string
default:"us"
Region where the sandbox should start.
number
Maximum sandbox lifetime in minutes.
boolean
default:false
Enable sandbox recording.
object
Optional raw-API map of mount path to volume reference. Each key is the mount
path inside the sandbox (for example
/mnt/workspace). Each value includes:
id (volume UUID), type (rw or ro, default rw), and optional
shared (currently reserved). This is available in the SDKs, via REST, and
via CLI mount flags.boolean
default:true
Sets the fallback for outbound destinations that do not match an allow or
deny rule. Set it to
false for a default-deny policy.string[]
IPv4 addresses, IPv4 CIDRs, exact domains, or wildcard domains to allow.
string[]
IPv4 addresses or IPv4 CIDRs to deny. See
Network Policies for precedence and domain rules.
Sandbox Response
The create API returns a detailed sandbox object:string
Unique sandbox identifier.
string
Current sandbox status.
string
Region where the sandbox is running.
string
Dashboard URL for the sandbox.
object
Runtime target used for direct runtime operations. Includes
transport,
host, and baseUrl.object
Effective outbound network policy. Includes
allowInternetAccess,
allowOut, and denyOut.string | null
Sandbox runtime bearer token.
string | null
Token expiration time in ISO 8601 format.
Explore Sandbox Features
Lifecycle
Lifecycle
Manage running sandboxes, refresh handles, reconnect, and stop them cleanly
with Sandbox Lifecycle.
Runtime URLs and Exposed Ports
Runtime URLs and Exposed Ports
Expose HTTP services, understand how sandbox URLs route to ports, and use
authenticated browser access with
Sandbox Runtime URLs.
Network Policies
Network Policies
Restrict outbound traffic with IPv4, CIDR, and domain rules using
Network Policies.
Processes
Processes
Run one-shot commands, start background work, stream output, and manage
process state with Sandbox Processes.
Local Filesystem
Local Filesystem
Read, write, watch, upload, download, and presign file transfers with
Local Filesystem.
Volumes
Volumes
Create persistent volumes and mount them at launch with
Volumes.
Snapshots
Snapshots
Capture memory state and restore new sandboxes from it with
Sandbox Snapshots.