LOGSandbox0 field notes
Engineering & Updates
Architecture decisions, release notes, and deep dives from the Sandbox0 team.
- Dispatches
- 11
- Latest
- September 22, 2026
IDXArticle index
More from the build log
10 archived dispatches
A Sandbox Is Not a Container: Inside Sandbox0's New Nomad Architecture
Sandbox0 now separates durable sandbox identity and encrypted block-COW RootFS state from disposable Nomad workers. This post explains the carrier pool, claim-time resource leases, stock gVisor isolation, and failure boundaries behind the redesign.
Meet Sandpi: A Persistent Cloud Workspace for Coding Agents
Sandpi is our open-source side project for running native Codex sessions inside persistent Sandbox0 Environments. Here is why we built it, how it preserves the native agent experience, and what becomes possible when the session, workspace, browser, and security boundary all live in the cloud.
How We Cut gVisor Metrics CPU by 72% at 424 Sandboxes
At high sandbox density, every CRI stats request launched a runsc subprocess before calling an existing gVisor control RPC. This post explains how Sandbox0 removed that process boundary, kept the same metrics contract, and reduced average node CPU from 60.68% to 16.70% in a matched production comparison.
Vercel Eve Sandbox Backend: Run Eve Agents on Sandbox0
Vercel Eve makes the sandbox backend pluggable. This guide shows how to use Sandbox0 as an Eve SandboxBackend with @sandbox0/eve, including prewarm snapshots, durable session metadata, file and command APIs, and network policy boundaries.
Initialize Once, Claim Many: Custom AI Agent Sandboxes on Sandbox0
Custom AI agent environments do not always need another template artifact. Sandbox0 rootfs snapshots and claim-time snapshot IDs let teams start from a compatible template, initialize the writable filesystem once, and claim fresh running sandboxes from that state.
Docker in Sandbox: Run Docker Inside an AI Agent Sandbox with Sandbox0
Sandbox0 Docker in Sandbox lets AI agents run Redis, Postgres, Docker builds, and containerized test workflows inside an isolated sandbox without depending on the host Docker daemon.
MCP Tool Access Control: Restrict Which Tools AI Agents Can Call
MCP makes it easy to connect agents to tools, but production teams need runtime enforcement for which tools can actually execute. Sandbox0 Protocol Controls add MCP tool allowlists and denylists at the sandbox network boundary.
Claude Code SDK Deployment Modes: Ephemeral, Long-Running, and Hybrid
Anthropic now calls it the Claude Agent SDK, but many developers still search for Claude Code SDK. This post separates three deployment modes from a second, independent decision: whether the Claude runtime lives in the same environment as your app or behind a control and execution boundary.
AI Hallucinated Links: Building a Semantic 404 Resolver for AI Agents
AI agents often request plausible-but-wrong URLs like /docs/self-hosting or /docs/deploy/single-cluster and land on a 404 page. This post explains why static redirect tables do not scale, and how to build a local semantic 404 resolver that maps hallucinated links to the most likely canonical page without creating soft 404s.
API Key Security for AI Agents: How to Keep Secrets Out of the Sandbox
The standard advice for AI agent API key security is to use a local proxy that swaps fake tokens for real ones. Sandbox0 goes further: credentials are injected at the kernel network layer, so the agent process never holds a token — real or phantom.