LOGSandbox0 field notes
Engineering & Updates
Architecture decisions, release notes, and deep dives from the Sandbox0 team.
- Dispatches
- 16
- Latest
- July 31, 2026
IDXArticle index
More from the build log
15 archived dispatches
How We Cut gVisor Metrics CPU by 72% at 424 Sandboxes
At high sandbox density, every CRI stats request launched a runsc subprocess before calling an existing gVisor control RPC. This post explains how Sandbox0 removed that process boundary, kept the same metrics contract, and reduced average node CPU from 60.68% to 16.70% in a matched production comparison.
Mount an S3 Bucket in an AI Agent Sandbox
Sandbox0 now supports S3 backend Volumes for mounting an existing S3-compatible bucket prefix into an agent sandbox. This post explains when to use the S3 backend, how it differs from S0FS, and what filesystem semantics to expect.
Vercel Eve Sandbox Backend: Run Eve Agents on Sandbox0
Vercel Eve makes the sandbox backend pluggable. This guide shows how to use Sandbox0 as an Eve SandboxBackend with @sandbox0/eve, including prewarm snapshots, durable session metadata, file and command APIs, and network policy boundaries.
Initialize Once, Claim Many: Custom AI Agent Sandboxes on Sandbox0
Custom AI agent environments do not always need a custom template and a dedicated warm pool. Sandbox0 rootfs snapshots and claim-time snapshot IDs let teams start from a builtin template, initialize the writable filesystem once, and claim fresh running sandboxes from that state.
Deploy OpenClaw and Hermes Agent in a Sandbox0 Sandbox
OpenClaw and Hermes Agent are usually deployed on a laptop, Docker host, VPS, or Kubernetes cluster. This post explains the Sandbox0 agent-in-sandbox pattern: run the agent gateway inside a sandbox, keep state on persistent volumes, expose routes through Sandbox Services, and enforce network and credential boundaries outside the agent process.
Docker in Sandbox: Run Docker Inside an AI Agent Sandbox with Sandbox0
Sandbox0 Docker in Sandbox lets AI agents run Redis, Postgres, Docker builds, and containerized test workflows inside an isolated sandbox without depending on the host Docker daemon.
Sandbox Functions: Keep Coding Agent Repositories Warm
Sandbox Functions turn a sandbox into a webhook target without running a long-lived HTTP server. This post introduces the feature through a coding-agent workflow: keep a repository Volume refreshed from GitHub webhooks, publish snapshots, then create per-task Volumes from those snapshots when agent tasks start.
MCP Tool Access Control: Restrict Which Tools AI Agents Can Call
MCP makes it easy to connect agents to tools, but production teams need runtime enforcement for which tools can actually execute. Sandbox0 Protocol Controls add MCP tool allowlists and denylists at the sandbox network boundary.
Sandbox0 Volumes: Turning S3 into Persistent Workspaces for AI Agents
S3 is the right durable storage layer for cloud-native agent infrastructure, but it is the wrong interface for an AI agent workspace. This post explains why Sandbox0 built S0FS on top of object storage, what problems showed up in the first JuiceFS-based design, and how node-local volume portals improved small-file performance for agent workloads.
Encrypted Persistent Storage for AI Agents: How Sandbox0 Volumes Store, Snapshot, and Protect Agent State
AI agents need durable workspaces, but durable workspaces create a new security surface. This post explains how Sandbox0 Volumes separate storage from sandbox lifecycle, how S0FS stores manifests and segments, and how application-layer encryption protects persisted objects and node-local cache files.
Claude Code SDK Deployment Modes: Ephemeral, Long-Running, and Hybrid
Anthropic now calls it the Claude Agent SDK, but many developers still search for Claude Code SDK. This post separates three deployment modes from a second, independent decision: whether the Claude runtime lives in the same environment as your app or behind a control and execution boundary.
Direct File Operations for AI Agent Storage over HTTP, SDK, and CLI
Not every file operation in an AI agent system should require mounting a volume into a running sandbox. Sandbox0 lets you read, write, list, stat, move, delete, upload, download, and watch volume files directly by volume ID over raw HTTP, SDK helpers, and the s0 CLI.
AI Hallucinated Links: Building a Semantic 404 Resolver for AI Agents
AI agents often request plausible-but-wrong URLs like /docs/self-hosting or /docs/deploy/single-cluster and land on a 404 page. This post explains why static redirect tables do not scale, and how to build a local semantic 404 resolver that maps hallucinated links to the most likely canonical page without creating soft 404s.
API Key Security for AI Agents: How to Keep Secrets Out of the Sandbox
The standard advice for AI agent API key security is to use a local proxy that swaps fake tokens for real ones. Sandbox0 goes further: credentials are injected at the kernel network layer, so the agent process never holds a token — real or phantom.
Persistent Storage for AI Agent Sandboxes: Volumes, Copy-on-Write Forks, and Snapshots
AI agent sandboxes are ephemeral by default — when the container stops, the workspace is gone. Sandbox0 volumes are persistent storage units decoupled from sandbox lifetime: POSIX-native, mountable across multiple sandboxes simultaneously, and forkable with copy-on-write isolation for parallel agent workloads.