# Sandbox0

Sandbox0 is AI agent infrastructure with sandbox execution, persistent workspaces, network control, and fast runtime startup.

## s0 CLI

When a user asks you to set up Sandbox0, install the `s0` CLI if it is not already available, use it for Sandbox0 operations, and consult the agent-readable docs below as needed.

Install on Linux or macOS:

```bash
curl -fsSL https://raw.githubusercontent.com/sandbox0-ai/s0/main/scripts/install.sh | bash
```

Install on Windows PowerShell:

```powershell
irm https://raw.githubusercontent.com/sandbox0-ai/s0/main/scripts/install.ps1 | iex
```

Install with Go:

```bash
go install github.com/sandbox0-ai/s0/cmd/s0@latest
```

Authenticate with `s0 auth login` for interactive CLI use. The CLI starts device login; ask the user to approve it when required. If no team is selected after login, run `s0 team list` and `s0 team use <team-id>`. For SDK or raw HTTP automation, create an API key with `s0 apikey create --name <name> --role developer --raw` and pass it as `SANDBOX0_TOKEN`.

## Products

- [sandbox](https://sandbox0.ai/docs/sandbox) - docs: https://sandbox0.ai/docs/sandbox.md

## Docs

Docs links below point to raw MDX `.md` pages for AI agents. Each description is extracted from the page introduction. Remove `.md` for the human-readable HTML page.

### sandbox / GET STARTED

- [Overview](https://sandbox0.ai/docs/sandbox/get-started.md): Sandbox0 provides isolated execution environments for AI agents with a persistent sandbox root filesystem across pause/resume, named rootfs snapshots, session state maintenance, and fast warm claims. Sandbox0 Cloud uses https://api.sandbox0.ai for sandboxes, templates, and credentials.
- [Concepts](https://sandbox0.ai/docs/sandbox/get-started/concepts.md): This page explains Sandbox0 from an AI agent developer perspective: how to think about runtime state, isolation, and long-running workflows.

### sandbox / SANDBOX

- [Overview](https://sandbox0.ai/docs/sandbox.md): A Sandbox is an isolated execution environment where you can run code, manage files, and control network access. Each sandbox is created from a Template and has a writable root filesystem that is checkpointed across pause/resume for the same sandbox identity.
- [Observability](https://sandbox0.ai/docs/sandbox/observability.md): Sandbox0 provides runtime metrics, historical logs, and a signed audit ledger for each sandbox. These APIs read historical data without waking a paused sandbox.
- [Pause And Resume](https://sandbox0.ai/docs/sandbox/pause-resume.md): Sandbox0 can release runtime compute without deleting a sandbox. By default, pause publishes the writable block-COW RootFS head and retires the current runtime allocation. Resume claims a fresh resource-neutral carrier and starts a new runtime generation from the latest committed head.
- [Snapshot And Restore](https://sandbox0.ai/docs/sandbox/snapshot-restore.md): Sandbox rootfs snapshots are point-in-time copies of a sandbox writable root filesystem. Use them when you want to checkpoint an initialized workspace, claim new sandboxes from that known filesystem state, roll an existing sandbox back, or fork a sandbox into an isolated child sandbox.
- [Contexts](https://sandbox0.ai/docs/sandbox/contexts.md): Contexts are execution units within a sandbox. Each context runs a process and can be either a REPL (stateful) or Cmd (stateless) type.
- [Supervised Sessions](https://sandbox0.ai/docs/sandbox/session-supervisor.md): A supervised session runs a process as a sandbox-owned resource instead of tying the process to one client connection. The session keeps a stable identity and a replayable event journal while its current operating-system process is represented by an attempt.
- [Files](https://sandbox0.ai/docs/sandbox/files.md): Manage files and directories within a sandbox. The Files API provides full POSIX file operations including read, write, delete, move, and real-time file watching.
- [SSH](https://sandbox0.ai/docs/sandbox/ssh.md): Use standard SSH clients to open a shell inside a sandbox or copy files with scp. Sandbox0 terminates SSH at a region-scoped ssh-gateway, authenticates the user from uploaded SSH public keys, and bridges the session into the sandbox runtime.
- [Network](https://sandbox0.ai/docs/sandbox/network.md): SandboxNetworkPolicy controls outbound traffic for a sandbox.
- [Protocol Controls](https://sandbox0.ai/docs/sandbox/protocol-controls.md): egress.protocolRules adds protocol-aware controls after outbound traffic is allowed by trafficRules.
- [Egress Proxy](https://sandbox0.ai/docs/sandbox/proxy.md): Sandbox egress proxy routes allowed outbound TCP traffic through a customer-managed SOCKS5 proxy.
- [Sandbox Services](https://sandbox0.ai/docs/sandbox/services.md): Sandbox Services expose public HTTP entrypoints for workloads inside a sandbox. A service can point to a long-running listener on a sandbox port, start a command on first public access, or route to a Sandbox Function.
- [Private Previews](https://sandbox0.ai/docs/sandbox/previews.md): Private previews let an authenticated client open an HTTP server that listens only on sandbox loopback addresses. They are intended for IDE and agent-product preview panes, not for publishing an application.
- [Docker in Sandbox](https://sandbox0.ai/docs/sandbox/docker-in-sandbox.md): Docker in Sandbox lets a Sandbox0 Cloud sandbox run a Docker daemon inside the sandbox. Use it when a coding agent or test workflow expects Docker commands such as docker run or docker build.
- [Sandbox Functions](https://sandbox0.ai/docs/sandbox/functions.md): Sandbox Functions expose public HTTP handlers inside a sandbox without running a long-lived HTTP server. They are configured as function-backed Sandbox Services, so each function uses the same public URL, route policy, auth, CORS, rate limit, timeout, path rewrite, and auto-resume model.
- [Webhooks](https://sandbox0.ai/docs/sandbox/webhooks.md): Receive real-time event notifications from sandboxes via webhooks. Webhooks allow you to react to process events, sandbox lifecycle changes, and file modifications.

### sandbox / TEMPLATE

- [Overview](https://sandbox0.ai/docs/sandbox/template.md): A template is the reusable blueprint for a sandbox. It defines the image, default resources, environment, metadata, and default network policy. Every sandbox is claimed from a template.
- [Custom Images](https://sandbox0.ai/docs/sandbox/template/images.md): Every image-based template names a normalized, SHA-256 digest-pinned OCI image. Sandbox0 accepts public images and team-scoped private images and imports their RootFS into the regional block store before runtime use. Mutable tags are rejected rather than resolved during template creation.
- [Warm Pool](https://sandbox0.ai/docs/sandbox/template/pool.md): Sandbox0 uses one resource-neutral pool of pre-created Nomad carrier allocations per immutable runtime compatibility class. A template does not own or size a separate pool.
- [Configuration](https://sandbox0.ai/docs/sandbox/template/configuration.md): A template describes reusable sandbox inputs. The public spec is runtime-neutral: it contains an image, default memory and RootFS storage, guest security class, claim-lifetime ephemeral mounts, environment variables, metadata, and a default network policy. Scheduling and warm-pool topology are platform concerns and are not embedded in a template.

### sandbox / CREDENTIAL

- [Overview](https://sandbox0.ai/docs/sandbox/credential.md): Credential features let Sandbox0 authenticate outbound traffic without placing raw secret material inside the sandbox process.
- [Sources](https://sandbox0.ai/docs/sandbox/credential/sources.md): Credential sources store the secret material that later gets projected into outbound auth flows.
- [Egress Auth](https://sandbox0.ai/docs/sandbox/credential/egress-auth.md): Egress auth rules tell Sandbox0 when to apply outbound authentication for matching traffic.

### sandbox / INTEGRATIONS

- [Overview](https://sandbox0.ai/docs/sandbox/integrations.md): Sandbox0 can be integrated into external delivery and automation systems through the CLI and SDKs.
- [GitHub CI](https://sandbox0.ai/docs/sandbox/integrations/github-ci.md): GitHub Actions can run s0 non-interactively for common Sandbox0 automation flows such as image build/push, template updates, and sandbox orchestration.
- [LangChain Deep Agents](https://sandbox0.ai/docs/sandbox/integrations/langchain-deepagents.md): Use Sandbox0 as the sandbox backend for LangChain Deep Agents and Deep Agents Code.
- [OpenAI Agents](https://sandbox0.ai/docs/sandbox/integrations/openai-agents.md): Use Sandbox0 as the backend for OpenAI Agents SDK SandboxAgent runs through the Sandbox0 Python SDK adapter. The adapter maps the OpenAI workspace to /workspace on the sandbox writable rootfs.
- [Vercel Eve](https://sandbox0.ai/docs/sandbox/integrations/vercel-eve.md): Vercel Eve agents can use Sandbox0 as their sandbox backend through the @sandbox0/eve adapter for the Sandbox0 JavaScript SDK.

### sandbox / SELF-HOSTED

- [Overview](https://sandbox0.ai/docs/sandbox/self-hosted.md): Sandbox0 self-hosting uses dedicated Nomad client nodes, stock gVisor runsc, direct node services, regional PostgreSQL, and S3-compatible RootFS storage.
- [Install](https://sandbox0.ai/docs/sandbox/self-hosted/install.md): This guide describes the production Nomad boundary. It intentionally does not create a local orchestration cluster or install a development-only alternate runtime.
- [Configuration](https://sandbox0.ai/docs/sandbox/self-hosted/configuration.md): Sandbox0 configuration is split across direct service YAML, root-owned credential/identity files, Nomad client configuration, and the warm-carrier job. Keep these inputs under versioned infrastructure management and pin them to one tested release.
- [Observability](https://sandbox0.ai/docs/sandbox/self-hosted/observability.md): Self-hosted Sandbox0 has three distinct data paths. Do not merge their storage or authority boundaries.
- [Team Quotas](https://sandbox0.ai/docs/sandbox/self-hosted/quotas.md): Team Quota protects shared regional capacity and bandwidth from one team. It is an operational admission guardrail, not pricing or billing. A team-specific PostgreSQL policy overrides the regional default for the same dimension.
- [Team Deletion](https://sandbox0.ai/docs/sandbox/self-hosted/team-deletion.md): Team deletion is conservative. DELETE /teams/{id} checks the current region for team-owned resources and returns 409 conflict while any blocking resource remains.

### sandbox / USE CASES

- [Use Cases](https://sandbox0.ai/docs/sandbox/use-cases.md): Use these patterns when you want to host an agent framework gateway, browser automation API, or similar developer tool inside a Sandbox0 sandbox instead of on a cloud VM, VPS, or developer workstation.
- [Coding Agents](https://sandbox0.ai/docs/sandbox/use-cases/coding-agents.md): Use a Sandbox0 sandbox as a persistent coding workspace with isolated command execution, file APIs, network policy, and rootfs snapshots.
- [Hosting OpenClaw](https://sandbox0.ai/docs/sandbox/use-cases/openclaw.md): Run OpenClaw inside a Sandbox0 sandbox when you want its gateway, workspace, logs, and session state behind Sandbox0 lifecycle and network controls. The builtin openclaw template stores /home/node/.openclaw on the sandbox writable rootfs, so checkpointed pause/resume preserves that state.
- [Hosting Hermes](https://sandbox0.ai/docs/sandbox/use-cases/hermes.md): Run Hermes inside a Sandbox0 sandbox when you want sessions, memory, skills, and gateway state behind Sandbox0 lifecycle and network controls. The builtin hermes template keeps its writable state on the sandbox rootfs.
- [Steel Browser](https://sandbox0.ai/docs/sandbox/use-cases/steel-browser.md): Run a browser automation API inside a Sandbox0 sandbox when you want CDP, browser profile state, cookies, downloads, and a live browser view behind Sandbox0 lifecycle and public ingress.

## Agent-readable Markdown

Docs and blog content pages expose their raw MDX at the same URL with a `.md` suffix. Repeated `.md` suffixes are treated the same as a single suffix.

Examples:

- `/docs/sandbox.md`
- `/blog/2026-06/docker-in-sandbox-for-ai-agents.md`

## Source Code And Issues

- [Sandbox0 core](https://github.com/sandbox0-ai/sandbox0)
- [CLI](https://github.com/sandbox0-ai/s0)
- [Go SDK](https://github.com/sandbox0-ai/sdk-go)
- [JavaScript SDK](https://github.com/sandbox0-ai/sdk-js)
- [Python SDK](https://github.com/sandbox0-ai/sdk-py)

When reporting issues, include a minimal reproduction and relevant logs, but remove API keys, tokens, kubeconfigs, customer data, private repository URLs, and any other sensitive personal or organizational information.