none
A sandbox your agent drives from the shell.
A persistent, isolated Linux box for every AI agent, driven entirely from the shell.
operator — workboxREADY
# one box per agent, driven over the API$ workbox sandbox create --name demo --network egress $S{ "id": "01K8X3F2QH7M9V4T6B2N5R8C1D", "name": "demo", "state": "READY", "health": "HEALTHY"}$ workbox sandbox exec 01K8X3F2QH… $S -- sh -c 'wb run -- echo hello'hello$ workbox agent codex 01K8X3F2QH… -p "Add a test for parse()" $SClaude CodeCodexMCP clientsbubblewrapcgroup v2nftablesslirp4netnsseccomp-bpfNode.js 22SQLite (WAL)PrometheusStandard Webhooks
Tool schemas don’t scale. A shell does.
One box. Every interface.
A full Linux machine, sealed from the first instruction.
Real isolation from namespaces, cgroup v2 and seccomp. Typically ready in under a second.
Explore the platformoperator — workboxREADY
$ workbox sandbox inspect 01K8X3F2QH7M… $S
{
"id": "01K8X3F2QH7M9V4T6B2N5R8C1D",
"state": "READY",
"health": "HEALTHY",
…
}
$ workbox sandbox run 01K8X3F2QH7M… --name build $S -- make test
{"sessionId":"01K8X4A7MN…"}
$ workbox sandbox wait 01K8X3F2QH7M… 01K8X4A7MN… $SNetwork on your terms.
egressDefault
Open internet, private network sealed.
allowlist
Only the hosts you approve.
Fast enough to spin up per task.
- 842ms
- Median time to ready
- 1,088ms
- p95 time to ready
- 11.9MiB
- Memory per idle sandbox
- 87.4MiB
- Server footprint, 20 sandboxes
Six layers between your agent and the host.
- 01
Bounded before it starts
- 02
Root inside, nobody outside
- 03
A private writable layer
- 04
bubblewrap seals the rest
- 05
No new privileges
- 06
The supervisor answers
READY
Hand an agent one key, not the host.
One URL and one scoped key. No SSH, no host credentials.
Bound keys
One event log
Signed webhooks
GET /v1/events/ws · live
- #1044session.startedtest · make test
- #1043sandbox.stateREADYwebhook
- #1042sandbox.stateBOOTSTRAPPING
- #1041sandbox.createdbuild-7 · rootfs minimal
POST https://ci.example.com/hooks1 signed · 200
Security built into every layer.
- Seven namespaces per box
- Hard resource limits
- 50 syscalls blocked
- Brokered secrets
- A firewall it can’t touch
- Tamper-evident audit log
Up and running in minutes.
One install script. workbox doctor checks the rest.
as root, in the checkout
alias workbox='node packages/cli/src/main.js'
sh deploy/install.sh
workbox doctor
workbox rootfs build minimal
workbox runtime install
export WORKBOX_TOKEN=$(openssl rand -hex 24)
workbox serve &
S='--server http://127.0.0.1:8790'
# prints the sandbox; note its id
workbox sandbox create --name demo $S
workbox sandbox exec <id> $S -- sh -c 'wb status; wb run -- echo hello'
workbox sandbox rm <id> $SGive your agent a box of its own.
Open source and self-hosted.