Coding agents

Sandbox profiles encode deliberate defaults for resources, network, sensitivity, and risk signals; they do not embed API keys or provider credentials.

Included profiles

Profile	Executable	Default image strategy
Codex	`codex`	Local pinned image builder
Claude Code	`claude`	Local pinned image builder
OpenCode	`opencode`	Local pinned image builder
Pi	`pi`	Local pinned image builder
Aider	`aider`	Official `paulgauthier/aider` image
Goose	`goose`	Official `ghcr.io/block/goose` image
CommandCode	`commandcode`	Required `--image` override

Review image versions as dependencies. npm-based agent versions live in images/agents/versions.env; update them through a reviewed dependency change and pin the production base-image digest.

Build and run an agent

Build local images on every eligible worker. If a required :local image is missing, Sandbox returns the precise worker-side build command instead of a generic Docker error.

12345678./scripts/build-agent-image.sh codex
./scripts/build-agent-image.sh claude
./scripts/build-agent-image.sh opencode
./scripts/build-agent-image.sh pi

sandbox agent list
sandbox agent run codex --tenant engineering
sandbox agent run opencode --tenant engineering -- --version

agent run provisions a disposable workspace. With arguments after --, it waits for creation and uses the normal argv-safe execution path, preserving the command's exit code, stderr, timeout, and truncation state. The sandbox remains available until deletion or TTL expiry.

Workspace and network policy

Agent roots are read-only. Each sandbox receives a writable, scoped /workspace volume, while HOME and XDG state live below that mount. Deletion removes both the container and its workspace volume.

Profiles start with restricted egress. Choose --network open only when an agent genuinely needs an external model provider or package endpoint that a restricted worker cannot reach.

Source and credentials

The v0.1 API has no first-class repository checkout object. Use an argv-safe git clone, a signed source archive, a short-lived SSH certificate, or a runtime driver that materialises a reviewed source snapshot. Do not forward a developer's long-lived SSH key into the environment.

Secret references are safer than plaintext fields. A production runtime driver should resolve an opaque reference inside the isolation boundary, issue a short-lived credential, and revoke it on deletion without writing the secret to the image or control database.

Read AEGIS placement, Sandbox MCP and skills, and the agent skill before giving an agent a new workload.