Sandbox is explicit about its security claims. Docker on a dedicated worker host is not the same as a strong multi-tenant VM boundary. High-risk workloads must not silently get a weaker tier simply because stronger capacity is busy.

AEGIS is the Adaptive Execution Guard and Isolation Scheduler. It scores a workload using data sensitivity, network access, repository trust, generated code, secret need, host mounts, exposure, privilege, and lifetime.

It then hard-filters incompatible workers and ranks safe candidates by resource headroom, fragmentation, host pressure, image warmth, locality, and bin-packing efficiency. If no compatible microVM worker exists for a high-risk request, the controller returns no_capacity; it does not downgrade to a container.

The hardened Docker adapter is for trusted tenants or dedicated hosts. It uses read-only roots, dropped capabilities, no-new-privileges, explicit networking, and bounded CPU, memory, PID, tmpfs, and output behavior.

Mutually hostile workloads need a VMM-grade external runtime. Sandbox offers an external driver contract for an operator to integrate Firecracker, Kata, gVisor, Cloud Hypervisor, Kubernetes, or a private isolation system. Do not advertise an unconfigured microVM preference as working isolation.

Commands cross the API as argv arrays. The public workflow rejects privileged sandboxes and bounds request bodies, runtime duration, PIDs, CPU, memory, TTL, and captured output.

Credentials never belong in a prompt, argv, label, image name, ordinary environment map, or task output. Use an external runtime driver, workload identity, secret broker, or secret manager; pass only the deployment-approved reference through policy.

Default network access to deny; prefer restricted over open. A tunnel is an Internet-facing HTTP/WebSocket route, not an authentication feature. The current public tunnel workflow rejects raw TCP, request-time tunnel auth, and confidential or restricted workload exposure.

If origin privacy is required, use a genuine ingress boundary such as an outbound Cloudflare Tunnel overlay and close public origin ingress only after verification. Read the tunnels guide and use operations for deployment controls.