GLOSSARY

What is sandboxed execution?

Sandboxed execution means running code inside a boundary that limits what it can touch. It usually combines filesystem isolation, a restricted network, and CPU or memory limits. Containers use kernel namespaces and cgroups; virtual machines use a hypervisor. Either way, a bug, a bad dependency, or a hostile input should not reach the host or another tenant.

Isolation is a boundary you can describe. If you cannot say what the code can reach, you do not have a sandbox.

Start free See pricing

Sandboxed execution runs untrusted code inside an isolated environment with its own filesystem, network, and resource limits, so a failure stays contained.

What it is

A sandbox is a boundary drawn around a running process. Inside it, the code sees a filesystem, a network, and a set of limits that the operator chose. Outside it, the host and other tenants stay out of reach. The isolation is enforced by the platform, not by the good behaviour of the code. That matters, because the code you sandbox is often the code you do not trust yet.

Container, VM, process

The common boundaries trade weight for strength. A process boundary with restricted syscalls and no network is cheap and weak. A container adds namespaces and cgroups, which Docker describes as the first and most straightforward form of isolation, and it still shares a kernel with the host. A virtual machine adds a hypervisor, so a kernel bug is not automatically an escape. Pick the boundary that matches what you contain.

What good looks like

A good sandbox has a short, written list of what the code can reach. Egress is deny-by-default with named exceptions. Credentials are scoped to the task and expire with it. Resource limits exist so one run cannot starve the machine. And the boundary is tested, not assumed: someone has tried to reach a sibling and watched it fail.

How to evaluate one

Ask what the isolation is made of, then ask what the code can reach on the network. A sandbox that can dial the cloud metadata service or a sibling tenant is not isolated, whatever the label says. Ask how secrets enter and whether they appear in the prompt or the logs. Ask whether the machine is destroyed or reused, and what a reused machine remembers.

How Hyperlane implements it

Every Hyperlane run executes in its own resource-capped Linux machine, and agent commands never touch your laptop or production hosts. A per-machine firewall drops new outbound connections to sibling sandboxes while leaving the internet and DNS reachable, so one run cannot dial another. Egress can be narrowed to an allowlist, and secrets are encrypted at rest and injected by name. Enterprise adds VPC, on-premises, and air-gapped deployment.

What Hyperlane ships

  • Autonomous agent loop that plans, edits, runs, and verifies work end-to-end
  • Every run executes inside an isolated, resource-capped sandbox
  • Live execution traces - diffs, terminal output, and reasoning as it happens
  • GitHub-native workflow: pushes branches and opens pull requests itself
  • Web app, REST API, TypeScript SDK, CLI, and MCP server interfaces
  • Dollar-for-dollar credits - pay $20, get $20 of agent work

Frequently asked

Is a sandbox the same as a container?

No. A container is one way to build a sandbox. A virtual machine, a separate host, or a process with restricted syscalls can also be a sandbox. The word describes the boundary and its purpose, not the implementation.

Does sandboxing make running untrusted code safe?

It reduces the blast radius; it does not make risk zero. A sandbox can be misconfigured, a kernel bug can break a boundary, and a permitted network path can still leak data. The useful claim is contained and auditable, not safe.

What should a coding agent sandbox block?

At minimum: the host filesystem, other tenants’ machines, cloud metadata endpoints, and any production credential it does not need. Outbound network access should be an allowlist rather than a default. Secrets should arrive scoped to the task and disappear with it.

Why does an agent need a sandbox at all?

Because an agent runs commands it wrote itself, based on a model’s judgment. Some of those commands will be wrong. A sandbox means a wrong command deletes a throwaway checkout instead of your working tree, and an unexpected network call fails instead of reaching a service.

How long does a sandbox live?

For one task, usually. The machine is created for the run and stopped when the run settles. Retention windows exist so a follow-up turn can reuse the same desktop, but the default is short-lived and disposable rather than a shared box that accumulates state.

Last verified 11 Nov 2026.

Sources: Docker Docs - Docker Engine security Hyperlane pricing Hyperlane docs

Keep exploring

Delegate the ticket. Review the PR.

Start with the Free plan — 10 minutes of agent computer time every month, no card required.

Try Hyperlane free

Hyperlane AI is not affiliated with the Hyperlane blockchain protocol (hyperlane.xyz) or the Hyperlane code editor (hyperlaneide.com).