Agent workspace
Workspace
Run code in an isolated, writable, throwaway workspace, or let an agent write and test it for you. The sandbox owns the image, command and limits.
Isolation
What a workspace can and cannot do
- Runs under gVisor: a user-space kernel sits between code and the host
- No network, no host files, no secrets, no environment inherited
- Unprivileged user with limits: 1 CPU, 128 MB memory, 32 processes, 8 MB disk, 10 s
- The folder is deleted afterwards; only file names and sizes are returned
Python
Run your own code
280 B of 16 KB. Your code is saved nowhere; the audit log keeps only a hash.