Sandboxing

Preview

Isolation boundaries for execution and untrusted content.

Execution happens in disposable, network-restricted environments with no access to host resources, other runs, or workspace secrets beyond the brokered tokens a step needs.

Boundary	Enforcement
Process isolation	Per-run environment with no shared kernel namespaces
Filesystem	Ephemeral overlay; no host mounts
Network	Deny-all egress, per-step allowlists, DNS pinning
Secrets	Injected at transport layer; not readable from the environment
Resources	CPU, memory, disk and wall-clock ceilings
Lifetime	Destroyed at run end; snapshots encrypted at rest

For full detail on environment classes and egress profiles, see Execution Environments and Tool Sandboxing.

Last updated 2026-09-16