Sandboxes
One running microVM. Boots from a template, has its own IP, CPU, memory, disk.
A sandbox is a Cloud Hypervisor microVM with a vanilla Linux kernel. Boot is ~1s regardless of image size — the rootfs streams in block-by-block from R2 over NBD.
Identified by a UUID. The short slug (4–7 chars, shown in sb ls, e.g. hbuh, smwlk) is a friendlier alias that works everywhere a UUID does in CLI per-sandbox commands. SDK methods always take the UUID.
States
| State | Meaning |
|---|---|
provisioning | Host is allocating the VM. Transient (~1s). |
running | VM is up. Exec, files, ports, ssh all work. |
suspended | sb stop (or sandboxes.stop) puts it here. RAM + disk preserved. |
stopped | Powered off without snapshotting. |
error | Provisioning or runtime failure. See sb get for details. |
archived | Soft-deleted; metadata kept for audit. |
sb start resumes a suspended sandbox. sb rm is destructive.
Sizes
| Size | vCPU | Memory | Disk |
|---|---|---|---|
| xs | 1 | 512 MB | 10 GB |
| s | 2 | 2048 MB | 20 GB |
| m | 4 | 8192 MB | 40 GB |
| l | 8 | 16 GB | 80 GB |
Picked at sb new --size … time. Not changeable after boot — destroy and recreate to resize.
What a sandbox has
- A private IP on the workspace network. Reachable from other sandboxes in the same workspace.
- Full root inside the guest. The kernel and userland are yours.
- An sshd the bastion can reach (see SSH access).
- An exec API for one-shot commands and a PTY API for full terminals.
- A file API for upload/download/list against any path in the guest.
- Snapshot + backup hooks (Backups).
- Optional mounted volumes (Volumes).
CLI / SDK
See CLI · sandboxes and TypeScript SDK. Every dashboard sandbox operation is available in both.