Sandbox · node9 documentation

Sandbox

Run a coding agent in a disposable, jailed container — isolated from your host, walled off from the network, and governed + audited from the inside.

Requires Docker
node9 sandbox needs a container runtime (Docker) on the host. The current release is single-container and Claude-first; Codex is a fast-follow.

Commands

Build + run a jailed agent
# 1. Scaffold a recipe in the project you want the agent to work on
cd ~/my-project
node9 sandbox new --agent claude

# 2. Build (cached) + boot the agent, jailed
node9 sandbox run claude

# Pass flags through to the agent after --
node9 sandbox run claude -- --dangerously-skip-permissions

# Watch the jailed agent's actions live (second terminal)
node9 sandbox tail

# Dump the audit, or tear the box down
node9 sandbox logs
node9 sandbox clean
The directory you run from is mounted at /workspace — that’s the only part of your machine the agent can see.

What you get

Hard isolationContainer
The agent runs in a disposable container as an unprivileged user. It can only touch the folder you mounted (/workspace) — not your SSH keys, other projects, or system files.
Kernel egress wallDeny-by-default
Outbound is sealed at the kernel (ipset/iptables). Only the hosts on your allowlist are reachable; everything else is dropped — even if the agent is compromised.
Governed + audited insidenode9 in-box
node9 runs inside the box too: its hooks gate the agent’s tool calls and log every action to an audit stream you can tail from the host.

Subcommands

CommandWhat it does
sandbox newScaffold node9.sandbox.yaml (mounts, allowlist, ports)
sandbox runBuild (if needed) + boot the jailed agent
sandbox tailStream the box’s audit log to your terminal
sandbox logsPrint the box’s audit log once
sandbox cleanRemove the image, build context, and audit data
Honest scope (current release)
This is hard isolation plus in-box governance — the agent holds its own provider credential, confined by the egress wall, and your node9 SaaS key is never placed in the box. A transparent credential broker (so the agent holds no secret at all) is on the roadmap, not in this release. Today’s honest claim is “jailed and governed,” not “never holds a secret.”