Sandbox · node9 documentation
Sandbox
Run a coding agent in a disposable, jailed container — isolated from your host, walled off from the network, and governed + audited from the inside.
Requires Docker
node9 sandbox needs a container runtime (Docker) on the host. The current release is single-container and Claude-first; Codex is a fast-follow.Commands
Build + run a jailed agent
# 1. Scaffold a recipe in the project you want the agent to work on cd ~/my-project node9 sandbox new --agent claude # 2. Build (cached) + boot the agent, jailed node9 sandbox run claude # Pass flags through to the agent after -- node9 sandbox run claude -- --dangerously-skip-permissions # Watch the jailed agent's actions live (second terminal) node9 sandbox tail # Dump the audit, or tear the box down node9 sandbox logs node9 sandbox cleanThe directory you run from is mounted at
/workspace — that’s the only part of your machine the agent can see.What you get
Hard isolationContainer
The agent runs in a disposable container as an unprivileged user. It can only touch the folder you mounted (
/workspace) — not your SSH keys, other projects, or system files.Kernel egress wallDeny-by-default
Outbound is sealed at the kernel (ipset/iptables). Only the hosts on your allowlist are reachable; everything else is dropped — even if the agent is compromised.
Governed + audited insidenode9 in-box
node9 runs inside the box too: its hooks gate the agent’s tool calls and log every action to an audit stream you can
tail from the host.Subcommands
| Command | What it does |
|---|---|
| sandbox new | Scaffold node9.sandbox.yaml (mounts, allowlist, ports) |
| sandbox run | Build (if needed) + boot the jailed agent |
| sandbox tail | Stream the box’s audit log to your terminal |
| sandbox logs | Print the box’s audit log once |
| sandbox clean | Remove the image, build context, and audit data |
Honest scope (current release)
This is hard isolation plus in-box governance — the agent holds its own provider credential, confined by the egress wall, and your node9 SaaS key is never placed in the box. A transparent credential broker (so the agent holds no secret at all) is on the roadmap, not in this release. Today’s honest claim is “jailed and governed,” not “never holds a secret.”