Sandboxes

New to AgentEnv Framework? Getting Started installs it and runs a first task in two commands, with no Docker, model or cloud account, and Core Concepts explains environments, agents and tasks. Every provider below runs the same tasks; the default, local, needs only Docker.

Supported ProvidersCopy Anchor Link

A deploy_sandbox or deploy_agent step with a network_policy gets a sandbox that only reaches the hosts the policy allows. A provider that can't enforce the policy refuses the step instead of creating an open sandbox. To run on a platform that isn't listed, write a sandbox provider plugin.

Picking a ProviderCopy Anchor Link

[sandbox]
default       = "local"   # envs and deploy_sandbox steps
agent_default = "local"   # agents

A comma-separated value, such as "sail_vm,e2b", is a fallback chain: when one provider can't create a sandbox, the next one is tried. For a single run, --sandbox on agent-env run, or --env-sandbox and --agent-sandbox on agent-env task run, override the config. A provider's own settings go in [sandbox.providers.<name>.config], with keys given as secret: or env: references, never as the key itself.

ModalCopy Anchor Link

modal and modal_vm read MODAL_TOKEN_ID and MODAL_TOKEN_SECRET, or else the active profile in ~/.modal.toml that modal token new writes, so they need no config table.

E2BCopy Anchor Link

e2b needs an E2B template with Docker and Compose v2. Build one with the Docker Compose example in E2B's Docker guide, then set base_template to its name. agent-env builds each sandbox size it needs from that template.

[sandbox.providers.e2b.config]
api_key       = "env:E2B_API_KEY"
base_template = "docker-compose"   # the template the guide builds

SailCopy Anchor Link

pip install 'agentenv-framework[sail]'

[sandbox.providers.sail_vm.config]
api_key = "env:SAIL_API_KEY"

agent-env run hello --sandbox sail_vm checks the setup with no model. Sail injects an agent's model key and [model.headers] at its egress, so neither enters the Sailbox. The sail_vm README covers sizes, auto-sleep, egress and cost.

TensorlakeCopy Anchor Link

pip install 'agentenv-framework[tensorlake]'

[sandbox.providers.tensorlake.config]
api_key = "env:TENSORLAKE_API_KEY"

agent-env run hello --sandbox tensorlake checks the setup with no model. Sandboxes boot from agentenv-dind-host-v1, a public image with Docker and Compose v2; set image to boot your own. The tensorlake README covers sizes, egress and cost.

TenkiCopy Anchor Link

pip install 'agentenv-framework[tenki]'

[sandbox.providers.tenki.config]
api_key = "env:TENKI_API_KEY"

agent-env run hello --sandbox tenki checks the setup with no model. Each env and each agent gets a Linux VM of its own, with Docker inside and a public HTTPS URL for each port it exposes. The tenki README covers sizes, egress and cost.

VercelCopy Anchor Link

pip install 'agentenv-framework[vercel]'

[sandbox.providers.vercel.config]
token      = "env:VERCEL_TOKEN"
team_id    = "your-team-id"
project_id = "your-project-id"

agent-env run hello --sandbox vercel checks the setup with no model. Set token, team_id and project_id together, or leave out the table to use the Vercel SDK's own credentials, such as a VERCEL_OIDC_TOKEN from vercel project token <project>. Each env and each agent gets a Vercel Sandbox of its own, with Docker inside and a public *.vercel.run URL for each port it exposes. The framework's README covers sizes, regions and egress.

smol machinesCopy Anchor Link

pip install 'agentenv-framework[smol]'

agent-env run hello --sandbox smol_vm checks the setup with no model. Each env and each agent gets a SmolVM microVM of its own on your machine, with Docker inside, so it needs no account, API key or config table, and nothing runs on your host's Docker. It needs Apple Silicon macOS, or Linux with /dev/kvm; on Apple Silicon, build images for linux/arm64. The framework's README covers images and the local stores.