Sandboxes
for coding agents
Give your agent a live sandbox container — spawn, exec, checkpoint, and resume, with a durable audit ledger and full replay.
Live session
One prompt. A real sandbox. A durable session.
Active Connections
Available Tools
Sandbox Telemetry
Session Summary
Why Alineo
Your agent is smart.
Its sandbox should be too.
workflow(client)
.sandbox({ resources }, (sb) => {
sb.exec("pytest -q");
sb.checkpoint();
})
.pipe(sink);
// one await, however complexSandboxes that persist
Every exec runs inside a live, isolated OpenSandbox container — filesystem, packages, and processes carry over between calls.
- —A live container as a first-class object: spawn(), exec(), close()
- —Streamed events: text, tool_start, tool_end over one API
- —Resource limits required on every request — no runaway containers
Checkpoint & resume
Every exec is written to a durable ledger. checkpoint() snapshots the container; resume() reconnects after a full restart.
- —SQLiteAdapter for local dev, PostgresAdapter in production
- —Resume replays cached results, runs only what's left live
- —Invisible to the caller — no special resume-path code
Spawn & fork
Fork a running agent's live sandbox — filesystem, installed packages, everything on disk — into an independent sub-agent.
- —spawnDepth and maxAgents cap recursive fan-out
- —steer() redirects a running agent mid-response
- —attach() reconnects to any live sandbox by ID
Programmatic workflows
@alineo-labs/workflow is a lazy pipeline builder — retry, branching, fan-out, and parallel steps queue synchronously.
- —The queue flushes on one await, regardless of complexity
- —Hooks fire on every lifecycle event — bring your own tracer
- —maxConcurrency caps simultaneous sandboxes with a semaphore
For agent builders
From chatbot to an agent that actually executes.
Execute your code inside the sandbox itself — reading and writing real files, running real shell commands, and capturing outputs in real time.
Learn more →█████╗ ██╗ ██╗███╗ ██╗███████╗ ██████╗ ██╔══██╗██║ ██║████╗ ██║██╔════╝██╔═══██╗ ███████║██║ ██║██╔██╗ ██║█████╗ ██║ ██║ ██╔══██║██║ ██║██║╚██╗██║██╔══╝ ██║ ██║ ██║ ██║███████╗██║██║ ╚████║███████╗╚██████╔╝ ╚═╝ ╚═╝╚══════╝╚═╝╚═╝ ╚═══╝╚══════╝ ╚═════╝
█████╗ ██╗ ██╗███╗ ██╗███████╗ ██████╗
██╔══██╗██║ ██║████╗ ██║██╔════╝██╔═══██╗
███████║██║ ██║██╔██╗ ██║█████╗ ██║ ██║
██╔══██║██║ ██║██║╚██╗██║██╔══╝ ██║ ██║
██║ ██║███████╗██║██║ ╚████║███████╗╚██████╔╝
╚═╝ ╚═╝╚══════╝╚═╝╚═╝ ╚═══╝╚══════╝ ╚═════╝ SDKimport { Alineo, textOnly } from "alineo"; const agent = await Alineo.load(spec, { adapter }); for await (const chunk of textOnly( agent.prompt("Write and run a hello world script.") )) { process.stdout.write(chunk); }
For developers
Five lines to a running agent. Full control underneath.
A plain TypeScript SDK — no framework lock-in, no hidden runtime. Swap the storage adapter, the model, or the hooks without touching the rest.
Isolation & security
Protected from every angle, by default.
Every sandbox is ephemeral, resource-capped, and network-gated — an agent gets exactly the reach you grant it, nothing more.
cpu/memory are required on every sandbox request — OpenSandbox rejects anything without them. No runaway containers.
DNS or direct egress modes, plus an agent-egress-approval gate so outbound calls need explicit sign-off.
Secrets are injected into the sandbox at exec time — never returned to the agent, never written to the ledger.
Every exec_start, exec_event, and exec_complete is recorded to your storage adapter and fully replayable.
Your agent's ready.
Give it somewhere to run.
One command spins up OpenSandbox locally — no infra to provision first.