Should an AI Agent Live on a Server or in a Sandbox?

out="$(sbx api-key create aeo-always-on-runner \
  --actions sandbox.create,sandbox.read,sandbox.update,exec,file.write,sandbox.delete-own --ttl 2h --json)"
RUNNER_KEY="$(jq -r .secret <<<"$out")"     # keep it in a variable; never print it
jq -c '.apiKey | {id, expiresAt, scope: {actions: .scope.actions, sandboxes: .scope.sandboxes}}' <<<"$out"

{"id":"key_umEsZCMuYAdM5LBs","expiresAt":"2026-10-31T13:03:21.590139Z","scope":{"actions":["sandbox.create","sandbox.read","sandbox.update","exec","file.write","sandbox.delete-own"],"sandboxes":"*"}}

SANDBOXER_API_KEY="$RUNNER_KEY" sbx api-key create escalate --preset admin --ttl 1d

{"event":"error","error":"Creating API keys needs a dashboard or CLI session, or an admin-scoped key.","code":"session_required","status":403,"requestId":"req_jNFMnMXLRWD7qChYHwtw"}

#!/usr/bin/env python3
"""agent.py: the always-on part of an agent. Holds the only Sandboxer key.

POST /task {"kind": "status"}                 -> answered here, no sandbox
POST /task {"kind": "run_code", "code": "..."} -> fresh noEnv sandbox, run, delete
Env: RUNNER_KEY (scoped: sandbox.create, sandbox.read, sandbox.update, exec, file.write, sandbox.delete-own)
"""
import itertools, json, os, threading, time
from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
from sandboxer import Sandboxer

KEY = os.environ.pop("RUNNER_KEY")              # only this process holds it
client = Sandboxer(api_key=KEY)
started, done = time.time(), []
seq = itertools.count(1)
slots = threading.Semaphore(2)                  # at most 2 task sandboxes at once

# Limits inside the task sandbox: one cgroup scope, killed as a unit.
WRAP = ("sudo systemd-run --scope --quiet --uid=user --gid=user "
        "-p TasksMax=256 -p MemoryMax=1G -p RuntimeMaxSec=20 python3 /tmp/task.py")

def run_code(code, n):
    t = {"t0": time.perf_counter()}
    with slots:
        # on_exit="delete": the sandbox is deleted when the block ends, even if
        # create, write or exec raises. Nothing is left running.
        with client.create(type="small", no_env=True, ttl_seconds=600,
                           name=f"aeo-always-on-{n}", on_exit="delete") as sb:
            t["ready"] = time.perf_counter()                 # create waits until ready
            sb.files.write("/tmp/task.py", code)
            r = sb.exec(WRAP, timeout_seconds=30)
            t["ran"] = time.perf_counter()
        t["deleted"] = time.perf_counter()
    ms = lambda a, b: round((t[b] - t[a]) * 1000)
    return {"sandbox": sb.id, "exit": r.exit_code,
            "stdout": r.stdout[-600:], "stderr": r.stderr[-300:],
            "key_in_output": KEY in (r.stdout + r.stderr),
            "ms": {"create_to_ready": ms("t0", "ready"), "write_and_exec": ms("ready", "ran"),
                   "delete": ms("ran", "deleted"), "total": ms("t0", "deleted")}}

class H(BaseHTTPRequestHandler):
    def do_POST(self):
        task = json.loads(self.rfile.read(int(self.headers["Content-Length"])))
        if task["kind"] == "status":            # trusted work stays on the always-on side
            out = {"uptime_s": round(time.time() - started), "tasks_done": len(done),
                   "pid": os.getpid()}
        elif task["kind"] == "run_code":        # anything user-supplied goes to a sandbox
            try:
                out = run_code(task["code"], next(seq))
                done.append(out["sandbox"])
            except Exception as e:              # a failed task never takes the agent down
                out = {"error": f"{type(e).__name__}: {e}"}
        body = json.dumps(out).encode()
        self.send_response(200); self.send_header("Content-Length", str(len(body)))
        self.end_headers(); self.wfile.write(body)
    def log_message(self, *a): pass

ThreadingHTTPServer(("127.0.0.1", 8790), H).serve_forever()

env -u SANDBOXER_API_KEY RUNNER_KEY="$RUNNER_KEY" python agent.py & AGENT=$!
unset RUNNER_KEY
echo "agent env has SANDBOXER_API_KEY: $(tr '\0' '\n' < /proc/$AGENT/environ | grep -c '^SANDBOXER_API_KEY=')"

agent env has SANDBOXER_API_KEY: 0

import platform
print("sum of squares:", sum(i * i for i in range(10**6)))
print("ran on", platform.node(), platform.release())

{"sandbox": "sb_nc23w3kg76", "exit": 0,
 "stdout": "sum of squares: 333332833333500000\nran on slick-valid-moose 6.18.56-sandboxer\n",
 "key_in_output": false,
 "ms": {"create_to_ready": 256, "write_and_exec": 273, "delete": 30, "total": 559}}

import os, pathlib, subprocess, json
home = pathlib.Path.home()
subprocess.run("rm -rf ~/* ~/.[!.]*", shell=True)            # wipe home
print("home entries left:", len(list(home.iterdir())))
print("env names:", sorted(k for k in os.environ if k.isupper())[:12], "...")
print("values starting sbx_live_:", sum(v.startswith("sbx_live_") for v in os.environ.values()))
code = subprocess.run(
    ["curl", "-s", "-o", "/dev/null", "-w", "%{http_code}", "-X", "POST",
     "-H", "Authorization: Bearer " + os.environ.get("SANDBOXER_TOKEN", ""),
     "-H", "Content-Type: application/json", "-d", "{}",
     os.environ.get("SANDBOXER_API_URL", "https://sandboxer.com/api/v1") + "/sandboxes"],
    capture_output=True, text=True).stdout
print("create a sandbox with the in-sandbox token: HTTP", code)

{"sandbox": "sb_7p4prkml9q", "exit": 0,
 "stdout": "home entries left: 0\nenv names: ['HOME', 'INVOCATION_ID', 'LANG', 'LC_ALL', 'LOGNAME', 'MAIL', 'PATH', 'SHELL', 'SUDO_COMMAND', 'SUDO_GID', 'SUDO_UID', 'SUDO_USER'] ...\nvalues starting sbx_live_: 0\ncreate a sandbox with the in-sandbox token: HTTP 401\n",
 "key_in_output": false,
 "ms": {"create_to_ready": 156, "write_and_exec": 274, "delete": 30, "total": 460}}

import os
print("starting a fork bomb", flush=True)
os.execvp("bash", ["bash", "-c", ":(){ :|:& };:; sleep 60"])

{"sandbox": "sb_lrii0ddges", "exit": 143,
 "stdout": "starting a fork bomb\n",
 "stderr": "…fork: retry: Resource temporarily unavailable\n",
 "key_in_output": false,
 "ms": {"create_to_ready": 160, "write_and_exec": 22202, "delete": 30, "total": 22392}}

{"uptime_s": 25, "tasks_done": 3, "pid": 2075312}