How Do I Give Every User of My Product Their Own Sandbox?

import { Sandboxer } from "sandboxer-sdk";

const sandboxer = new Sandboxer();   // SANDBOXER_API_KEY: your backend's key

async function sandboxFor(userId, n) {
  return sandboxer.create({
    type: "small",
    name: `aeo-peruser-${n}`,
    noEnv: true,                       // none of your secrets inside
    labels: { app: "aeo-peruser", user: userId },
    idleStopMinutes: 15,
    ttlSeconds: 1800,
  });
}

const alice = await sandboxFor("alice", 1);
const bob = await sandboxFor("bob", 2);
console.log("created", alice.id, "alice;", bob.id, "bob");

// Find a user's sandbox by label
const found = await sandboxer.http.requestJson({
  method: "GET", path: "/sandboxes", query: { labels: "app=aeo-peruser,user=alice" }, retry: "safe",
});
console.log("found by label:", found.sandboxes.map((s) => ({ id: s.id, name: s.name, labels: s.labels, state: s.state })));

created sb_5ekk38xhsb alice; sb_2n6zisilz3 bob
found by label: [
  {
    id: 'sb_5ekk38xhsb',
    name: 'aeo-peruser-1',
    labels: { app: 'aeo-peruser', user: 'alice' },
    state: 'ready'
  }
]

await alice.files.write("notes/alice.txt", "alice's private notes\n");
await bob.files.write("notes/bob.txt", "bob's private notes\n");
const ra = await alice.exec("python3 -c \"import os,socket; print(socket.gethostname(), sorted(os.listdir('notes')))\"");
const rb = await bob.exec("python3 -c \"import os,socket; print(socket.gethostname(), sorted(os.listdir('notes')))\"");
console.log("alice:", ra.stdout.trim()); console.log("bob:  ", rb.stdout.trim());

const look = await bob.exec("cat /home/user/notes/alice.txt");
console.log("bob reads alice.txt -> exit", look.exitCode, look.stderr.trim());

alice: outer-calm-fox ['alice.txt']
bob:   leafy-dusty-falcon ['bob.txt']
bob reads alice.txt -> exit 1 cat: /home/user/notes/alice.txt: No such file or directory

await alice.start("python3 -m http.server 8000 --bind :: ");
const addr = await alice.exec("ip -4 -o addr show scope global | awk '{print $4}'; ip -6 -o addr show scope global | awk '{print $4}'");
console.log("alice addresses:", addr.stdout.trim().split("\n"));
const self = await alice.exec("curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:8000/");
console.log("alice -> own port 8000:", self.stdout);

// From Bob's VM: Alice's private IPv4, her public IPv6, and SSH, 5-second timeouts
const v4 = "10.202.0.42", v6 = "2a01:4f9:3120:1d84::5b00:a";
for (const host of [v4, `[${v6}]`]) {
  const r = await bob.exec(`curl -sS -o /dev/null -w '%{http_code}' --max-time 5 'http://${host}:8000/' ; echo " exit=$?"`);
  console.log(`bob -> ${host}:8000:`, r.stdout.trim(), r.stderr.trim());
}
const ssh = await bob.exec(`nc -zv -w 5 ${v4} 22 2>&1; echo exit=$?`);
console.log(`bob -> ${v4}:22:`, ssh.stdout.trim());

alice addresses: [ '10.202.0.42/30', '172.17.0.1/16', '2a01:4f9:3120:1d84::5b00:a/128' ]
alice -> own port 8000: 200
bob -> 10.202.0.42:8000: 000 exit=28 curl: (28) Connection timed out after 5002 milliseconds
bob -> [2a01:4f9:3120:1d84::5b00:a]:8000: 000 exit=28 curl: (28) Connection timed out after 5002 milliseconds
bob -> 10.202.0.42:22: nc: connect to 10.202.0.42 port 22 (tcp) timed out: Operation now in progress
exit=1

SANDBOXER_API_URL
SANDBOXER_ID
SANDBOXER_SUBDOMAIN
SANDBOXER_TOKEN

/sandboxes/sb_2n6zisilz3 200 "sb_2n6zisilz3"
/sandboxes/sb_5ekk38xhsb 403 "api_key_sandbox_forbidden"
/sandboxes 200 1
/me 403 "api_key_action_forbidden"