Skip to main content
StateSet Sandbox is a Kubernetes-based sandbox infrastructure for running code execution workloads inside isolated pods. It exposes REST and WebSocket APIs for creating sandboxes, streaming command output, and reading or writing files inside each sandbox workspace.

Key capabilities

  • Isolated execution per sandbox pod with resource limits
  • REST and WebSocket APIs for command execution and streaming output
  • File read and write APIs for workspace workflows
  • Prebuilt runtime with Node.js, Python, Go, Rust, and common CLI tooling
  • Automatic cleanup with per-sandbox timeouts
  • Optional warm pool support for faster startup

Architecture overview

Hosted API quickstart

  1. Register and receive an API key.
  2. Create a sandbox with a timeout.
  3. Execute commands inside the sandbox.

TypeScript SDK example

Self-hosted deployment

At a high level, deployment includes:
  1. Build and push the sandbox and controller images.
  2. Apply the Kubernetes manifests in k8s/.
  3. Configure secrets for JWT signing and provider keys.
  4. Deploy the controller and verify pod creation.

API summary

Configuration highlights

Security and isolation

  • Sandboxes run as non-root with dropped Linux capabilities.
  • Seccomp profiles and resource limits are enforced at the pod level.
  • Network policies restrict egress to HTTPS and DNS.