Skip to main content

Quick Start

Output:

API

hexr.sandbox.exec()

string
required
The code to execute inside the microVM.
string
default:"python"
Execution language. "python" or "shell".
int
default:"30"
Maximum execution time in seconds. The VM is killed after this.
dict
default:"None"
Environment variables to set inside the VM.
list[str]
default:"None"
Python packages to install before execution.

ExecResult

Async Version

Check Availability


Examples

Data Analysis

Shell Commands

Error Handling


Security Model

Code inside the sandbox runs in a Firecracker microVM with hardware-level isolation. It has no access to SPIFFE identity, cloud credentials, Vault secrets, or the Kubernetes cluster network.
This means even if sandboxed code is malicious (e.g., prompt injection leads to code execution), it cannot:
  • Access Vault secrets
  • Call cloud APIs with agent credentials
  • Communicate with other agents
  • Read the SPIRE socket
  • Escape to the host

Architecture

1

Agent sends execute request

The agent container sends POST /execute in plaintext to the Envoy sidecar.
2

Envoy upgrades to mTLS

Envoy forwards POST /execute to the Sandbox Service (port 8092) over mTLS.
3

microVM boots and code runs

The Sandbox Service boots a Firecracker microVM and injects the code. The code executes inside the VM.
4

Results returned, VM destroyed

stdout, stderr, and exit_code are captured. The VM is immediately destroyed. The ExecResult is returned through Envoy to the agent.
Built on SmolVM — a thin Firecracker wrapper (Apache-2.0).