Give an agent a real computer — file system, shell, Python — that boots in
milliseconds and is thrown away after the run. If it hallucinates a
rm -rf /, only the disposable guest dies. The host is untouched.
Every agent run is contained, credential-masked, and governed at the boundary — under one API.
A hardware-virtualised Firecracker guest per run. Terminal, filesystem, and code execution, isolated behind a KVM boundary and discarded on exit.
The agent never holds your real secrets. Scoped, short-lived credentials are injected at the egress boundary — so a prompt-injection attack has nothing to steal.
The sandbox gets no default route — the only reachable address is a per-sandbox proxy. Off-allow-list traffic is dropped at the network; every allowed request is brokered, credential-injected, and logged.
The confidential runtime where agents execute — operator-excluded, hardware-attested, with their identity and secrets held outside the agent and their egress governed. Nobody else ships that combination.
Disposable isolation, hardware attestation, a non-human identity vault, and governed egress — as one runtime. The operator can't see in, and the customer can verify it with an attestation quote.
E2B, Modal, and Daytona give fast, disposable isolation. But the operator can still see inside, there is no hardware attestation, and no vault holding the agent's credentials outside the guest.
Confidential-compute clouds keep the operator out. But they are not agent-native: no per-run disposable runtime, no non-human identity vault, no egress governance around the workload.
Create a sandbox, run code under policy, read the governance event stream,
throw it away. Set confidential: true to place the whole sandbox
inside an attested confidential VM — so even the operator can't see inside.
from terrabox_sdk import TerraboxClient
client = TerraboxClient("https://api.terrabox.example", api_key="tbx_live_...")
sandbox = client.create_sandbox(
tenant_id="…",
template="python",
confidential=True, # run inside an attested TDX VM
iam_policy={
"grants": [{
"service": "api.github.com",
"allowed_resource": "repo:acme/widgets",
"scopes": ["contents:read"],
"token_ttl_seconds": 300,
}],
"never_expose": ["GITHUB_MASTER_PAT"],
},
egress_policy={"default_deny": True, "allowed_domains": ["api.github.com"]},
)
# curl to an allowed host → ephemeral token injected at the boundary
client.exec_in_sandbox(sandbox["sandbox_id"],
command="curl https://api.github.com/repos/acme/widgets")
# anything off the allow-list is dropped at the network boundary
client.exec_in_sandbox(sandbox["sandbox_id"],
command="curl https://evil.example.com/exfil") # egress_blocked
events = client.sandbox_events(sandbox["sandbox_id"]) # signed governance stream
client.destroy_sandbox(sandbox["sandbox_id"])Metered for developers; single-tenant flat fee where sovereignty and confidential execution matter.