Somewhere for the agent to be wrong.
A coding agent runs commands it wrote itself. Blastpen gives it a room to do that in: a git worktree of its own, confined by the operating system, on your machine. It works, you watch, and your host is exactly as you left it.
bun install -g @relay/sandboxSHEET · 01 · BOUNDARY
The agent is inside something.
Isolation is not a setting here, it is the shape of the thing. On Linux the sandbox is a bwrap jail; on macOS it is sandbox-exec; ask for the sealed profile and it is a Firecracker microVM with its own kernel. Same commands, same output, three different strengths of wall. There is no Docker and no daemon — nothing is installed on your host to make this work.
The agent cannot read, write or execute anything outside this line. Not your home directory, not your keys, not your other projects.
The workspace is a git worktree on its own branch, so it starts with your committed files and nothing else — no stray build output, no local secrets you forgot were there.
Any CLI coding agent runs here unmodified. Blastpen does not wrap it, replace it, or ask it to behave differently.
Only committed files cross the boundary. --include-untracked copies the rest in when you actually want that, and says so.
SHEET · 02 · NETWORK
Three answers to "can it reach the internet".
The middle one is the point. A denied request that cannot explain itself is indistinguishable from a broken agent, and you will waste an afternoon on it.
isolated
Nothing leaves.
restricted
An allowlist you write. A blocked host produces an event naming the host and the setting that stopped it, rather than a bare 403 that looks like a hang.
open
For when you have decided that is fine.
SHEET · 03 · MEASUREMENTS
Isolation costs almost nothing once you are inside it.
The number people expect to be bad is the one that is fine. Starting a hardware-isolated virtual machine takes about a second and a third. Running a command inside one, once it is up, takes 5.6 milliseconds — against 3.7 for a plain process jail. The whole cost of hardware isolation sits in create and teardown, not in the work.
- process jail · create
- bwrap
- process jail · exec
- warm
- hardware VM · cold boot
- sealed profile
- hardware VM · exec
- warm
- hardware VM · fork restore
- from snapshot
Measured on a 12-core x86 Linux host with hardware virtualisation, warm image, single tenant, idle machine, trivial repository, no toolchain or dependency install. Your numbers will differ.
SHEET · 04 · SURFACES
Five doors, one runtime.
A command line (sandbox, sbx). A TypeScript client you call in-process. An HTTP API with an OpenAPI document. A Python SDK. An MCP server, so an agent can drive sandboxes itself. They are the same runtime underneath — whichever door you come in through, a prompt is templated the same way and a run is recorded the same way.
SHEET · 05 · RUNNING
A run that hangs is a bug, not a fact of life.
Idle, not elapsed
The timer re-arms on real agent activity, so a run working hard for an hour is left alone and a run that has gone quiet is stopped.
It says which timer fired
A timeout is never mistaken for a Ctrl-C. The reason names the timer and the budget it was given.
A timeout keeps the work
Stopping a run does not delete the branch it was building on.
SHEET · 06 · SAID BY
Placeholder — replace before launch
This section is wired up and styled, but it holds no real quotes yet. Nothing below was said by anyone.
Placeholder quote. Replace this with something a real person actually said about the product.
Name · Role · Company Placeholder quote. If the quote came from a public post, add the link so it can be checked.
Name · Role · Company Placeholder quote. Delete this whole block if there is nothing real to put in it.
Name · Role · Company
Questions
Does it need Docker?
No. No Docker, no daemon, no background service. The isolation primitives are the ones your operating system already ships.
Which coding agents work?
Any that run as a command-line program. Blastpen spawns the agent you name and gets out of the way.
Where does my code actually go?
Into a git worktree on a branch called sandbox/<id>. That means the sandbox starts from your committed files. Uncommitted work stays on your side of the line unless you pass --include-untracked, and Blastpen warns you when there is uncommitted work it is leaving behind.
Can I run more than one at a time?
Yes — that is the normal case. Each gets its own workspace and its own branch.
macOS or Linux?
Both. Linux uses bwrap, macOS uses sandbox-exec. The sealed Firecracker profile is Linux with KVM.
What happens to a run I stop?
It stops, the state is recorded, and the branch survives. You can look at what it did.
Put the next one in a box.
Two commands, and the next agent you run is somewhere it cannot hurt you.
Get started