Sandbox

Box Runtime gives the built-in Agent one execution interface for running commands, reading and writing files, and hosting long-lived processes. Everyday Agent use cases (data processing, file operations, running user code, hosting stdio MCP) all rely on it. Docker, nsjail, and E2B provide sandbox isolation; the explicitly selected Host backend is for trusted local development and provides no isolation. Once Box is enabled, the built-in Agent automatically gains six tools — no need to wire each one into the pipeline.

​

Built-in Tools

exec runs in the selected Box backend; the other five operate directly on the workspace directory mapped to /workspace. With Host selected, commands also run directly on the Box Runtime host.

​

Sandbox Scope

The pipeline’s AI configuration lets you choose how the sandbox is shared across messages. The default “per chat” works for most cases.

​

Lifecycle

These lifecycle rules also apply to Host. Cleanup terminates the session’s managed process trees and removes its temporary session directory. A durable workspace mapped under box.local.host_root is not deleted as temporary state. Runtime shutdown and explicit session deletion also perform cleanup.

​

Quick Start

Trusted local development on Linux / macOS can select Host without installing Docker:

1. Edit config.yaml:
   box:
     enabled: true
     backend: 'host'
     local:
       host_root: './data/box'
   
2. Start LangBot: Box Runtime is enabled automatically
3. In the pipeline, select the built-in Agent plus a model that supports function calling

The Agent will then automatically receive the six tools. See Sandbox Configuration for details.

​

Disabling Box

Set box.enabled: false. Everything that depends on the sandbox (built-in tools, Skill create/edit/activate, stdio MCP) is disabled together; MCP servers in http/sse mode are unaffected.

​

Next Steps

• Sandbox Configuration — backends, security profiles, mounts, environment variables
• Runtimes & Extensions Compared — how the sandbox, Skills, MCP, and plugins divide responsibilities