bezalel-sandbox
Bezalel Sandbox
Disposable Linux microVMs behind your token's sandbox scope — a shell, a
filesystem, and internet, isolated from everything. A sandbox is cattle,
not a pet: spin one up, run code, throw it away. There can be several at
once. This is NOT the owner's computer (that is the computer domain — one
persistent machine); nothing here touches the owner's real files, and every
sandbox auto-expires.
Backends are swappable (Daytona, E2B, or Vercel Sandbox — the plane picks
one); you cannot tell which, and should not care. When your token grants
sandbox, this is the default place to run throwaway work — prefer it over
a harness-local sandbox so the work stays under the owner's caps and audit.
The plane caps how many sandboxes you create per day and how many run at
once, so a blocked call names the exceeded limit — report it, do not retry
in a loop.