Commands and files
Run commands, stream output and move files through one API.
ExecutionRoute the workload.
Govern every step.
The right provider, the right account, and your policies from creation to every outbound request.
The best fit
for every workload.
Optimize for the lowest cost, fastest startup, or highest creation success. Keep region, isolation and capabilities as firm requirements.
- Choose what matters mostCombine cost, startup latency and reliability in your preferred order.
- Control where it runsTarget a region, provider or pool. Add isolation, compliance and network requirements.
- Place workloads together or apartUse affinity and spreading to keep related work close or distribute it across providers.
Filter, then rankIllustrative pools
Required region
Rank matching pools by
Try in orderCostStartSuccess
Pool BUS EastLowSlowLow
Pool CEU WestMidMidHigh
Pool AUS EastHighFastMid
3 matching pools, ordered by lowest configured price.
Your accounts.
Working together.
Use several accounts on one provider, combine providers, or do both. Route across their capacity while keeping credentials and policies separate.
Each pool connects a provider account to the resources it offers. Choose an explicit order, rank matching pools by your priorities, or pin a destination.
Understand accounts and poolsOne request, several possible poolsExample route
- E2BAccount APrimary pool
- E2BAccount BBackup pool
- DaytonaAccount CFallback pool
Try two accounts on one provider, then another provider. Every pool must satisfy the request’s requirements.
Keep creation moving.
Capacity limits, rate limits and provider outages can interrupt a start. When a pool cannot serve the request, Sandbox Router tries the next eligible one.
Match
Find pools that satisfy your requirements.
Rank
Order them by your routing priorities.
Try
Check policy and attempt creation, moving on when a pool cannot serve it.
Run
Keep the first successful placement under the same sandbox ID.
One sandbox ID. Fresh policy checks. Your requirements stay in force.
Inside creation failoverYour rules, throughout the run.
Control who can create, where workloads can run, what they can do, and which services they can reach.
- Creation
Decide who can create a sandbox and which resources it can use.
- Lifecycle
Control start, stop, update, snapshot and delete permissions independently.
- Provider and account
Apply rules to specific provider pools and account boundaries.
- Individual actions
Authorize commands, file access, port access and credential use.
- Egress proxy
Control outbound destinations and the credentials attached to matching requests.
Policies work together across layers, including during failover. A denied action stays denied.
Explore policy layersConnect your APIs.
Protect your keys.
Control outbound destinations and add credentials at egress, outside the sandbox. Each matching request uses only the connections it is authorized to use.
Network enforcement and credential injection follow the selected provider’s capabilities.
How egress policies workAn outbound API requestWith credential injection
- Sandbox
Makes a request to an allowed API.
- Egress proxy
Checks policy and adds the credential.
Destination + credential authorization - Destination API
Receives the authenticated request.
One interface. The whole lifecycle.
Put your providers to work.
One integration. Your accounts. Your rules.