Share feedback
Answers are generated based on the documentation.

Cloud sandboxes

もくじ
メモ

Cloud sandbox support in the sbx CLI is experimental. Features and behavior may change.

Cloud sandboxes run AI agents on Docker-managed infrastructure instead of your local machine. Use them when you need an isolated environment that doesn't depend on the compute resources or virtualization support of your host.

Cloud sandboxes use the same sbx CLI as local sandboxes. Add the global --cloud flag to send a supported command to the Cloud Sandboxes API:

$ sbx --cloud ls

Cloud and local sandboxes have separate state and different capabilities. A cloud sandbox can't mount a host workspace or use host hardware, and its secrets, network policy, ports, and lifecycle are managed in the cloud. See Local and cloud differences before adapting a local workflow.

Prerequisites

To use cloud sandboxes, you need:

Follow Signup and billing to activate cloud access and review compute charges. Then return here to sign in from the CLI and configure your agent.

Sign in from the CLI

Sign in with the same Docker account you used to subscribe:

$ sbx login

Check cloud connectivity and account access:

$ sbx --cloud diagnose

If the check reports that your account doesn't have access, follow Check account access.

Get started

Credentials configured for local sandboxes aren't available to cloud sandboxes. Configure a cloud credential for your agent before launching it. For Claude Code, store an Anthropic API key:

$ sbx --cloud secret set anthropic

See Authenticate cloud agents for other agents and credential options.

Cloud sandboxes expire after one hour by default. On expiration, the service stops sandboxes that can be resumed and deletes the rest. Check the timeout action before relying on a sandbox to retain your work. See Configure expiration.

Create a sandbox without attaching, allowing access to GitHub for this example:

$ sbx --cloud create --name cloud-project --allow-network github.com:443 claude

Cloud sandboxes don't accept a local workspace path. Clone the public Welcome to Docker repository inside the sandbox:

$ sbx --cloud exec cloud-project git clone \
    https://github.com/docker/welcome-to-docker.git /home/agent/workspace/project

Attach to the agent:

$ sbx --cloud attach cloud-project

Ask Claude to inspect /home/agent/workspace/project and write a description of the application to /home/agent/workspace/review.md. When the file is ready, press Ctrl+\ to detach and leave the agent running.

Copy the result to your machine:

$ sbx --cloud cp cloud-project:/home/agent/workspace/review.md ./review.md

Read the result, then remove the sandbox when you're finished:

$ sbx --cloud rm cloud-project

Removal deletes files stored only in the sandbox. For your own projects, see Transfer files and Authenticate cloud agents before cloning private repositories.

Learn more