# Sanbox knowledge base

Step-by-step guides for running AI agents on their own computers: coding agents, secrets and egress, always-on assistants, teams and the EU.

A typed index of every page is at https://sanbox.cloud/kb/sitemap.md.

## Agent computers explained

- [What is an agent computer? Sandbox vs Computer vs VPS](https://sanbox.cloud/kb/agent-computers/what-is-an-agent-computer.md): An agent computer is a persistent, isolated machine that an AI agent owns. It differs from a short-lived code sandbox and from a VPS that you run and maintain yourself.
- [Persistent vs ephemeral sandboxes for AI agents: which do I need?](https://sanbox.cloud/kb/agent-computers/persistent-vs-ephemeral-sandboxes.md): Use an ephemeral sandbox for one-shot code execution. Use a persistent computer when the agent must keep files, packages, browser logins or services between sessions.
- [What survives when an agent's computer stops?](https://sanbox.cloud/kb/agent-computers/what-survives-a-stop.md): On Sanbox, a stop keeps the disk: /workspace, installed packages, Docker images and the browser profile. RAM, running processes, connections and exec commands end.
- [Container, microVM or VM: which isolation for coding agents?](https://sanbox.cloud/kb/agent-computers/container-microvm-or-vm-for-coding-agents.md): Containers share the host kernel. MicroVMs such as Firecracker give each workload its own kernel behind hardware virtualisation. Full VMs do too, with more weight.

## Coding agents in the cloud

- [How do I keep Claude Code running 24/7 and control it from my phone?](https://sanbox.cloud/kb/coding-agents/claude-code-24-7-from-your-phone.md): Run Claude Code on a machine that stays on, in a terminal session that survives disconnects, and reach it from your phone with Remote Control or a browser terminal.
- [How do I run Claude Code on a cloud computer that keeps its files?](https://sanbox.cloud/kb/coding-agents/claude-code-on-a-cloud-computer-that-keeps-files.md): Install Claude Code on a cloud machine whose disk outlives each session. A Sanbox Computer keeps your repository, installed packages and Claude Code settings across stop and resume.
- [How do I run OpenAI Codex on an always-on Linux computer instead of my laptop?](https://sanbox.cloud/kb/coding-agents/codex-on-an-always-on-linux-computer.md): Install the Codex CLI on a Linux machine that stays on, sign in with a device code or API key, and run it in a terminal session that survives disconnects, for example on a Sanbox Computer.
- [How do I run OpenCode as a server on a remote computer?](https://sanbox.cloud/kb/coding-agents/opencode-server-on-a-remote-computer.md): Run opencode serve on a machine that stays on and connect with the OpenCode SDK. A Sanbox OpenCode Computer runs the server privately and gives your app a short-lived URL and token.
- [How do I log in to Claude Code or Codex on a headless server?](https://sanbox.cloud/kb/coding-agents/log-in-to-claude-code-or-codex-on-a-headless-machine.md): Claude Code: paste the sign-in code back, use a claude setup-token token, or an API key. Codex: codex login --device-auth or an API key. Plus where each stores the login.

## Parallel and background work

- [How do I run 10 coding-agent tasks in parallel without them clashing?](https://sanbox.cloud/kb/parallel-work/run-coding-agent-tasks-in-parallel.md): Give each task its own machine. sanbox batch runs every task in a JSON file in its own isolated Sanbox run, so tasks never share files, ports or databases.
- [How do I try three approaches from the same starting point?](https://sanbox.cloud/kb/parallel-work/fork-a-computer-to-try-several-approaches.md): Get one Computer to the starting point, stop it, and fork it three times. Each fork is an independent copy with the same files and packages, so three ideas can run without touching the original.
- [How do I run Docker Compose inside an AI agent's sandbox?](https://sanbox.cloud/kb/parallel-work/docker-compose-inside-an-agent-computer.md): Use a Sanbox Docker Computer: a microVM with its own Docker Engine, Compose and Buildx. Allow your registries, copy the project in, and run docker compose through sanbox exec.
- [How do I preview the dev server my agent is running?](https://sanbox.cloud/kb/parallel-work/preview-your-agents-dev-server.md): Allow the dev server's port on the Computer's template, then run sanbox ports forward to open it on your own machine. HTTP and SSE work; WebSockets, and so hot reload, don't.
- [Run an AI agent on a schedule](https://sanbox.cloud/kb/parallel-work/schedule-a-recurring-agent-job.md): Sanbox starts your agent at the times you choose, with no laptop or server of yours involved. Scheduled runs are enabled per organisation on request; today, any scheduler can call the CLI.

## Secrets, egress and blast radius

- [Give your agent its own computer, not SSH to production](https://sanbox.cloud/kb/security/agent-own-computer-not-ssh-to-production.md): Don't give a coding agent a shell on production. Give it a Computer with staging-only credentials, deny-by-default egress and a snapshot, and review its diff before you deploy.
- [How do I give an AI agent API keys without exposing them?](https://sanbox.cloud/kb/security/api-keys-your-agent-cannot-see.md): Keep the key off the agent's machine. A Secret Proxy stores it and adds it to matching HTTPS requests on the way out, so the agent can call the API but never read the key.
- [How do I restrict which domains an AI agent can reach?](https://sanbox.cloud/kb/security/restrict-which-domains-an-agent-can-reach.md): Use a deny-by-default egress allowlist. On Sanbox, a template's network policy lists the hosts and ports its Computers may reach; a blocked request names the host.
- [How do I use --dangerously-skip-permissions in a disposable computer?](https://sanbox.cloud/kb/security/snapshot-before-skip-permissions.md): Run it in a disposable Computer: snapshot the stopped Computer, run Claude Code with --dangerously-skip-permissions, review the diff, and start fresh from the snapshot if needed.

## Always-on personal agents

- [Mac mini vs VPS vs cloud computer for an always-on AI agent: what does it cost?](https://sanbox.cloud/kb/always-on-agents/mac-mini-vs-vps-vs-cloud-computer.md): Over 12 months a small VPS is cheapest and a Mac mini pays off only over years or for macOS. A managed agent computer adds isolation, snapshots and no server to run.
- [How do I run Hermes Agent in the cloud with memory, skills, an inbox and Telegram?](https://sanbox.cloud/kb/always-on-agents/hermes-agent-in-the-cloud.md): Create a Sanbox Hermes Computer template with the email and Telegram channels, then start one always-on run with an AgentMail address and your Telegram bot. Memory and skills stay on its disk.
- [Where should I host OpenClaw so it keeps running?](https://sanbox.cloud/kb/always-on-agents/where-to-host-openclaw.md): OpenClaw's docs say to use a VPS for 24/7 reliability and a Mac only for iMessage or macOS tools. A one-click OpenClaw Computer on Sanbox is enabled on request.
- [Give your AI agent its own phone number](https://sanbox.cloud/kb/always-on-agents/give-your-agent-a-phone-number.md): Sanbox gives an agent its own phone number, so people can reach it by text message. It's enabled per organisation on request. Today, Hermes Computers take email and Telegram.

## Browser agents

- [How do I keep an agent's browser logged in between sessions?](https://sanbox.cloud/kb/browser/keep-an-agents-browser-logged-in.md): Keep the browser profile on a disk that outlives each session and log in once yourself. A Sanbox Browser Computer keeps cookies and signed-in sessions across stop and resume.
- [Can I watch my AI agent's browser live and take over?](https://sanbox.cloud/kb/browser/watch-and-take-over-your-agents-browser.md): Yes. A Sanbox Browser Computer shows the agent's chat beside its live browser in the console. You can watch each step and take control to complete a sign-in or verification step yourself, then hand back.

## Agents for teams

- [Can someone build our AI agent use case with us? Forward-deployed engineering](https://sanbox.cloud/kb/teams/forward-deployed-engineering.md): Yes. Sanlabs' forward-deployed engineers build AI agent use cases with your team on Sanbox, with experience in aviation, pharma, supply chain and logistics, and internal admin.
- [How do I give every employee their own AI agent computer?](https://sanbox.cloud/kb/teams/agent-computer-for-every-employee.md): Build one team template with a network policy and secret proxies, then start one persistent Sanbox Computer per person with a stable external run ID. Enterprise adds SSO.
- [Can an AI agent create Word, Excel and PDF files in the cloud?](https://sanbox.cloud/kb/teams/agents-that-write-word-excel-and-pdf.md): Yes. A Sanbox OpenCode Computer ships LibreOffice Writer and Calc, pandoc, python-docx, openpyxl, xlsxwriter and reportlab, so an agent can write .docx, .xlsx and .pdf files you download.
- [Trigger an AI agent from Slack, Microsoft Teams or WhatsApp](https://sanbox.cloud/kb/teams/trigger-an-agent-from-slack-teams-or-whatsapp.md): Sanbox connects agent Computers to Slack, Microsoft Teams and WhatsApp, enabled per organisation on request. Email and Telegram work today through Hermes Computers.
- [See and cap what each AI agent spends](https://sanbox.cloud/kb/teams/spend-caps-per-computer-and-team.md): Sanbox shows and caps spend per Computer and per team, enabled per organisation on request. Today, hosting is agreed per organisation and your model provider's limits apply.

## Building agent products

- [How do I give each of my users their own persistent agent computer?](https://sanbox.cloud/kb/build/one-persistent-computer-per-user.md): Create one template for your product and one Sanbox Computer per user, keyed by your user ID. Stop it when they leave, resume it when they return, and use warm pools for fast first starts.
- [How do I make agent computers start instantly?](https://sanbox.cloud/kb/build/warm-pools-and-snapshot-templates.md): Prepare a Computer once, snapshot it, and keep a warm pool of ready copies, so a new Computer can start in under a second. Snapshot templates let you promote or roll back.
- [How do I use my own model endpoint (Azure OpenAI, vLLM, LiteLLM) with an agent computer?](https://sanbox.cloud/kb/build/bring-your-own-model-endpoint.md): Add the endpoint as a Custom OpenAI Proxy with sanbox model-providers create, then build templates on it. Any OpenAI-compatible URL works, such as an Azure OpenAI EU Data Zone deployment.
- [How do I give Supabase users a persistent agent computer that respects RLS?](https://sanbox.cloud/kb/build/supabase-users-get-a-computer.md): Connect your Supabase project to Sanbox once, then create a Hermes Computer per user with their Supabase Auth ID. The user approves access, and every read runs as them under your RLS policies.
- [Use Sanbox from any MCP client](https://sanbox.cloud/kb/build/sanbox-mcp-server.md): The Sanbox MCP server lets Claude, ChatGPT, Cursor and other MCP clients start and use Sanbox Computers as tools. It's enabled on request; today, agents with a shell use the Sanbox CLI.

## Automation and no-code

- [Call an agent computer from n8n, Make or Zapier](https://sanbox.cloud/kb/automation/call-a-sanbox-computer-from-n8n.md): A native Sanbox node for n8n is enabled per organisation on request. Today, self-hosted n8n runs the Sanbox CLI from its Execute Command node, and Make or Zapier can call that workflow.

## EU, GDPR and data residency

- [Where do my AI agent's model calls go? Claude, OpenAI and Mistral EU options](https://sanbox.cloud/kb/eu/where-do-agent-model-calls-go.md): To the provider and endpoint you configure. Claude via Bedrock or Google Cloud, OpenAI or Azure OpenAI with EU residency, and Mistral's EU endpoint keep inference in Europe; the exact scope differs by route.
- [Do I need a DPA for AI agents?](https://sanbox.cloud/kb/eu/dpa-for-ai-agents.md): Usually, yes. If an AI agent processes personal data on a vendor's infrastructure or model, Article 28 GDPR normally requires a DPA with each such vendor, including the model provider.

## Troubleshooting

- [Why can't my AI agent reach a website or package registry?](https://sanbox.cloud/kb/errors/why-cant-my-agent-reach-a-website.md): Sanbox Computers block outbound traffic by default. A blocked request names the host it couldn't reach: add that host and port to the template's network policy and start a new run.

## Comparisons

- [Best EU-hosted sandboxes for AI agents in 2026](https://sanbox.cloud/compare/best-eu-hosted-sandboxes-for-ai-agents-2026.md): Eight ways to run AI agent sandboxes in the EU, compared by contracting company, location, persistence, DPA and price, including where each is stronger.
- [Sanbox vs E2B: E2B alternative with persistent computers (2026)](https://sanbox.cloud/compare/sanbox-vs-e2b.md): E2B gives agents SDK-driven Firecracker sandboxes, billed per second. Sanbox gives each agent a persistent Computer that stays on until stopped, in EU data centres, for a flat plan.
- [Sanbox vs Daytona (2026)](https://sanbox.cloud/compare/sanbox-vs-daytona.md): Daytona offers container, Linux VM, Windows, macOS and GPU sandboxes with five SDKs and per-second pricing. Sanbox gives each agent a persistent microVM Computer in EU data centres for a flat plan.
- [Docker Sandboxes vs a persistent cloud computer for coding agents (2026)](https://sanbox.cloud/compare/docker-sandboxes-vs-a-persistent-computer.md): Docker Sandboxes run coding agents in a microVM on your machine for free, or in Docker's cloud with a one-hour default expiry. A persistent cloud computer runs until you stop it.
- [Claude Code on the web vs your own cloud computer in 2026: what's the difference?](https://sanbox.cloud/compare/claude-code-on-the-web-vs-your-own-cloud-computer.md): Claude Code on the web runs each session in a fresh Anthropic VM cloned from GitHub, included in your Claude plan. Your own cloud computer keeps its disk, services and tools, and runs any agent.

## Auf Deutsch

- [Kann jemand unseren KI-Agenten-Anwendungsfall mit uns bauen? Forward-Deployed Engineering](https://sanbox.cloud/de/kb/teams/forward-deployed-engineering.md): Ja. Die Forward-Deployed Engineers der Sanlabs GmbH bauen KI-Agenten mit Ihrem Team auf Sanbox, mit Erfahrung in Luftfahrt, Pharma, Lieferkette und Logistik sowie interner Verwaltung.
- [Wohin gehen die Modellaufrufe meines KI-Agenten? EU-Optionen für Claude, OpenAI und Mistral](https://sanbox.cloud/de/kb/eu/wohin-gehen-die-modellaufrufe-meines-agenten.md): Zu dem Anbieter und Endpunkt, den Sie konfigurieren. Claude über Bedrock oder Google Cloud, OpenAI oder Azure OpenAI mit EU-Datenresidenz und Mistrals EU-Endpunkt halten die Inferenz in Europa, je nach Weg mit anderem Umfang.
- [Brauche ich einen AVV für KI-Agenten?](https://sanbox.cloud/de/kb/eu/avv-fuer-ki-agenten.md): Meist ja. Verarbeiten KI-Agenten personenbezogene Daten auf der Infrastruktur oder mit dem Modell eines Anbieters, verlangt Art. 28 DSGVO in der Regel einen AVV, auch mit dem Modellanbieter.