Sandbox limits and FAQ
Concurrency, size and lifetime limits for sandboxes in the beta, per-request caps for commands and files, retention, and common questions.
Limits
Per organization, beta defaults. GET /v1/limits shows yours with current usage.
| Limit | Default |
|---|---|
Sandboxes at once (sandboxes.concurrent) | 10 |
vCPUs per sandbox (sandboxes.vcpu_max) | 2 |
Memory per sandbox (sandboxes.memory_max) | 2048 MiB |
Longest timeout_s (sandboxes.timeout_max) | 3,600 seconds |
Per request:
| Request | Limit |
|---|---|
Buffered exec | 60 seconds; up to 1 MiB of stdout and of stderr returned |
Streamed or background exec | Up to an hour |
exec stdin | 1 MiB |
run_code | 60 seconds; code up to 1 MiB |
| File read or write | 64 MiB per request |
| Ports | 8 per sandbox |
| Private port URL | Valid from one minute to 24 hours, 10 minutes by default |
env, secrets | 256 and 64 variables |
| Terminal, logs stream | Up to an hour per connection |
Retention
Stopped sandboxes stay listed for 7 days with their final usage. Snapshots are kept for 7 days.
FAQ
Yes, to public addresses by default, through the node's egress guard. Narrow it with egress: {"mode": "allowlist", "allow": [...]} or turn it off with "deny". A sandbox never reaches the node's network, loopback or cloud metadata.
With on_idle: "stop" (the default) the sandbox is destroyed, memory and disk included. With on_idle: "pause" it is paused instead, so you can extend the timeout and resume it. Extend a running sandbox at any time with POST /v1/sandboxes/{sandbox_id}/timeout.
Take a snapshot and create sandboxes from it. Snapshots are kept for 7 days in the beta.
Each sandbox is a Firecracker microVM with its own kernel, restored with a fresh identity. Its traffic leaves through the egress guard, and its calls to B3OS run with only the scopes you granted it.
Account operations (keys, usage, limits, organizations, projects, the pack registry) live at https://beta-api.b3os.org, not on the node. Call them there with a key.
Yes: the terminal WebSocket at GET /v1/sandboxes/{sandbox_id}/pty, or b3os sandbox shell from the CLI.
Not in v0.1. A GPU tier is planned.
The agent inside the microVM did not answer, usually because the guest hung or ran out of memory. Retry once; if it repeats, delete the sandbox and create a new one, with more memory if the workload needs it.