> ## Documentation Index
> Fetch the complete documentation index at: https://docs.beta.b3os.org/llms.txt
> Use this file to discover all available pages before exploring further.

# Sandbox limits and FAQ

Concurrency, size and lifetime limits for sandboxes in the beta, per-request caps for commands and files, retention, and common questions.

## Limits

Per organization, beta defaults. `GET /v1/limits` shows yours with current usage.

| Limit | Default |
|---|---|
| Sandboxes at once (`sandboxes.concurrent`) | 10 |
| vCPUs per sandbox (`sandboxes.vcpu_max`) | 2 |
| Memory per sandbox (`sandboxes.memory_max`) | 2048 MiB |
| Longest `timeout_s` (`sandboxes.timeout_max`) | 3,600 seconds |

Per request:

| Request | Limit |
|---|---|
| Buffered `exec` | 60 seconds; up to 1 MiB of stdout and of stderr returned |
| Streamed or background `exec` | Up to an hour |
| `exec` stdin | 1 MiB |
| `run_code` | 60 seconds; code up to 1 MiB |
| File read or write | 64 MiB per request |
| Ports | 8 per sandbox |
| Private port URL | Valid from one minute to 24 hours, 10 minutes by default |
| `env`, `secrets` | 256 and 64 variables |
| Terminal, logs stream | Up to an hour per connection |

## Retention

Stopped sandboxes stay listed for 7 days with their final usage. Snapshots are kept for 7 days.

## FAQ

**Does a sandbox have internet access?**

Yes, to public addresses by default, through the node's egress guard. Narrow it with `egress: {"mode": "allowlist", "allow": [...]}` or turn it off with `"deny"`. A sandbox never reaches the node's network, loopback or cloud metadata.
  **What happens when the timeout passes?**

With `on_idle: "stop"` (the default) the sandbox is destroyed, memory and disk included. With `on_idle: "pause"` it is paused instead, so you can extend the timeout and resume it. Extend a running sandbox at any time with `POST /v1/sandboxes/{sandbox_id}/timeout`.
  **How do I keep a sandbox's state for later?**

Take a [snapshot](/sandboxes/snapshots) and create sandboxes from it. Snapshots are kept for 7 days in the beta.
  **Is my sandbox isolated from other customers?**

Each sandbox is a Firecracker microVM with its own kernel, restored with a fresh identity. Its traffic leaves through the egress guard, and its calls to B3OS run with only the scopes you granted it.
  **Why does a call from my sandbox return 421 edge_only?**

Account operations (keys, usage, limits, organizations, projects, the pack registry) live at `https://beta-api.b3os.org`, not on the node. Call them there with a key.
  **Can I get a shell?**

Yes: the terminal WebSocket at `GET /v1/sandboxes/{sandbox_id}/pty`, or `b3os sandbox shell` from the CLI.
  **Can sandboxes use GPUs?**

Not in v0.1. A GPU tier is planned.
  **What does guest_unreachable mean?**

The agent inside the microVM did not answer, usually because the guest hung or ran out of memory. Retry once; if it repeats, delete the sandbox and create a new one, with more memory if the workload needs it.