Sandbox

stack: app
services:
  sandbox:
    recipe: sandbox
    # its defaults, each a field you can set:
    # image: ghcr.io/briq-cloud/sandbox:latest
    # size: small
    # volume: { gb: 2 }

briq_run({ recipe: "sandbox", wait: true })

curl -X POST https://api.briq.cloud/v1/briqs \
  -H "Authorization: Bearer $BRIQ_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "recipe": "sandbox",
    "wait": true
  }'
# → { "briqs": [{ "id": "bq_…", … }], "outputs": { "SANDBOX_HOST": "…" }, … }

# ... when done, for each briq id
curl -X DELETE https://api.briq.cloud/v1/briqs/<id> \
  -H "Authorization: Bearer $BRIQ_API_KEY"

When to use it

• Code the agent wrote, or code it does not trust, that should not run on your computer: a script, a test suite, a build, a tool to try.
• Code that needs a real service: a Postgres or a Redis in the same stack.
• Work that should stop on its own: the sandbox sleeps after its sleep window, and costs nothing asleep.

Step by step: Run code in a sandbox.

Tips

• Files in, commands, files out: briq_files_put to /work/…, briq_exec with ["sh", "-c", "cd /work && …"], briq_files_get for what it wrote. Over a minute: async: true (Run a long command).
• A repo: git clone it from inside with briq_exec. Uploads are capped at 1 MB a file.
• What the image has: every tool and its version on the sandbox reference. image: "ghcr.io/briq-cloud/sandbox:full" adds document and media tools, the Python data libraries and a browser. Another image: "golang:1.25", "ubuntu:24.04", anything with sh.
• Credentials as secrets: env: { GITHUB_TOKEN: { secret: "GITHUB_TOKEN", value: "…" } }. The commands read $GITHUB_TOKEN; status and audit show its name only. Make the token for the task (read-only, expiring), never a key to your cloud: the code runs with an open internet.
• A server it starts gets a URL: expose: "private" at run; whatever listens on $PORT (8080) serves at URL.
• Prepare once, run many: install the dependencies, then briq_fork for each attempt. The forks start with /work as it was.
• small for scripts and tests; medium or large for a build.
• It can reach the internet and the team's other briqs: see Security.