Run code you didn't write. Throw the room away after.
The isolation primitive of the estate: a disposable, contained room for agent-generated and user-submitted code — behind a front door that serves today, with every gate to the rest stated in the open.
Agents write code now — patches, scripts, whole services — and every product built on them hits the same wall at the same moment: the code a model returns is worthless until it executes, and executing it anywhere that matters hands a shell to a text generator. The same wall stands in front of anyone accepting user-submitted code: the online IDE, the eval harness, the plugin platform, the grading pipeline. The traditional answer is a containment practice the builder assembles and operates — container images, syscall policy, egress rules, resource policing, an incident plan for the day the wall leaks. The market's newer answer is the right one: isolated execution sold as a primitive. More than one credible vendor now sells that primitive, which is evidence the category is real — and none of them sits where this door sits: inside the estate whose own agents are the natural first tenants, one gateway hop from the callers that need it.
The tax lands hardest exactly where the estate's whole premise lives: on builders too small to carry a security practice. If agents write software, the machine economy needs a place where software runs before it is trusted — and that place has to be a primitive you call, not a department you staff. Execution and trust have to be separable, or every agent ships with a security team attached.
Three things in this estate are the substrate itself: the studio, the platform, and the runtime. This is deliberately not a fourth. sandbox.do is the isolation primitive the platform operates — and the second door of the execution subcategory, split from its sibling by one rule:
If you wrote the unit and trust it, it belongs at functions.do — a thin stub in shared warm runtimes, where sharing is the whole economics. If you didn't write it — an agent did, a user did, a repo did — it belongs here, inside a wall where nothing is shared across the tenant boundary and the room is destroyed after use. Shared-by-design versus isolated-by-design; deploy-once-durable versus create-run-destroy. One subcategory, two doors, zero overlap by construction.
The other seams are just as sharp. agents.do is where an agent lives; sandbox.do is the room the agent is handed when its work product has to run somewhere that is not production. database.do holds state that must outlive every request; this door's database containers are its deliberate opposite — Postgres, SQLite, or DuckDB that exist precisely so their state can die with the room: test fixtures, scratch analytics, a schema an agent is about to mangle.
In the estate's own registry the coordinate is exact: noun Sandbox, verb sandbox, type primitive, subcategory execution, priority P1.
import { getSandbox } from '@cloudflare/sandbox'
import { createClaudeCodeSandbox } from '@dotdo/sandbox/agents/claude-code'
const claude = createClaudeCodeSandbox({
sandbox: getSandbox(env.CLAUDE_CODE_SANDBOX, sessionId),
permissionMode: 'acceptEdits',
})
await claude.init() // the room opens
const result = await claude.runOnRepo( // untrusted work runs inside
'https://github.com/user/repo',
'Add unit tests for the auth module',
)
await claude.close() // the room is gone
The engine's design — stated here as the built, public architecture it
is, with its gates below, never as a live self-serve promise: sandboxes
are Cloudflare Containers addressed through Durable Objects. Agent rooms
run a coding agent — Claude Code, OpenCode, or Codex — with a shell, a
filesystem, and repo access behind init / run / exec / readFile / writeFile / close. Database rooms run Postgres, SQLite, or DuckDB
behind connect / query / execute / transaction / close, with
parameterized statements and typed results. Every room carries its
limits as properties — instance caps, an idle sleep, a command timeout —
so containment is what the caller gets, not what the caller must
remember to enforce. A WebSocket RPC client and a REST control plane
wrap the same lifecycle for remote callers.
The engine is public: github.com/dot-do/sandbox — agent sandboxes for
Claude Code, OpenCode, and Codex; Postgres, SQLite, and DuckDB
containers; the RPC client and REST control plane; per-image
Dockerfiles; and unit, E2E, and integration suites, with E2E running
against Cloudflare preview deploys. A claim about code, evidenced as
code — not a claim that any hosted surface serves it yet.
Concreteness over adjectives: each door below was checked cold on 2026-07-30 and carries its own state and its own evidence URL — never one URL evidencing several domains. Serving is a liveness fact, not a tenancy claim: nothing here asserts external tenancy, metered billing in production, or a usage roll. Those publish behind their own gates.
sandbox.do serves. The front door a builder would resolve is live — a
generated door of the platform's marketing family — and it sells exactly
this record's offer in its own words: "Execute Untrusted Code Securely
at the Edge," running user-submitted code, building online IDEs, and
testing scripts safely. (The page also headlines performance figures;
this record adopts none of them — see the benchmarks gate below.)
The gateway routes this primitive as a named service today: GET https://apis.do/sandbox returns a machine-readable JSON record — no
login, no signup — naming the service, its domain sandbox.do, its
category compute, and its status available.
The engine repo is public and resolvable cold — the same URL any evaluator, human or agent, can read before trusting a wall with their untrusted code.
Four ambers, worn in the open — each the exact distance between what serves and what this door intends to be. (The figures gate on the economics slide is the estate's standing stack#1 §A5 disclosure rule, carried by every record in the portfolio — an estate gate, not a fifth product amber.)
The domain's own machine door does not yet speak the machine's
language: the gateway's service record points callers at
sandbox.do/api as this service's own API (links.also), but that
path serves the human marketing page today — not a structured envelope,
not even a typed 404. A machine that resolves this primitive finds a
door with no machine handle at all. The claim flips when the catalog
serves at that address.
The engine's REST control plane and RPC endpoint — the POST /api/agents, /api/databases, and wss://sandbox.do/rpc surfaces the
public repo documents — do not serve at the apex today: /health and
/api/agents return 404, checked cold 2026-07-30. Until this gate
flips, the hosted product is roadmap and the repo is the product — and
no latency, memory, or capacity figure appears in this record, including
the ones the front door itself headlines, until benchmarks publish with
their method and window.
The package the README's own install command names is not yet published
— the npm registry returns 404 for @dotdo/sandbox, checked
2026-07-30. The repo builds and tests in the open; the claim flips when
the package resolves.
The estate's own domain registry files sandbox.do at status planned, priority P1 — filed before the door lit, and the door now serves. The estate does not round up its own books from a deck: the filing is declared here at face value, and this claim flips when the registry does.
Primary motion is B2D: the buyer is a developer who evaluates in the docs and the public repo, and converts at the first contained run — untrusted code in, result out, room destroyed, nothing leaked. No sales motion, no demo call, no procurement. Secondary is B2A, and this is the one door in the pack where the machine motion is structural rather than aspirational in shape: the agent that writes the code is the caller that needs the room, so the buyer and the user converge in the same machine. The first step of that motion already serves — the gateway returns this service's record to a caller with no login — and everything after it gates on the machine door and control plane ambers above, exactly as the sibling records state for theirs.
Layer-1 economics at the trust boundary: rooms are designed to be metered while occupied — that is the intended model, and the rate card binds when it posts — and are destroyed after use: no idle reservation to sell, no tenancy to babysit, and the buyer's alternative is not a cheaper vendor but a staffed security practice, which is the margin.
Disposability is the economic design, not just the safety design: a room exists only while code runs in it, sleeps when idle, and is destroyed at close, so capacity follows demand instead of reservations — the caller never pays to hold an empty jail, and the operator never carries one. The pricing power comes from what the primitive replaces: the comparison in the buyer's head is not another line item but the containment practice they would otherwise have to assemble, operate, and answer for. And there is no regulatory floor anywhere in this function — nothing in destroying a container reserves a step for a statutory person — so the implementation mix migrates all the way to Code.
Sandbox counts, execution volumes, and the internal-versus-external split are gated. Each figure publishes with its window and base or it does not publish.
the estate’s own runtime, agents.do, is the natural first tenant — every agent the estate deploys needs a room for the code it writes, so first demand is structural, generated by the portfolio’s construction rather than bought; the usage roll publishes behind its stack#1 §A5 gate or not at all
the estate’s gateway already routes /sandbox as a named compute service to a machine with no login — when the buyer is an agent, being discoverable and callable IS the distribution channel
coding agent, shell, filesystem, repo access, and a disposable database in one primitive — the point-solution alternative is an execution API glued to a separately rented store, which re-creates the integration burden the builder came here to delete
the repo is public: an evaluator can read the wall before trusting it, and a security-sensitive buyer can audit rather than believe — the strongest posture available to a containment vendor, and this door already holds it
The claim ledger lives on the "What serves today" and gates slides — one posted chip per live door, one amber per gate, each stated once. This slide is the evidence in kind: what a machine actually receives when it resolves this primitive, retrieved cold on 2026-07-30 with no login and no signup.
The gateway's service record. GET https://apis.do/sandbox returns
this envelope (abridged — the gateway's own header block, the
caller-context block, and the extra link keys are omitted; every key and
value shown is verbatim from the live response):
{
"service": {
"name": "sandbox",
"domain": "sandbox.do",
"url": "https://sandbox.do",
"description": "Sandbox Service",
"category": "compute",
"status": "available"
},
"links": {
"self": "https://apis.do/sandbox",
"also": "https://sandbox.do/api",
"category": "https://apis.do/categories/compute"
}
}
Note links.also: the gateway itself points machine callers at
sandbox.do/api as this service's own door.
What that door serves today. GET https://sandbox.do/api answers
with the front door's human marketing page — HTML, not an envelope. For
a primitive whose secondary motion is machine callers, that is the
deck's most important amber, shown here as behavior rather than
restated as a chip: the gate on the gates slide flips when a structured
catalog replaces the page at that address.
The front door is sandbox.do — it serves today, and the engine repo
is public.
If this was forwarded to you: sandbox.do is the isolation primitive of the startups.studio estate's infrastructure layer — the disposable, contained room where code nobody vouches for gets to run. It is deliberately not one of the estate's three substrate properties, and its deck says so; it is the walled counterpart of the execution primitive, split from it by a single rule of trust: functions.do runs the unit you wrote, this door runs the code you didn't. What is live is posted with a URL checked cold — the front door, the gateway's service record, the public engine repo — and what is not is pending with the gate that flips it, including the four ambers it wears openly: the machine catalog, the routed control plane with its benchmarks, the unpublished package, and a registry that still files the door as planned. Judge it by what is posted, and by how plainly it labels what is not.