Using Cloudly

Sandbox and network

Every turn runs in a fresh container that is removed when the turn ends. It runs as a non-root user, with memory, process and capability limits, and sees only the repository and the agent's runtime: never the install directory, the .env file or other runs.

Tools in the sandbox

Every run has Node 22, Bun, Python 3, git and C build tools. To add more, open Settings → Sandbox tools:

• Tick a preset (such as Rust, Go or Java), or
• Edit the setup script directly. It runs as root once, when the image is built, not on every run.

apt-get install -y --no-install-recommends jq

Tick Desktop and browser to give sessions a virtual desktop with Chromium; see Desktop and previews.

Saving starts a build in the background. Runs keep using the previous image until the new one is ready, and a failed build leaves the last good image in place. The agent is told what's installed. Each tool adds roughly 0.3 to 1 GB of disk.

Beyond the repository

Every run also has /files, the repository's kept files, the user's secrets as placeholders, and the tools of any connected MCP servers.

Network access

Run containers have no direct route to the internet and no outside DNS. They can only reach:

• the model APIs, through Cloudly's key gateway,
• the main package registries,
• GitHub,
• the hosts your secrets may be sent to,
• the hosts the agents you add send their keys to, and any others they need,
• and any hosts you add.

This means a malicious repository can't make the agent send data, or your key, anywhere else.

To allow more, open Settings → Network and add hosts, one per line. Subdomains are included, and * allows everything. Changes apply from the next run.

docs.example.com
registry.internal.example.com

Resource limits

Set these in the configuration if the defaults don't fit your VM: