Sandbox Hub

Sandbox Hub

Sandbox Hub (/sandbox) is where you turn sandboxes on or off for your account. Each sandbox is a card: its own tool, instruction, and container. Servers stay in the operator's profiles file. A card does not show the server URL or API key. Admins see image status on the card. The image name stays in Settings.

On desktop, open the sandbox icon in the left sidebar. On mobile, open More, then Sandbox. The icon and the page appear when at least one sandbox server is configured.

Turn a profile on or off

1. Open Sandbox Hub.
2. Use the switch on a profile. On means that profile can be added to an assistant. Off removes that tool and its instruction from every assistant at once. You do not edit each assistant.
3. In a chat, open the tool picker and enable the profiles that assistant should be able to call. A profile that is off in Sandbox Hub is not in the picker.

The Servers area above the sandboxes shows each server with its status: Online, Unreachable, API key missing, or API key rejected. Admins see every configured server. Other users see the servers their sandboxes run on.

The card shows the profile name, description, and a short summary: resources, network, lifetime, server, and, for an admin, image status. Choose the card to open the details. Instruction, environment variables, files, the persistent folder, and prepare image are in that dialog. The switch and the admin menu stay on the card.

A profile whose server is missing its API key stays listed and cannot run. If that profile is still on, you can turn it off. You cannot turn a broken profile on.

If the list fails to load, the page says so. Retry later. A saved off switch is not treated as on while the list cannot be read.

Add or edit a profile

Only accounts listed in SANDBOX_HUB_ADMINS see these controls. The value is a comma-separated list of user ids or emails. An email matches the account email regardless of case. Recreate the ChatHub container after you change the variable. Setup is Sandbox (OpenSandbox).

Add sandbox creates a profile. The gear (Settings) edits one. The avatar can be an emoji you pick or generate from the name and description, an uploaded image, or an image URL. Move up, Move down, and Delete are in the more menu. A blank image, CPU, memory, network, or time limit inherits the matching OPENSANDBOX_* value, shown as the placeholder. Memory without a unit is in GiB: 2 saves as 2Gi. The id is lowercase letters, digits, and single hyphens, at most 16 characters, and it cannot change later. Moving a profile changes tool and prompt order.

general cannot be deleted, and neither can the last profile. Deleting any other profile also removes its saved instruction, its environment variables, its files, and every user's on/off choice. Running background jobs for that profile are lost. Creating the same id again does not restore that instruction, those variables, those files, or those choices.

Prepare image is in the card's details. It pulls the profile's current image on its server before the first user call. The card shows preparing, ready, or failed. A large image can take up to 15 minutes. The server must allow a sandbox lifetime of at least 20 minutes (max_sandbox_timeout_seconds). Changing the image, network, or server replaces that profile's open containers on the next call.

The extra instruction in settings is the same text as Edit on the card. View on the card shows the full instruction the model receives. See the next section.

Model instructions

Any signed-in user can show a profile's model instruction. Open the card, then choose View. That shows the text the model receives. Admins see Edit on every profile, including Sandbox. Edit changes only that sandbox's extra instruction. It does not replace the General instruction, and the instruction base stays whatever is selected in settings.

General instruction is on the Sandbox Hub page, next to Add sandbox. It is the instruction for every sandbox whose instruction base is Added after the General instruction, including Sandbox. Only the text below does not use it. Extra instruction on a sandbox is added after the General instruction and stays on that sandbox. Saving the General instruction changes every sandbox that still uses it, on its next turn.

Only Sandbox Hub admins can change it. When SANDBOX_HUB_ADMINS is unset, the instruction is read-only and the page says to set it.

1. Open Sandbox Hub. Choose General instruction next to Add sandbox for the shared text. Open a card and choose Edit to change that sandbox's extra instruction only.
2. Save replaces that text for every user on this server. The next turn uses it.
3. Reset to default on the General instruction restores its starting text. Reset to default on a card removes that sandbox's extra instruction. Neither restores a later edit of the profiles file.

Do not put secrets in the instruction. Every signed-in user can read it, and the model receives it.

A token such as {{date}} is filled in before the model sees it. A value that changes also changes the prompt cache for chats that use that profile.

A later change to the built-in General instruction does not replace a saved General instruction. Reset it, or edit it again, to pick up the new starting text. A card's extra instruction is only that sandbox's own text.

The General instruction must be non-blank and at most 32 KiB. A card's extra instruction can be empty.

Environment variables

Open a profile card and choose Manage on Environment variables.

Shared variables apply to every user of that profile. Only Sandbox Hub admins can add, replace, or delete them. Your own variables apply only to your sandboxes. A variable of yours with the same name as a shared one is the one your sandboxes get.

A name is capitals, digits, and underscores, starting with a letter or underscore, at most 64 characters. PATH, HOME, HOSTNAME, PWD, SHELL, USER, LD_PRELOAD, and LD_LIBRARY_PATH are reserved, and so are names starting with OPENSANDBOX_, EXECD_, or CHATHUB_. A value is at most 8 KiB. Each side (shared, and your own) holds at most 32 variables. A sandbox receives at most 64 KiB of them; a name that does not fit is left out.

Each variable has Sensitive, checked by default. A checked value shows a hint (the last 4 characters when it is 12 or longer) and is not sent to the browser. Replace starts empty. Clear the box for a URL or a mode: the page shows the full value, and Replace opens with that value filled in so it can be edited. Clearing the box on a value that was already sensitive does not reveal it; type the new value and save. Command output hides only sensitive values, as [secret:NAME].

Until KEY_VAULTS_SECRET is set on the ChatHub server, the profile card says the feature is off and a save is refused. Setup is Sandbox (OpenSandbox).

A shared value can be read by every user of that profile, because the sandbox and the model can read it. Do not put a secret there that those users should not have.

Saving or deleting a variable replaces the sandbox of every conversation that uses this profile (for a shared variable, every user's) on that conversation's next command, Python, file, or startJob call. Files and running background jobs in the old sandbox are lost. Until that call, a running job keeps the values it started with. Command output from that job hides sensitive values it started with and the current sensitive values. The contents of a file the sandbox writes are not hidden. A job that was already running when you upgraded to this version is hidden using only the current values.

Files

Open a profile card and choose Manage on Files.

Shared files apply to every user of that profile. Only Sandbox Hub admins can add, replace, or delete them. Your own files apply only to your sandboxes. A file of yours at the same path as a shared one is the one your sandboxes get.

A path is absolute, such as /root/.oci/config, at most 255 characters of letters, digits, and . _ - @ +. It cannot be inside /tmp/workspace, /proc, /sys, or /dev. The mode is three octal digits. The page offers 600, 640, 644, 660, and 400. The default is 600. A file is 1 byte to 64 KB. Each side (shared, and your own) holds at most 16 files.

Each file has Sensitive, checked by default. A sensitive file never comes back to the browser: Replace starts empty, and leaving the content untouched changes only the mode and the Sensitive flag. Clear the box for a config you want to edit: the page shows the text, and Replace opens with that text filled in. Clearing that text and saving is refused, and the dialog stays open. Command output hides sensitive text as [secret:FILE]. A line shorter than 16 characters is hidden only when the whole file is printed.

Until KEY_VAULTS_SECRET is set on the ChatHub server, the profile card says the feature is off and a save is refused. Setup is Sandbox (OpenSandbox).

A shared file can be read by every user of that profile, because the sandbox and the model can read it. Do not put a secret there that those users should not have.

Saving or deleting a file replaces the sandbox of every conversation that uses this profile (for a shared file, every user's) on that conversation's next command, Python, file, or startJob call. Files and running background jobs in the old sandbox are lost. Command output from a job hides the sensitive file text it started with and the current text. A job that was already running when you upgraded to this version is hidden using only the current text.

Persistent folder

Open a profile card. When that profile keeps a folder, the details show the path and Empty.

Files you save there are yours and stay after the sandbox is removed. Another user of the same profile has a separate folder. Your conversations on that profile share yours. Anything outside the folder is still removed when the sandbox goes idle.

Empty asks you to confirm, then deletes everything in your folder. Those files also disappear from containers that are still running. The empty folder remains. You can empty it while the profile switch is off. Success says Emptied. A failure shows the server message. If the image is not on the server yet, an admin runs Prepare image first. The host, the server image, and how to remove leftover volumes are in Sandbox (OpenSandbox).

Admins turn this on in Settings, under Persistent folder. Enable Keep a folder for each user. Mount path defaults to /persist. It is an absolute path of letters, digits, and . _ - @ +. It cannot be inside /tmp/workspace, /proc, /sys, /dev, /bin, /boot, /etc, /lib, /lib32, /lib64, /libx32, /run, /sbin, /tmp, /usr, or /var, and it cannot be /root, /home, /mnt, /opt, or /srv itself. /persist, /root/persist, /data, and /mnt/data are allowed.

Changing the path keeps the files and mounts them at the new path. Turning the folder on or off, or changing its path, replaces that profile's open containers on the next call, and its running background jobs are lost. Turning the folder off or deleting the profile leaves the volume on the OpenSandbox host.

Do not put a secret in the folder. The host stores it unencrypted. Saving a Hub file inside the folder is refused. A file saved there before the folder was turned on is left out of new sandboxes.

Background jobs

Jobs the model starts with startJob are listed on this page, across conversations. Running lists jobs that are still running. Finished lists every other status, 20 per page. A row shows the status, the first line of the command, the profile, when it started, and the job id.

The refresh icon (tooltip Refresh) reloads the list. A running job has Cancel job. Cancel stops it and keeps the output and files it has produced so far. Purge on Finished deletes every finished job for this account: succeeded, failed, timed out, cancelled, and lost. After Purge the assistant can no longer read that job with getJobResult. Files the job kept stay in your files.

Statuses are running, succeeded, failed, timed out, cancelled, and lost. Lost means the sandbox was gone before the job finished.

Turning a profile off stops that profile's running jobs.

The result is not shown here. Ask in the conversation that started the job. Limits and the worker are in Sandbox (OpenSandbox).

When nothing is listed

The operator has not configured a sandbox, the Hub has no profile that can run, or SANDBOX_PROFILES_FILE is invalid. An invalid file configures no servers, even when OPENSANDBOX_SERVER_URL and OPENSANDBOX_IMAGE are set. Setup is Sandbox (OpenSandbox).