Run untrusted AI-generated code safely

​

The default is already isolated

import { Sandbox } from "sandkiln";

const sandbox = await Sandbox.create({ tags: { purpose: "untrusted-exec" } });
const result = await sandbox.runCommand("python3", ["-c", untrustedCode]);
// result.stdout / result.stderr / result.exitCode — inspect before trusting
await sandbox.stop({ keep: false }); // no reason to keep state around for a one-shot run

from sandkiln import Sandbox

sandbox = Sandbox.create(tags={"purpose": "untrusted-exec"})
result = sandbox.run_command("python3", ["-c", untrusted_code])
# result.stdout / result.stderr / result.exit_code — inspect before trusting
sandbox.stop(keep=False)  # no reason to keep state around for a one-shot run

kiln sandbox create --tag purpose=untrusted-exec
# prints the new sandbox's id

kiln sandbox exec <id> python3 -- -c "$UNTRUSTED_CODE"
# inspect the printed stdout and exit code before trusting them

kiln sandbox rm <id> --destroy

​

Things worth doing on top of the default

• Set a resource ceiling. vcpu_count/mem_size_mib on create, checked against SANDKILN_MAX_VCPU_COUNT/SANDKILN_MAX_MEM_SIZE_MIB — stops one sandbox from starving the host.
• Tag it. tags: { purpose: "untrusted-exec", ... } makes it easy to filter and audit later via GET /sandboxes?tag.purpose=untrusted-exec.
• Destroy, don’t preserve, one-shot runs. stop({ keep: false }) (or ?keep=false / kiln sandbox rm --destroy) skips the snapshot entirely for a sandbox you never intend to resume — no reason to pay the pause-and-snapshot cost or leave state sitting on disk.
• For genuinely adversarial workloads, turn on the jailer. SANDKILN_JAILER_ENABLED adds chroot, cgroup v2 resource limits, and a dedicated unprivileged uid per VM — see The jailer and privilege model. It’s opt-in and not yet proven against a real installed jailer binary on hardware, so verify it in your own environment before relying on it for something genuinely hostile.
• Set an idle timeout. SANDKILN_IDLE_TIMEOUT_SECS or SANDKILN_AUTO_SUSPEND_TIMEOUT_SECS on the daemon reclaims a sandbox a caller forgot to stop — see Auto-suspend idle sandboxes.