> ## Documentation Index
> Fetch the complete documentation index at: https://sandkiln.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Run untrusted AI-generated code safely

> The default, no-configuration-needed path for executing code you don't trust.

This is the case sandkiln is built for: code you didn't write — an AI agent's output, a user upload, a third-party script — needs to run somewhere that a bug or a deliberately hostile payload in it can't reach your own systems.

## The default is already isolated

You don't need to configure anything extra for the baseline isolation guarantee — every sandbox is a real Firecracker microVM with its own kernel, its own filesystem, its own network namespace, the moment you call `Sandbox.create()`. See [The jailer and privilege model](/internals/jailer-privilege-model) for what that boundary actually is and isn't.

<CodeGroup>
  ```ts run-untrusted.ts theme={null}
  import { Sandbox } from "sandkiln";

  const sandbox = await Sandbox.create({ tags: { purpose: "untrusted-exec" } });
  const result = await sandbox.runCommand("python3", ["-c", untrustedCode]);
  // result.stdout / result.stderr / result.exitCode — inspect before trusting
  await sandbox.stop({ keep: false }); // no reason to keep state around for a one-shot run
  ```

  ```python run_untrusted.py theme={null}
  from sandkiln import Sandbox

  sandbox = Sandbox.create(tags={"purpose": "untrusted-exec"})
  result = sandbox.run_command("python3", ["-c", untrusted_code])
  # result.stdout / result.stderr / result.exit_code — inspect before trusting
  sandbox.stop(keep=False)  # no reason to keep state around for a one-shot run
  ```

  ```bash CLI theme={null}
  kiln sandbox create --tag purpose=untrusted-exec
  # prints the new sandbox's id

  kiln sandbox exec <id> python3 -- -c "$UNTRUSTED_CODE"
  # inspect the printed stdout and exit code before trusting them

  kiln sandbox rm <id> --destroy
  ```
</CodeGroup>

## Things worth doing on top of the default

* **Set a resource ceiling.** `vcpu_count`/`mem_size_mib` on create, checked against `SANDKILN_MAX_VCPU_COUNT`/`SANDKILN_MAX_MEM_SIZE_MIB` — stops one sandbox from starving the host.
* **Tag it.** `tags: { purpose: "untrusted-exec", ... }` makes it easy to filter and audit later via `GET /sandboxes?tag.purpose=untrusted-exec`.
* **Destroy, don't preserve, one-shot runs.** `stop({ keep: false })` (or `?keep=false` / `kiln sandbox rm --destroy`) skips the snapshot entirely for a sandbox you never intend to resume — no reason to pay the pause-and-snapshot cost or leave state sitting on disk.
* **For genuinely adversarial workloads, turn on the jailer.** `SANDKILN_JAILER_ENABLED` adds chroot, cgroup v2 resource limits, and a dedicated unprivileged uid per VM — see [The jailer and privilege model](/internals/jailer-privilege-model). It's opt-in and not yet proven against a real installed jailer binary on hardware, so verify it in your own environment before relying on it for something genuinely hostile.
* **Set an idle timeout.** `SANDKILN_IDLE_TIMEOUT_SECS` or `SANDKILN_AUTO_SUSPEND_TIMEOUT_SECS` on the daemon reclaims a sandbox a caller forgot to stop — see [Auto-suspend idle sandboxes](/guides/auto-suspend).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.