Sandboxes

Choose a sandbox

Decide where each project's agents run, Docker, Cloudflare Containers or the host, and what each option protects.

Agents run commands without asking (bypassPermissions), so where they run matters. Each project picks a sandbox provider. Docker is the default when docker.enabled is on; Cloudflare runs workspaces in the cloud; the host runs agents as your user.

	Docker	Cloudflare	Host
Set with	`sandbox.provider: docker`, or `docker.enabled: true`	`sandbox.provider: cloudflare`	`sandbox.provider: host`, or `docker.enabled: false`
Runs on	This Mac or the server	Cloudflare Containers, through your bridge Worker	This Mac or the server, as the user
Filesystem	Only the workspace is mounted; read-only root	The workspace lives in Cloudflare	Everything the user can reach
Network	Default-deny, allowlist proxy; a network per task; GitHub and registries read-only	Default-deny, the same allowlist	Unrestricted
Model and tracker keys	Never enter the container (the egress proxy adds the model credential)	Never enter Cloudflare (relayed from the host)	In the process environment
Hooks	In a disposable container	In the sandbox	On the host
Git on agent files	In an offline throwaway container	In the sandbox, verified bundles	On the host
Browser, preview, terminal	Yes	Yes	Yes (preview at the app's own port)
Linked services next to the agent	Yes	Not yet; use a hosted `url:`	No
Needs	Docker and the agent image	A deployed bridge and its token	Nothing

Host mode is high-trust

Without a sandbox, an agent with bypassPermissions can run any command as you, read your files and reach your network. The Workflow inspector shows High-trust: commands run on your Mac without approval. Use it only with repositories you trust. On the Mac it's off until you allow it per project; on a server it isn't possible. See The sandbox floor.

Set the provider#

In the Workflow tab, Settings → Sandbox → Run agents in offers Docker, Cloudflare, and None (runs on the host). Or edit WORKFLOW.md:

WORKFLOW.md

sandbox:
  provider: docker          # docker | cloudflare | host
  network:
    mode: allowlist         # default
    allow: [api.stripe.com]
  hooks: sandbox            # default
  read_only_root: true      # default

The sandbox floor#

WORKFLOW.md lives in the repository, where agents can edit it on their task branch, so it doesn't get the last word on isolation. Each host has a floor:

	Mac app	`harnessd`
Agents must run in Docker or Cloudflare	By default	Always
Not allowed	`sandbox.provider: host` (or `docker.enabled: false`), `sandbox.hooks: host`, `docker.extra_args`, `docker.network`, `sandbox.read_only_root: false`	The same
Turn it off	Per project: Edit Project → Allow agents to run directly on this Mac	Not possible

A project below the floor pauses. Its header shows sandbox_policy: followed by what isn't allowed and how to fix it, for example agents must run in a sandbox here: add docker: { enabled: true }. On the Mac the message also points at the Edit Project setting. The project resumes once WORKFLOW.md is fixed or the setting changes. On a server, saving a WORKFLOW.md below the floor is refused.

Allow agents to run directly on this Mac is stored in the app's own project list, not in WORKFLOW.md, so an agent can't turn it on. With it on, everything above is allowed for that project, and hooks and agents without a sandbox run as you. Projects on a server follow the server's floor.

What every sandbox shares#

An allowlisted network. Agents reach package registries and source hosts from the host-wide list, the project's own hosts, their model (through a relay) and SI Fabrik's tracker tools. Cloud metadata endpoints are always blocked. See Network policy.
Model credentials outside the sandbox. Docker and Cloudflare sandboxes hold only a placeholder; SI Fabrik's relay adds the real key. See Agent credentials.
Read-only GitHub and package registries (Docker). Agents can clone and install, but not push or publish.
Tracker tools on the host. Agents never hold tracker tokens.
Branch delivery that never runs git on the host in an agent-controlled directory. See Branches and pull requests.
Blocked hosts reported on each run with an Allow button.

The Sandboxes screen#

Open Sandboxes (⌘4) in the sidebar. It shows where agents run: disposable Docker containers on this Mac or on your servers, or Cloudflare Containers through a bridge.

Docker: engine status, the agent and browser images with Build, and the containers SI Fabrik started, with logs and a stop button.
Cloudflare: the bridge's health, the relay, agents running in Cloudflare, and kept workspaces.
Servers: each connected server below this Mac, with the same cards. See Server sandboxes.