Every Agent runs its commands inside a sealed sandbox, never on the server itself. Two engines can build that sandbox. Which one you can use depends on one thing: does the server give access to CPU virtualization (KVM)?
The CPU hardware builds the wall. Each Agent gets its own Linux kernel.
/dev/kvm on the serverA Linux kernel written as a normal program catches every request from Agent code.
Same for both: the same signed images, the same /workspace, the same network rules through our egress proxy. Agents cannot tell which engine they run on.
A physical machine. Best speed and the most Agents per server.
The hypervisor passes virtualization into the VM. Works, but it is a VM inside a VM. The cloud or hypervisor admin must enable it.
Most ordinary cloud VMs and managed Kubernetes nodes. Firecracker cannot start here.
| Install type | Bare metal | VM + nested virt | VM, no nested virt |
|---|---|---|---|
| Docker Compose | Firecracker | Firecrackerslower | no local sandboxesRun the sandbox Runner on a separate KVM host |
| Kubernetes (#657) | gVisor | gVisor | gVisorthe main target |
Kubernetes nodes are usually cloud VMs without KVM, and SecondBox supports only its gVisor Runner as a Kubernetes pod. So the Kubernetes install needs no virtualization at all.
“We have an ordinary cloud VM.”
Kubernetes install with gVisor. It runs anywhere.
“We run many Agents.”
Bare metal with Firecracker: the fastest and strongest option.
“We run our own hypervisor.”
Enable nested virtualization to get Firecracker; otherwise use gVisor.
Most v3.0 Agent Platform features run in the Agent Platform worker and need no SecondBox. A sandbox is needed only for workspace computation and what is built on it: shell and files, files returned to chat, the browser, Sites, the workspace file browser, and Git, gh and SSH commands.
Runs every Agent turn. With it off, none of the features below work, with or without a sandbox.
Also needed for Jobs (scheduled Tasks) and memory dreaming.
Turns off only the rows marked Needs sandbox. The Agent editor shows those tools as unavailable.
| Feature | Without sandbox | Notes |
|---|---|---|
| Personal Assistant (agentic profiles, 1:1 chat) | Works | Chat files, Collections, Memory, Project context and MCP connectors are tools in the worker |
| Named Agents (directory, direct threads, Workbench, lifecycle, Access tab, budgets) | Works | |
| Project Assistant and named Agents in Projects | Works | Mentions and attributed answers |
| Agents consulting each other; delegation to named Agents | Works | |
| Parallel helpers | Works | Helpers use the parent's workspace only if it is open |
| Workspace management (find and summarize chats, organize Projects, drive other models and Agents, manage named Agents) | Works | "Workspace" here means the Chat workspace, not the sandbox |
| Memory (shared across Chat and DMs, recall by meaning, change log, undo, approval) | Works | |
| Memory dreaming | Works | Needs the scheduler and the agent-platform-memory-dreaming org key |
| Jobs / scheduled Tasks, including Task management from channels and by named Agents | Works | Needs the scheduler; a Job whose instructions need computation still fails without the workspace |
| Slack and Telegram channels (DMs, named-Agent bots, groups, open rooms, thread follow, album batching, voice transcription) | Works | |
| Live plans, tool activity, helper progress, guardrails panel, turn cost | Works | |
| Share links and read-only invitations | Works | |
| Waiting for capacity, compaction, bounded failures | Works | |
| Temporary Agent chats | Works |
| Feature | Without sandbox | Notes |
|---|---|---|
| Provider-hosted web search and metered gateway web search | Works | |
| Hosted image generation | Works | Generated images are published without a workspace |
Inline HTML pages (show_html) | Works | |
| Inline MCP apps | Works | |
| Connected accounts: Google Workspace, Microsoft 365, Outline, custom OAuth/MCP, GitHub REST and GraphQL tools | Works | Called through Integrations, no shell |
| Skills | Partly | Instruction-only Skills work. Supporting files and scripts, and creating private Skills from archives, need the workspace |
| File attachments to Agents | Partly | Supported uploads work through extraction. Archives, other file types, PDFs without extracted text and view_image need the workspace |
| Publishing to Collections | Partly | Chat files work. Files the Agent writes go through send_attachment, which needs the workspace |
GitHub Git/gh commands, SSH servers, credentialed HTTP commands | Needs sandbox | Also needs Integrations |
| Workspace: shell, files, code, data, office, PDF, OCR and media toolchain | Needs sandbox | |
send_attachment (Agent returns files to chat or channel) | Needs sandbox | |
| Workspace file browser in the composer | Needs sandbox | |
| Headless browser and live browser view with take-over | Needs sandbox | |
| Sites | Needs sandbox | Publish and import need the workspace; list and visibility do not. Also needs SITES_INSTALLATION |
| Per-Agent Internet access switch | Needs sandbox | Mainly controls the workspace |
| Workspace model calls billed to the chat budget | Needs sandbox |
| Feature | Without sandbox | Notes |
|---|---|---|
| Agent directory, Agent Activity, retiring Agent credentials, analytics delegation | Works | |
| Connections page, Integrations administration | Works | |
| Piloting Agent Platform with selected users and teams | Works | Next release |
| Agent workspaces section (policy, quotas, Monitoring) | Needs sandbox |
| Feature | Without sandbox | Notes |
|---|---|---|
Agent Claude credentialed Git/gh/HTTP commands | Needs sandbox | Run in a disposable SecondBox workspace |
| ChatGPT subscription providers and the OpenAI OAuth credential broker | Works | Platform feature in SecondGate |
| SecondGuard guardrails | Works | Platform feature |
Before turning this on: it is not yet confirmed that an agentic Chat profile which still enables the workspace is admitted cleanly with SecondBox disabled. On such a site, set enabledTools: [] under metadata.agentPlatform on the agentic profiles in chat-profiles.yaml.