Cloud Development Environment Platform  ·  View 05 of 21  ·  People and journeys

Journey — Forty Agent Sandboxes at Once

The workload that did not exist when this product category was designed, and what it demands.

Editable source SVG draw.io All views
Coding agent headless · 7-min median life Goal — Forty disposable machines now, and a diff back from each Trigger — One task fans out across forty repositories Done when — Every sandbox ran, or was refused in a way the orchestrator can retry 1 · Ask 40 at once 2 · Get or wait ◆ moment of truth 3 · Run 4 · Hand back ◆ moment of truth 5 · Vanish What it does POSTs 40 creates Reads the verdict Runs unreviewed code Pushes a branch Deletes the sandbox What the platform does Checks spend ceiling Claims warm pool Sheds the overflow Deny-by-default egress Brokers a scoped token Scans for secrets Keeps the session record How it feels Delighted Fine Frustrated Where it hurts Silent queueing is worse than no npm install blocked Push refused late What answers it Explicit retryable refusal Registry proxy, not the internet Scoped, short-lived token Record outlives the VM Journey — Forty Agent Sandboxes at Once The agent's trough is a refusal it cannot tell from a hang — which is why shedding is explicit and classed, not implicit and slow. v 1.0 · owner Platform Architecture · date 2026-10

What this settles

  • An agent cannot tell a slow platform from a hung one, so capacity pressure must surface as an explicit, classed, retryable refusal — never as silent queueing.
  • Agent workspaces default to deny-by-default egress with a registry proxy, which is why the trough sits at "npm install blocked" rather than at "my dependency exfiltrated a token" (ADR-06).
  • The session record — commands, destinations, files changed, diff — outlives the workspace, because the workspace is gone in seven minutes and the question about it arrives later.

Assumptions

  • Agent sessions are 65% of starts with a 7-minute median life; bursts reach 10× steady-state creation for 60 seconds.
  • Brokered git credentials are scoped to one repository and expire in 15 minutes.

Risks

  • A prompt-injected agent is the untrusted-code case the sandbox exists for; it must not get a weaker boundary than a human's workspace, however convenient that would be.
  • Unbounded fan-out from one task is indistinguishable from abuse until a ceiling says otherwise, so the ceiling is per principal, not only per tenant.
◀  Journey — Resuming Yesterday's Workspace All views Journey — Patching 1,800 Hosts Without Anyone Noticing  ▶
Solution Architecture v1.0 · open source on raw/bare-metal compute · Platform Architecture · 2026-1005-journey-agent-sandbox-burst