Secured access

The AgentBox SDK talks to a controller inside every sandbox. Secure access requires a token for commands, filesystem operations, and other controller APIs. JavaScript and Python enable it by default. In Go, set Secure: &secure with secure := true. The SDK sends the returned token automatically.

mjs

import { Sandbox } from "@abox-dev/sdk";

// Secure access is enabled by default.
const sandbox = await Sandbox.create();

try {
  const result = await sandbox.commands.run("printf secure");
  console.log(`Command result: ${result.stdout}`);
} finally {
  await sandbox.kill();
}

from agentbox import Sandbox


# Secure access is enabled by default.
sandbox = Sandbox.create()

try:
    result = sandbox.commands.run("printf secure")
    print(f"Command result: {result.stdout}")
finally:
    sandbox.kill()

package main

import (
	"context"
	"fmt"
	"log"

	"github.com/abox-dev/sdk/packages/go-sdk"
)

func kill(sandbox *agentbox.Sandbox) {
	if _, err := sandbox.Kill(context.Background()); err != nil {
		log.Printf("cleanup sandbox: %v", err)
	}
}

func run() (err error) {
	ctx := context.Background()
	client, err := agentbox.NewClient()
	if err != nil {
		return err
	}
	secure := true
	sandbox, err := client.Sandboxes.Create(ctx, &agentbox.CreateSandboxOptions{Secure: &secure})
	if err != nil {
		return err
	}
	defer kill(sandbox)
	result, err := sandbox.Commands.Run(ctx, "printf", &agentbox.CommandOptions{Args: []string{"secure"}})
	if err != nil {
		return err
	}
	fmt.Printf("Command result: %s\n", result.Stdout)

	return nil
}

You normally do not need to manage the controller token. If you call the controller API directly, send the X-Access-Token header returned when the sandbox is created.

You can create a sandbox with secure: false in JavaScript or secure=False in Python, or pass Secure pointing to false in Go, but this lets anyone with the sandbox ID call its controller APIs. Do not disable secure access in production.

Secured access ​

Secured access