# microsandbox

> Easy, fast microVMs for untrusted workloads, on your machine or in the cloud

## Docs

- [Introduction](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/getting-started/introduction.md): Easy, fast microVMs for untrusted workloads
- [Quickstart](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/getting-started/quickstart.md): Get a sandbox running in under 5 minutes
- [Cloud](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/cloud/overview.md): Run the same sandboxes on hosted infrastructure with an API key
- [Backends](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/getting-started/backends.md): How the SDK and CLI choose between the local runtime and the cloud
- [AI agents](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/getting-started/agents.md): Connect AI agents to isolated microsandbox machines
- [Overview](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sandboxes/overview.md): What sandboxes are and how to configure them
- [Lifecycle](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sandboxes/lifecycle.md): Create, start, stop, and manage sandbox state
- [Commands](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sandboxes/commands.md): Execute commands, stream output, and interact with sandboxes
- [Filesystem](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sandboxes/filesystem.md): Read and write files inside a running sandbox
- [Secrets](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sandboxes/secrets.md): Secure credential injection for sandboxes
- [Tuning](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sandboxes/tuning.md): Change sandbox settings without recreating it
- [SSH](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sandboxes/ssh.md): Connect to sandboxes through SSH protocol sessions
- [Volumes](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sandboxes/volumes.md): Persist and share data across sandboxes
- [OCI images](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/images/overview.md): Use standard container images from any registry
- [Disk images](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/images/disk-images.md): Boot from QCOW2, Raw, or VMDK disk images
- [Snapshots](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sandboxes/snapshots.md): Capture a sandbox's writable layer as a portable artifact
- [Labels](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sandboxes/labels.md): Organize sandboxes, act on them in bulk, and attribute metrics
- [Logs](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sandboxes/logs.md): Capture, read, and diagnose sandbox output
- [Metrics](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sandboxes/metrics.md): Monitor sandbox resource usage
- [Bootstrap](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sandboxes/bootstrap.md): Prepare scripts, patches, and PID 1 before work starts
- [Overview](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/networking/overview.md): Control network access and isolation
- [Host sockets](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/networking/host-sockets.md): Connect a sandbox to a Unix socket or Windows named pipe
- [DNS](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/networking/dns.md): Control how sandboxes resolve domain names
- [TLS interception](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/networking/tls.md): Inspect HTTPS traffic and manage certificate trust
- [Metrics collector](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/observability/msb-metrics.md): msb-metrics, the sidecar binary that ships microsandbox metrics over OTLP
- [Deep dive](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/observability/deep-dive.md): Flags, emitted metrics, attributes, and operational notes for msb-metrics
- [Optimization](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sandboxes/optimization.md): Choose the settings that can improve local sandbox performance
- [CPU placement](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sandboxes/cpu-placement.md): Choose where sandbox vCPU threads run on the host
- [Linux](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/troubleshooting/linux.md): Diagnose KVM, permissions, and host runtime setup on Linux
- [macOS](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/troubleshooting/macos.md): Diagnose Apple Silicon and local runtime setup on macOS
- [Windows](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/troubleshooting/windows.md): Diagnose Windows Hypervisor Platform, doctor checks, and terminal setup
- [Overview](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sdk/overview.md): Install the SDK and create your first sandbox
- [Runtime setup](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sdk/setup.md): Install, verify, and configure microsandbox runtime dependencies from every SDK
- [Error handling](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sdk/errors.md): Typed errors and resource cleanup patterns
- [Global config](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/configuration.md): Reference for the global config.json shared by the CLI and SDKs
- [Sandbox](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sdk/rust/sandbox.md): Rust SDK - Sandbox API reference
- [Execution](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sdk/rust/execution.md): Rust SDK - Command execution API reference
- [SSH](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sdk/rust/ssh.md): Rust SDK - SSH API reference
- [Filesystem](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sdk/rust/filesystem.md): Rust SDK - Filesystem API reference
- [Volumes](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sdk/rust/volumes.md): Rust SDK - Volume API reference
- [Networking](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sdk/rust/networking.md): Rust SDK - Network API reference
- [Secrets](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sdk/rust/secrets.md): Rust SDK - Secret injection API reference
- [Snapshots](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sdk/rust/snapshots.md): Rust SDK - Snapshot API reference
- [Images](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sdk/rust/images.md): Rust SDK - Image cache API reference
- [Agent client](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sdk/rust/agent-client.md): Rust SDK - Low-level agentd client reference
- [Sandbox](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sdk/typescript/sandbox.md): TypeScript SDK - Sandbox API reference
- [Execution](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sdk/typescript/execution.md): TypeScript SDK - Command execution API reference
- [SSH](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sdk/typescript/ssh.md): TypeScript SDK - SSH API reference
- [Filesystem](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sdk/typescript/filesystem.md): TypeScript SDK - Filesystem API reference
- [Volumes](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sdk/typescript/volumes.md): TypeScript SDK - Volume API reference
- [Networking](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sdk/typescript/networking.md): TypeScript SDK - Network API reference
- [Secrets](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sdk/typescript/secrets.md): TypeScript SDK - Secret injection API reference
- [Snapshots](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sdk/typescript/snapshots.md): TypeScript SDK - Snapshot API reference
- [Images](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sdk/typescript/images.md): TypeScript SDK - Image cache API reference
- [Agent client](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sdk/typescript/agent-client.md): TypeScript SDK - Low-level agentd client reference
- [Sandbox](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sdk/python/sandbox.md): Python SDK - Sandbox API reference
- [Execution](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sdk/python/execution.md): Python SDK - Command execution API reference
- [SSH](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sdk/python/ssh.md): Python SDK - SSH API reference
- [Filesystem](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sdk/python/filesystem.md): Python SDK - Filesystem API reference
- [Volumes](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sdk/python/volumes.md): Python SDK - Volume API reference
- [Networking](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sdk/python/networking.md): Python SDK - Network API reference
- [Secrets](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sdk/python/secrets.md): Python SDK - Secret injection API reference
- [Snapshots](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sdk/python/snapshots.md): Python SDK - Snapshot API reference
- [Images](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sdk/python/images.md): Python SDK - Image cache API reference
- [Agent client](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sdk/python/agent-client.md): Python SDK - Low-level agentd client reference
- [Sandbox](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sdk/go/sandbox.md): Go SDK - Sandbox API reference
- [Execution](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sdk/go/execution.md): Go SDK - Command execution API reference
- [SSH](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sdk/go/ssh.md): Go SDK - SSH API reference
- [Filesystem](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sdk/go/filesystem.md): Go SDK - Filesystem API reference
- [Volumes](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sdk/go/volumes.md): Go SDK - Volume API reference
- [Images](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sdk/go/images.md): Go SDK - Image cache API reference
- [Networking](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sdk/go/networking.md): Go SDK - Network API reference
- [Secrets](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sdk/go/secrets.md): Go SDK - Secret injection API reference
- [Snapshots](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sdk/go/snapshots.md): Go SDK - Snapshot API reference
- [Agent client](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sdk/go/agent-client.md): Go SDK - Low-level agentd client reference
- [Sandbox](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/sdk/ruby/sandbox.md): Ruby SDK - Sandbox lifecycle API reference
- [CLI overview](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/cli/overview.md): Manage sandboxes from the terminal
- [Configuration file](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/cli/configuration.md): Configure sandboxes created by the CLI with root or scoped YAML files
- [Sandbox commands](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/cli/sandbox-commands.md): Create, run, and interact with sandboxes from the CLI
- [SSH commands](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/cli/ssh-commands.md): Connect to and serve sandboxes over SSH
- [Volume commands](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/cli/volume-commands.md): Create and manage named volumes from the CLI
- [Image commands](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/cli/image-commands.md): Pull and manage OCI images from the CLI
- [Overview](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/api-reference/overview.md): The REST API behind the SDKs and CLI
- [Create a sandbox](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/api-reference/endpoints/sandboxes/create-a-sandbox.md)
- [List sandboxes](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/api-reference/endpoints/sandboxes/list-sandboxes.md)
- [Get a sandbox](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/api-reference/endpoints/sandboxes/get-a-sandbox.md)
- [Get a sandbox by name](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/api-reference/endpoints/sandboxes/get-a-sandbox-by-name.md)
- [Start a sandbox](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/api-reference/endpoints/sandboxes/start-a-sandbox.md)
- [Start a sandbox by name](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/api-reference/endpoints/sandboxes/start-a-sandbox-by-name.md)
- [Stop a sandbox](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/api-reference/endpoints/sandboxes/stop-a-sandbox.md)
- [Stop a sandbox by name](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/api-reference/endpoints/sandboxes/stop-a-sandbox-by-name.md)
- [Rename a sandbox](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/api-reference/endpoints/sandboxes/rename-a-sandbox.md)
- [Destroy a sandbox](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/api-reference/endpoints/sandboxes/destroy-a-sandbox.md)
- [Destroy a sandbox by name](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/api-reference/endpoints/sandboxes/destroy-a-sandbox-by-name.md)
- [Create a named volume](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/api-reference/endpoints/volumes/create-a-named-volume.md)
- [List volumes](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/api-reference/endpoints/volumes/list-volumes.md)
- [Set or clear a volume's storage cap](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/api-reference/endpoints/volumes/set-or-clear-a-volumes-storage-cap.md)
- [Schedule a volume for deletion](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/api-reference/endpoints/volumes/schedule-a-volume-for-deletion.md)
- [Get quota usage](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/api-reference/endpoints/quotas/get-quota-usage.md)
- [Get a usage summary](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/api-reference/endpoints/usage/get-a-usage-summary.md)
- [Get per-sandbox usage](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/api-reference/endpoints/usage/get-per-sandbox-usage.md)
- [Get per-volume storage usage](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/api-reference/endpoints/usage/get-per-volume-storage-usage.md)
- [List audit events](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/api-reference/endpoints/audit-events/list-audit-events.md)
- [Get an audit event](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/api-reference/endpoints/audit-events/get-an-audit-event.md)
- [Get the current organization](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/api-reference/endpoints/organization/get-the-current-organization.md): The slug-prefixed `GET /v1/orgs/:slug` returns the user's role; here the key is treated as `Owner` (matches `OrgContext` semantics), so the returned role is informational rather than a real per-user binding.
- [List organization members](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/api-reference/endpoints/members/list-organization-members.md)
- [Examples](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/examples/overview.md): Practical, tested microsandbox workflows for agents, CI, automation, tooling, browsers, data, and files
- [OpenCode](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/examples/agents/opencode.md): Run the OpenCode terminal agent against an isolated copy of a project
- [OpenClaw](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/examples/agents/openclaw.md): Onboard OpenClaw and run its persistent gateway inside a microVM
- [Goose](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/examples/agents/goose.md): Run the native Goose coding agent in an isolated project copy
- [Gemini CLI](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/examples/agents/gemini-cli.md): Run Google's Gemini CLI against a copied project in a microVM
- [Hermes Agent](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/examples/agents/hermes-agent.md): Set up Hermes Agent from its official image and persist its state
- [Pi coding agent](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/examples/agents/pi.md): Run the Pi terminal coding agent in an isolated project copy
- [Run GitHub Actions in a microVM](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/examples/ci-cd/github-actions-runner.md): Give one self-hosted job a disposable runner
- [Run isolated PR checks](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/examples/ci-cd/pr-checks.md): Stream a commit into a bounded microVM and run its tests there
- [Run Docker Compose integration tests](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/examples/ci-cd/compose-tests.md): Run a Compose stack without exposing the host Docker socket
- [Create an ephemeral preview deploy](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/examples/ci-cd/preview-deploys.md): Serve a built site from a time-limited microVM
- [Docker in a sandbox](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/examples/docker/docker-in-sandbox.md): Start dockerd inside a microsandbox VM and run containers from an interactive shell
- [Run microsandbox in Docker](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/examples/docker/docker.md): Run the microsandbox CLI from a Linux container with KVM access
- [Using local Docker images](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/examples/docker/local-images.md): Use locally built Docker images with microsandbox
- [Start warm workers from a snapshot](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/examples/sandboxing/warm-workers.md): Install a toolchain once and launch clean workers from the captured disk state
- [VNC desktop](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/examples/development/vnc-desktop.md): Open a modern CPU-only Linux desktop in the browser with LXQt, TigerVNC, and noVNC
- [Booting under systemd](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/examples/guest/systemd-services.md): Hand PID 1 to systemd inside the guest so services run under a real init
- [code-server](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/examples/development/code-server.md): Open an isolated VS Code workspace in the browser
- [JupyterLab](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/examples/development/jupyterlab.md): Run token-authenticated notebooks in an isolated Python environment
- [Schedule dependency audits](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/examples/automation/dependency-audits.md): Run npm audit in a short-lived sandbox and copy out the report
- [Fan out isolated batch jobs](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/examples/automation/parallel-batch-jobs.md): Run independent inputs in parallel microVMs and collect their output
- [Vet a Terraform provider offline](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/examples/plugins/terraform.md): Download a provider once, then validate and plan without network access
- [Playwright](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/examples/browser-automation/playwright.md): Capture pages or expose a remote browser server without a GPU
- [Crawl a site with Scrapy](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/examples/web-automation/scrapy.md): Run a bounded crawler with a single-site network allowlist
- [Convert documents and render PDFs](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/examples/file-processing/libreoffice-pdf.md): Prepare LibreOffice once, then convert untrusted documents without network access
- [Transcode media with FFmpeg](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/examples/file-processing/ffmpeg.md): Prepare FFmpeg once and process untrusted media in an offline worker
- [PostgreSQL](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/examples/data/postgresql.md): Run a persistent PostgreSQL service with a localhost-only forwarded port
- [Rehearse a database migration](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/examples/data/migration-rehearsal.md): Snapshot PostgreSQL, apply a risky migration, and restore the baseline
- [Redis](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/examples/data/redis.md): Run an authenticated Redis service with persistent data
- [Grafana Cloud](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/examples/metrics-backends/grafana-cloud.md): Ship msb-metrics output to Grafana Cloud's OTLP gateway
- [Grafana Alloy](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/examples/metrics-backends/grafana-alloy.md): Forward msb-metrics output to Grafana Cloud (or anywhere) via local Alloy
- [otel-collector](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/examples/metrics-backends/otel-collector.md): Inspect msb-metrics output locally with the OpenTelemetry Collector
- [Prometheus](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/examples/metrics-backends/prometheus.md): Ship msb-metrics output directly to Prometheus's OTLP ingestion endpoint
- [Datadog](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/examples/metrics-backends/datadog.md): Ship msb-metrics output to Datadog via the Datadog Agent's OTLP receiver
- [Security model](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/security/overview.md): The trust boundary microsandbox enforces, what it protects, and what it leaves to you
- [Isolation boundary](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/security/isolation.md): The microVM boundary, the host-guest control channel, and in-guest privilege
- [Filesystem & images](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/security/filesystem.md): Private root, mounts, snapshots, and the image supply chain
- [Network defenses](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/security/network.md): Egress filtering, SSRF, DNS rebinding, and cloud-metadata protection
- [Secret handling](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/security/secrets.md): How credentials stay on the host, and the exact boundary of the guarantee
- [Hardening](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/security/hardening.md): Dial the controls to match your threat level
- [Week of August 26, 2026](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/changelog/2026-08-26.md): Convergent sandbox lifecycle APIs and stable receiver identities across every SDK.
- [Week of August 7, 2026](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/changelog/2026-08-07.md): A first-class Ruby SDK, flat OCI root disks, deployment profiles, default-workload execution, host performance improvements, cloud volume filesystem access, and reliability fixes.
- [Week of July 31, 2026](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/changelog/2026-07-31.md): Unified cloud backend in every SDK with paginated sandbox listings, per-registry insecure and custom-CA overrides in Go and Python, msb completion for shell tab-completion, a shared log registry for tailing many sandboxes, and fixes for guest TCP half-close, DNS upstream failover, and cloud exec rec…
- [Week of July 24, 2026](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/changelog/2026-07-24.md): Composable network profiles across CLI and SDKs, bidirectional snapshot migration with msb self downgrade, msb run -d that honors image CMD, TTY resize in every SDK, and Go SDK on Windows.
- [Week of July 17, 2026](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/changelog/2026-07-17.md): Image archives on every SDK, a finalized snapshot API with dest_dir and --from-snapshot, hole-perfect snapshot archives across platforms, a newer guest kernel, and a batch of secret, snapshot, and SDK fixes.
- [Week of July 10, 2026](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/changelog/2026-07-10.md): Structured root disk for OCI sandboxes, default symlink protection on mount roots, secret modify across every SDK, offline OCI upper growth, cleaner guest shutdown, and a batch of snapshot, filesystem, and lifecycle fixes.
- [Week of July 5, 2026](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/changelog/2026-07-05.md): Modify existing sandboxes, inspect resize headroom, trust private TLS upstreams, load images faster, and pick up CLI, network, and SDK fixes.
- [Week of June 26, 2026](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/changelog/2026-06-26.md): Windows host support, guest-write quotas for virtiofs mounts, host-directory bind rootfs across all SDKs, non-PTY bidirectional `exec --stream`, upper disk usage metrics, an `msb doctor` command, runtime-owned ephemeral cleanup, and a round of SDK and runtime fixes.
- [Week of June 19, 2026](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/changelog/2026-06-19.md): Local and cloud backend routing in the SDKs, detached image init entrypoints, shared sandbox spec types, secret substitution through HTTP CONNECT tunnels and plain HTTP, and snapshot import hardening.
- [Week of June 12, 2026](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/changelog/2026-06-12.md): Guest runtime metrics, idempotent named volumes, unified sandbox lifecycle APIs, explicit mount kind flags, cleaner installer, raw agent socket paths, and richer secret violation logs.
- [Week of June 5, 2026](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/changelog/2026-06-05.md): OTLP sandbox metrics, SSH TCP forwarding, image archive commands, pruning, Python image management, Homebrew install, and smoother host upgrades.
- [Week of May 29, 2026](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/changelog/2026-05-29.md): Native SSH and SFTP, configurable OCI upper size, msb copy and rootfs patch flags, hardened mount options, env-backed secret shorthand, and a fix for multi-second published-port stalls.
- [Week of May 22, 2026](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/changelog/2026-05-22.md): Rotation-aware log streaming, raw agent client across SDKs, per-mount passthroughfs policies, network policy CLI cleanup, configurable port bind addresses, and ergonomic --script.
- [Week of May 15, 2026](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/changelog/2026-05-15.md): Go SDK, file-first disk snapshots, guest init handoff, exec and boot logs, and DNS egress policy.
- [Week of May 1, 2026](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/changelog/2026-05-01.md): TypeScript SDK redesign, network policy redesign, disk-image volumes, and more.
- [Week of April 24, 2026](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/changelog/2026-04-24.md): Block-backed OCI rootfs, guest rlimits, and TypeScript SDK improvements.
- [Week of April 17, 2026](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/changelog/2026-04-17.md): New Python SDK, Docker image publishing, and TLS proxy fixes.
- [Week of April 10, 2026](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/changelog/2026-04-10.md): File-level volume mounts, TypeScript SDK streams, and `msb shell` removal.
- [Week of April 3, 2026](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/changelog/2026-04-03.md): The microsandbox rewrite around an embeddable SDK, smoltcp networking, and a composable filesystem.

## OpenAPI Specs

- [openapi](https://microsanbox-staging-toks-cloud-snapshot-contracts.mintlify.site/api-reference/openapi.json)