For AI agents: the complete documentation index is available at https://docs.flezise.com/llms.txt, the full documentation bundle is available at https://docs.flezise.com/llms-full.txt, and this page is available as Markdown at https://docs.flezise.com/sandboxes/hardened-mode.md.
Docs

Hardened mode

Hardened mode is an opt-in set of restrictions that tightens what an agent sandbox can reach and do. It is off by default; ordinary sandboxes run on the same network as the platform with outbound internet access.

Note

Read this if you administer the platform and want to restrict agent execution. The deployment topology for hardened sandboxes is covered on Deployment overview; this page covers the controls themselves.

Network isolation

A hardened sandbox runs on a separate Docker network with no outbound internet. The only services it can reach are the platform backend, the AI gateway, and the headless-Chrome browser. The chrome-browser service is always on the allowed list so agent web browsing continues to work inside hardened mode.

To enable this, set sandbox_docker_network_restricted to the name of a Docker network that has no internet route and has the backend, ai-gateway, and chrome-browser containers attached. Leaving this setting empty keeps the sandbox on the standard platform network even when sandbox_hardened is true.

Scoped gateway keys

When sandbox_scoped_gateway_keys is enabled, each sandbox is issued its own short-lived AI gateway credential on creation. That credential is bound to the sandbox's instance, user, and project, and revoked when the container is destroyed. A credential that leaks from inside the sandbox cannot be replayed against another project.

The sandbox_scoped_key_providers setting lists which providers get scoped keys (default: openai,anthropic). If minting fails for an optional reason, the sandbox falls back to the shared platform key. If minting fails because the required policy is not met, the sandbox does not start.

Action guard

The action guard analyzes shell commands the agent executes before they run. It operates in one of three modes:

ModeEffect
offNo analysis; all commands pass through.
flagCommands that trip a rule are logged and emit a sandbox.action.flagged run event, but the command runs.
blockCommands that trip a block-severity rule are rejected before execution.

The default mode is flag. Set sandbox_action_guard_mode to change it.

The guard checks four categories of risky command: network egress through tools like curl or wget to hosts outside the allow list, reads of secret files such as private keys and credential stores, git push to a remote that is not the project's own repository, and destructive filesystem operations.

Platform services and internal addresses are always allowed regardless of mode. Add extra hostnames to sandbox_action_guard_allowed_hosts (comma-separated) to permit them as well.

Enabling hardened mode

Set sandbox_hardened = true in the platform environment. The table below lists the relevant settings:

KeyDefaultMeaning
sandbox_hardenedfalseEnable the hardened restrictions below.
sandbox_docker_network_restricted"" (same as platform)No-egress Docker network for hardened sandboxes.
sandbox_scoped_gateway_keysfalseIssue per-sandbox AI gateway credentials.
sandbox_scoped_key_providersopenai,anthropicProviders that receive scoped keys.
sandbox_action_guard_modeflagoff, flag, or block.
sandbox_action_guard_allowed_hosts""Extra hostnames the egress rule permits.
Warning

Enabling sandbox_docker_network_restricted without attaching the backend, ai-gateway, and chrome-browser services to that network will break agent execution entirely.

Next steps