> ## Documentation Index
> Fetch the complete documentation index at: https://docs.flashduty.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Sandbox

> The cloud sandbox is a Flashduty-managed, temporary execution environment that works out of the box with no install. When no usable self-hosted Runner is online for the current member, AI SRE sessions run in the cloud sandbox by default; you can also pin a session to it manually.

<Info>
  **Private beta**: AI SRE is currently in private beta. Pro or higher accounts can apply for free beta access through the [AI SRE private beta application form](https://c9xudyniiq.feishu.cn/share/base/form/shrcn0ngCfdoygiaHnAT80BfZiH); after approval, Flashduty will add your account to the whitelist. Features and the UI may change during the beta.
</Info>

## Overview

***

The **cloud sandbox** is a **temporary execution environment** managed by Flashduty — an isolated, ready-to-use container. The AI SRE agent's tool calls (running commands, reading and writing files, running Skills, connecting to MCP) all happen inside it, and you **don't have to install or maintain anything**.

It is AI SRE's **default fallback**: when no usable self-hosted Runner ([BYOC Runner](/en/ai-sre/environments#byoc-runner)) is online for the current member, sessions automatically run in the cloud sandbox; you can also **pin a session to it manually**.

<CardGroup cols={2}>
  <Card title="Zero install, ready to use" icon="cloud">
    No process to deploy and no credentials to enter. New accounts, ad-hoc investigations, and demos can start chatting right away on a clean sandbox the system allocates.
  </Card>

  <Card title="Auto-pause when idle" icon="moon">
    The sandbox pauses automatically when the session is idle to free resources, then resumes on your next message, continuing in the same working directory.
  </Card>
</CardGroup>

## When to use the cloud sandbox

***

The cloud sandbox is best for **investigations that don't depend on your private network**, and for getting started quickly:

* **Quick start / demos**: you haven't deployed a Runner yet and want to try AI SRE's troubleshooting first;
* **Publicly reachable diagnostics**: the investigation only needs Flashduty's own data (incidents, alerts, changes) or trusted public services;
* **One-off, lightweight tasks**: you don't want to set up a dedicated always-on machine for a single investigation.

<Warning>
  The cloud sandbox **cannot reach your private network**: its egress is restricted to a set of trusted public domains and cannot reach databases, APIs, or jump hosts behind your VPC, dedicated line, or intranet. When an investigation needs to connect to those targets directly, use a self-hosted [BYOC Runner](/en/ai-sre/environments#byoc-runner) instead — putting execution on a machine that can reach your internal systems.
</Warning>

## Using it in a session

***

The **environment selector** at the bottom of the chat box decides where the session executes. Two of its options relate to the cloud sandbox:

| Option                      | Behavior                                                                                                                          |
| --------------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
| **Auto**                    | The default for new sessions. Prefers an online Runner the current member can use; otherwise **falls back to the cloud sandbox**. |
| **Cloud sandbox · Default** | Forces the cloud sandbox, ignoring all self-hosted Runners.                                                                       |

<Note>
  The environment choice is **locked once per session**: the environment determined when the session sends its first message is recorded and reused for every later turn; it does not change if you switch the selector afterward. To use a different environment, start a new session. See [BYOC · Selecting an environment in a session](/en/ai-sre/environments#selecting-an-environment-in-a-session).
</Note>

## Cloud sandbox vs. self-hosted Runner

***

| Dimension             | Cloud sandbox                    | Self-hosted Runner ([BYOC Runner](/en/ai-sre/environments#byoc-runner)) |
| --------------------- | -------------------------------- | ----------------------------------------------------------------------- |
| Deployment            | No install, system-managed       | Deploy a persistent process on your own machine                         |
| Private-network reach | ❌ Trusted public domains only    | ✅ Can reach your VPC / intranet / dedicated line                        |
| Data residency        | Inside the managed environment   | Stays within your own network boundary                                  |
| Lifecycle             | Temporary, auto-pauses when idle | Persistent, under your control                                          |
| Best for              | Quick start, public diagnostics  | Deep investigations that reach real production                          |

<Tip>
  The two aren't mutually exclusive: keep sessions on **Auto** day to day — they fall back to the cloud sandbox when no Runner is available — and connect a [BYOC Runner](/en/ai-sre/environments#byoc-runner) when an investigation needs to reach your internal systems.
</Tip>

## Related pages

***

<CardGroup cols={2}>
  <Card title="BYOC Runner" icon="server" href="/en/ai-sre/environments#byoc-runner">
    Deploy a persistent Runner on your own machine so investigations reach your private network.
  </Card>

  <Card title="Console" icon="comments" href="/en/ai-sre/sessions">
    See the execution environment and status bound to a session.
  </Card>

  <Card title="MCP (External Tools)" icon="plug" href="/en/ai-sre/mcp">
    MCP connections are established inside the selected environment at agent runtime.
  </Card>

  <Card title="Skill" icon="bug" href="/en/ai-sre/skills">
    Skills run inside the selected execution environment.
  </Card>
</CardGroup>