---
title: "Your sandbox · intentic"
description: "Each agent runs in a Docker sandbox on hardware you own: an image overlay you approve, a private tunnel your browser dials, and a spend ledger the platform never sees."
url: "https://intentic.dev/product/sandbox/"
---

Sandbox & ownership

# The agent runs on hardware you own.

A sandbox is a Docker container on your laptop, workstation or VPS. Read its image, change what is installed, watch what it spends.

[Get started free](https://app.intentic.dev) [Open the live workspace](https://intentic.dev/demo/)

acme-shop · /sandbox

![The sandbox hub: the acme-shop sandbox online with its installed version and URL, and an at-a-glance list of its agent account, secrets, capabilities, running services and access.](https://intentic.dev/_astro/sandbox-overview.GCqFN3zD_2eHIot.webp)

- 2 fields

 all the platform stores about a sandbox: a name and its URL
- MIT

 the sandbox and CLI that run on your machine are open source
- No ports

 nothing inbound is opened; the tunnel dials out

## The image is a file you approve

Everything past the base image is an overlay Dockerfile. The agent can propose a line and then waits: you read the diff and approve before a rebuild applies it.

acme-shop · /sandbox/environment

![The sandbox Environment tab: an overlay Dockerfile diff awaiting review, adding an imagemagick install, with Reject and Approve buttons.](https://intentic.dev/_astro/sandbox-environment.DI5PrqmE_Z1L1s8A.webp)

## Your browser reaches it directly

The sandbox dials out over a private Cloudflare tunnel and your browser talks to that address. The platform never relays a file, a keystroke or a credential.

Your browser

Chat, files, editor, terminal

private tunnel, direct. Nothing in between

Your machine

Sandboxes, repos, credentials, capabilities

intentic platform

Identity + sandbox URL only. Off the command path.

## The bill is measured where it is spent

Every turn's tokens and cost land in the sandbox's own ledger, by day, provider and model. It is your subscription, so the platform never meters it.

acme-shop · /sandbox/usage

![The sandbox Usage tab: a stacked spend-per-day chart split by Claude Code and Codex, with cost broken down by model and by agent.](https://intentic.dev/_astro/sandbox-spend.DqO3lVId_ZxB2op.webp)

## What the platform actually holds

Identity, the sandbox's URL, billing state, and the grants that let a teammate reach it. Not your code, not your keys, not your transcripts.

### Stays inside your sandbox

- Your code and repos
- Every credential and token
- The agent's transcripts
- The container and its image

### All the platform holds

- Your identity (Google sign-in)
- The sandbox's name and URL
- Billing state
- Grants to invited teammates

What it stores is AES-256-GCM encrypted, with no decrypt path in the product.

## Everyone else lets you edit the prompt

The prompt is the one layer you can change anywhere. A sandbox opens the rest: the image, the systems it reaches, the skills it loads every turn. You can't make the model smarter, only better equipped.

### A prompt a system prompt and a few .md files

- Describes your tools. None are installed.
- No reach into your codebase, data, or services.
- Starts from the same blank context every run.
- Hands you generic output you finish by hand.

### The whole environment a sandbox you can open and change

- Its dev-tools and libraries are really installed.
- Wired to your repos, databases, and services.
- Curated context loads every single run.
- Does the job end to end, shows its work as diffs.

## One sandbox, several people

The owner installs the tools; invited teammates share that same sandbox, each over their own private tunnel. Setup stays owner-gated.

- Invite by email; grants are enforced by the daemon, fail-closed.
- Teammates chat, drive and review, and mirror the sandbox's ports.
- Sharing is a Pro feature; revoking or leaving never is.

Y

You Owner

installs tools · connects systems · full control

S

Sam Teammate

chats, drives & reviews · mirrors ports

A

Ada Teammate

chats, drives & reviews · mirrors ports

each over its own private tunnel

one specialized sandbox

release-captain · on the owner's machine

running

[Next Doorbell → Put your agent on your own website](https://intentic.dev/product/doorbell/)

[Get started free](https://app.intentic.dev) [Read the quickstart](https://intentic.dev/docs/quickstart/)