# High-end sandboxes

High-end sandboxes for developers and agents. Isolated VMs on the same hardware as Avrea runners, with repository access and shared CI caches.

Sandboxes

Isolated VMs for developers and agents, on the same hardware as your runners. Start from a repository branch and connect from your editor, terminal or a remote desktop.

[Start free](https://console.avrea.com/)
[Read the docs](https://docs.avrea.com/sandboxes/)

Create and connect

$avr vm create --name api --os linux --size 4-vcpu \

 --repo acme/api --ref main \

 --ttl 8h --wait

$avr vm ssh <vm-id>

## Start from your repository

Runtimes are prebuilt into the image. Choose a connected repository and branch when you create a sandbox. Your build tools can reuse the repository’s package and build caches as you install dependencies and run builds.

pull request

branch

tools

dependencies

postgres

agents

### Reuse your CI caches

Reuse the dependencies and build outputs already cached by CI. Skip repeated downloads and compilation.

Works with Docker, Go, Bazel, Gradle, Maven, Turborepo, sccache, ccache, Nix and Xcode.

## The same image your CI runs

Use the same image and warm caches as your Avrea runners. Reproduce CI failures without rebuilding the environment on your laptop.

Sandbox

CI runner

Shared image & caches

## Pause, resume and fork

Pause a sandbox to keep its disk, and resume it when you come back. Fork a paused sandbox into an independent copy for a risky change or a parallel task. Pause and fork are available on Linux x86 sandboxes.

Paused sandbox

Resume

Fork

## Isolated environments for agent tasks

Give each task its own VM, with its own size, time limit and egress firewall rules. Agents can install packages, change code and run tests inside it.

One sandbox per task

$avr vm create --name task-142 --os linux --size 4-vcpu \

 --repo acme/api --ref fix/login --ttl 2h --wait

$avr vm ssh task-142 -- make -C api test

# Delete it when the task is done

$avr vm delete task-142 --yes --wait

### Isolation

Each environment has its own VM and kernel.

### Ready to run tests

Start from a branch and run your project’s setup and test commands with access to shared CI caches.

## Desktop, editor or terminal

Turn on remote desktop on a supported image to use a sandbox as a full dev box, or connect over SSH. Use the same environment for coding, tests and visual debugging.

SSH and port forwarding

$avr vm ssh <vm-id>

$avr vm port-forward <vm-id> --port 3000

# Local endpoint: http://127.0.0.1:3000

### Remote desktop

Run applications, debug visual issues or watch an agent use a browser. `avr vm rdp` and `avr vm vnc` tunnel the session through SSH. [See supported images](https://docs.avrea.com/sandboxes/).

### Editor and SSH

Connect through your editor’s remote extension or SSH. Forward application ports to your own machine. [Public HTTPS URLs](https://docs.avrea.com/sandbox-https/) for previews are available when enabled for your organization.

### Bring your own agent

Run Claude Code or Codex with access to a terminal and desktop.

Works with
- VS Code
- JetBrains
- Claude Code
- Codex

## Pick the size per task

Choose the CPU and memory your work needs, and start a larger sandbox for a demanding build.

### Manage compute spend

Delete a sandbox when the work is done, or let its time limit end it. Usage reports cover every sandbox in your organization.

## Create sandboxes through the API

Start a sandbox when a pull request opens or an agent begins a task. Use the API to create and delete sandboxes, and the CLI to connect, run commands over SSH and inspect usage.

POST /orgs/<org-id>/vms

{ "repo": "acme/api", "ref": "main",

"os_type": "linux", "size": "4-vcpu",

"ttl_seconds": 7200 }

202 · provisioning

## Set limits on every sandbox

Each sandbox has its own size, time limit and egress firewall rules. An organization admin can turn published HTTPS URLs off for every sandbox at once.

### Isolated on Avrea infrastructure

Each sandbox runs in its own VM on Avrea infrastructure. SSH, and remote desktop when you enable it, listen on a public address and require authentication. HTTPS URLs you publish are the only other way in.

## Start working in a sandbox

[Start free](https://console.avrea.com/)
[Talk to an engineer](https://avrea.com/demo)