Sandbox Sidecars, a new isolation primitive, are now in Beta

Sidecars are containers that run alongside your main Sandbox on the same host, but with the same isolation as separate sandboxes. This means agent-generated code can run in the main Sandbox while credentials, proxies, harness logic, or other trusted operations run in a Sidecar that the agent cannot directly access. Because the containers share a host, communication between them stays local, avoiding the network round trips that add up in execution-heavy agent loops.

Sidecars are currently in Beta. Read the docs to get started.