Agents off the laptop, into your cloud.
Cloud Sandbox runs agents inside your own cloud account, under the same policy, approvals, and inspection as every laptop in the fleet. You own the compute and the data plane, and browser terminal traffic never transits SixWays infrastructure. SixWays orchestrates, governs, and keeps the evidence.
Pick the runtime you already trust.
Three runtimes, one orchestrator, one policy.
Hardened Docker host
The default. Workloads run non-root with capabilities dropped and no new privileges. Root is available only through an explicit, logged opt-out.
NVIDIA OpenShell
Provision, run, attach a terminal, persist the workspace, stop, and delete through an OpenShell gateway, on Docker or on the Kubernetes driver.
OpenSandbox
Run on an OpenSandbox lifecycle server when that is the runtime your platform team already operates.
Built for more than one tenant.
Signed commands only
Every lifecycle command is signed. Unauthenticated, forged, tampered, expired, or wrong-tenant commands create nothing.
Tenants stay apart
One tenant can never reach another tenant’s sandboxes. On Kubernetes, the orchestrator uses a least-privilege OIDC token and the gateway itself refuses cross-tenant access.
Quotas before anything starts
A sandbox that would exceed its owner’s quota is refused before anything is created, and a duplicated or replayed command never creates a second workload.
Capacity in the license
Your sandbox and concurrency limits are part of the signed license, and the orchestrator enforces them even when it is offline.
Questions.
Who pays for the compute?
You do, on your own cloud bill. SixWays does not resell compute. You pay SixWays for orchestration, governance, and evidence.
What happens if our license lapses?
Sessions, status, and terminal attach stay available through the license grace window. Billing never weakens isolation: sandboxes keep their confinement and enforcement after paid features stop.
Do we need a SixWays Server?
Yes. Cloud Sandbox is orchestrated from a connected Server, either a dedicated SixWays tenant or one you host.
Get early access.
Tell us about your agents and your team, and we will set you up.