Any GitHub repo.
A coding agent, boxed in.
Paste a public repository and the pi coding agent opens in a fresh checkout of it, in a Chalk sandbox that can reach only GitHub and the model gateway. Ask it to explain the code, find a bug, or write and run a test. The sandbox is deleted when you leave.
Bring a repository
Paste any public GitHub repository, or pick one below, and press Open in sandbox. pi starts in the checkout; ask it anything about the code. Press Ctrl+C twice for a plain shell, where you can check for yourself that only GitHub is reachable. Sessions last eight minutes.
How it works
A small server, itself running on Chalk, checks the repository, hands you a fresh sandbox and relays the terminal. The sandbox holds no secrets, and the server holds none the sandbox can reach.
Check
The server accepts only github.com/owner/name. It asks GitHub whether the repository exists, is public and is under 250 MB, and refuses it otherwise.
Clone
A fresh sandbox from a warm pool shallow-clones the repository: one branch, no tags, no LFS, a 90-second limit, and a size check on the checkout.
Work
pi opens in the checkout through an interactive PTY, drawn by ghostty-web. It reads, searches, edits and runs code there, and calls its model through the Chalk model gateway.
An agent sandbox in a few lines
The isolation is all constructor arguments: a gVisor kernel, an egress allowlist, a credential bound to one host, and a lifetime. Clone into it, then run any agent you can install.
The demo above is open source too. Its server validates the repository, keeps a warm pool, rate-limits by visitor and relays a PTY over a WebSocket.
chalk-ai/repo-agent-sandboxfrom chalkcompute import (
ComputeClass, ContainerSecurityPolicy, KernelPolicy, NetworkPolicy, Sandbox,
)
sandbox = Sandbox(
image=PI_IMAGE, # Node.js, pi, git, ripgrep and fd
cpu="1",
memory="2Gi",
lifetime="600s",
compute_class=ComputeClass.HOST,
security_policy=ContainerSecurityPolicy(kernel_policy=KernelPolicy.RESTRICTED),
# Only github.com resolves. add_credentials adds the gateway host and binds the key to it:
# the sandbox sees a placeholder, and the egress proxy swaps in the real key.
network_policy=NetworkPolicy(allowed_hosts=["github.com"]),
).add_credentials("api.chalk.ai", "CHALK_ROUTER_API_KEY")
sandbox.run()
sandbox.exec(
"git", "clone", "--depth", "1", "--", "https://github.com/pallets/click.git", "/workspace/click",
timeout_secs=90,
)Room to work, nowhere to go
Coding agents need a real filesystem, a shell and a model. They don't need your network, your credentials or your other repositories.
Two hosts, nothing else
A NetworkPolicy allowlist lets the sandbox reach github.com and the model gateway. Every other host fails to resolve.
Keys stay outside
add_credentials hands the sandbox a placeholder. The egress proxy swaps in the real gateway key only on requests to the gateway, so nothing inside can leak it.
A kernel of its own
KernelPolicy.RESTRICTED runs every sandbox under gVisor, so the repository's code never talks directly to the host kernel.
Hard limits
One CPU, 2 GiB, eight minutes, and a lifetime Chalk enforces itself. Concurrency and per-visitor limits keep a public demo affordable.
Untrusted checkouts
pi runs with project-local extensions, skills, MCP servers and themes switched off, so a repository can't add code to the agent's harness.
Any agent, same box
The sandbox is generic: swap pi for another coding agent or your own harness by changing the image. The isolation stays the same.
Give your coding agents a box of their own
Talk to an engineer about running agent sandboxes in your cloud, next to your code and data.