Watch: Context for Reliable Agents
Live demo · Agents in sandboxes

Any GitHub repo.
A coding agent, boxed in.

This demo shows the pi coding agent opening a public repository in a fresh checkout, inside a Chalk sandbox that can reach only GitHub and the Chalk Model Gateway. Ask it to explain the code, find a bug, or write and run a test. The sandbox is deleted when you leave.

See the DemoTry Chalk

Follow a coding request inside a restricted repository sandbox

The agent works in a cloned public repository with bounded network access and session lifetime.

Try this experiment · expected results

  1. 1Open a sample repository

    Choose one of the sample public repositories and select Open in sandbox. Ask a specific question about its code.

    Expected: The terminal shows the agent using the checkout to answer, rather than answering from the repository name.

  2. 2Inspect the boundary

    Use the documented shell controls to inspect the checkout and network restrictions.

    Expected: The example permits GitHub access while keeping other destinations outside its allowlist.

Agent: pi · Terminal: ghostty-webOpen in new tab

Open a sample repository to get a coding session inside a Chalk sandbox. The terminal shows the checkout and agent running with restricted network access.

Built on Chalk

Coding agents need a real filesystem, a shell and a model. They don't need your network, your credentials or your other repositories.

  • Two hosts, nothing else

    A NetworkPolicy allowlist lets the sandbox reach github.com and the Chalk Model Gateway. Every other host fails to resolve.

  • Keys stay outside

    add_credentials hands the sandbox a placeholder. The egress proxy swaps in the real gateway key only on requests to the gateway, so nothing inside can leak it.

  • A kernel of its own

    KernelPolicy.RESTRICTED runs every sandbox under gVisor, so the repository's code never talks directly to the host kernel.

  • Hard limits

    One CPU, 2 GiB, eight minutes, and a lifetime Chalk enforces itself. Concurrency and per-visitor limits keep a public demo affordable.

Deploy your own

An agent sandbox in a few lines

The isolation is all constructor arguments: a gVisor kernel, an egress allowlist, a credential bound to one host, and a lifetime. Clone into it, then run any agent you can install.

The demo above is open source too. Its server validates the repository, keeps a warm pool, rate-limits by visitor and relays a PTY over a WebSocket.

ghostty-web

chalk-ai/repo-agent-sandbox
git clone https://github.com/chalk-ai/repo-agent-sandbox
cd repo-agent-sandbox

# Or export CHALK_CLIENT_ID and CHALK_CLIENT_SECRET.
chalk login

# Builds the server image, starts a warm pool of sandboxes, prints your demo's URL.
./deploy.py
Implementation details

How the example works

  • Check

    The server accepts only github.com/owner/name. It asks GitHub whether the repository exists, is public and is under 250 MB, and refuses it otherwise.

  • Clone

    A fresh sandbox from a warm pool shallow-clones the repository: one branch, no tags, no LFS, a 90-second limit, and a size check on the checkout.

  • Work

    pi opens in the checkout through an interactive PTY, drawn by ghostty-web. It reads, searches, edits and runs code there, and calls its model through the Chalk Model Gateway.

More capabilities

  • Untrusted checkouts

    pi runs with project-local extensions, skills, MCP servers and themes switched off, so a repository can't add code to the agent's harness.

  • Any agent, same box

    The sandbox is generic: swap pi for another coding agent or your own harness by changing the image. The isolation stays the same.

Give your coding agents a box of their own

Talk to an engineer about running agent sandboxes in your cloud, next to your code and data.

Talk to an engineerExplore sandboxes