A real shell,
safely out of reach.
Open a terminal in a Chalk sandbox, right here in your browser. It runs on its own gVisor kernel with no network access, lasts a few minutes, and is deleted the moment you leave. The same primitive runs untrusted code for AI agents in production.
Try to break out
Press Launch sandbox for your own Linux box with Python. Poke around, install nothing, reach nothing: there is no network. Each session lasts four minutes and ends after a minute and a half of inactivity.
How it works
A small server, itself running on Chalk, sits between this page and a fresh sandbox. It holds no secrets the sandbox can reach, and the sandbox holds none at all.
Launch
Pressing Launch hands you a sandbox from a small warm pool, so it is ready in about a second. Nobody has used it before you, and nobody will after.
Attach
The server opens an interactive PTY session in the sandbox and relays it over a WebSocket. Keystrokes go in, terminal output comes back, and resizes follow your window.
Render
ghostty-web draws the terminal: Ghostty's own VT parser compiled to WebAssembly, so colors, cursor movement, and full-screen programs behave like a native terminal.
A sandbox in a few lines of Python
Create a sandbox, run a command, stream another, and tear it down. Every limit you see on this page is a constructor argument: CPU, memory, lifetime, kernel policy, and network policy.
The terminal above is open source too. Its server keeps a warm pool, rate-limits by visitor, and relays a PTY over a WebSocket. The page uses ghostty-web.
chalk-ai/sandbox-terminalfrom chalkcompute import ComputeClass, ContainerSecurityPolicy, KernelPolicy, Sandbox
sandbox = Sandbox(
cpu="500m",
memory="1Gi",
lifetime="300s", # deleted after five minutes, whatever happens
compute_class=ComputeClass.HOST,
security_policy=ContainerSecurityPolicy(kernel_policy=KernelPolicy.RESTRICTED),
# No network_policy: no egress at all, not even DNS.
)
sandbox.run()
result = sandbox.exec("python3", "-c", "print(6 * 7)")
print(result.stdout.decode()) # 42
for event in sandbox.exec_stream("bash", "-c", "for i in 1 2 3; do echo tick $i; sleep 1; done"):
if event.stdout:
print(event.stdout, end="")
sandbox.terminate()Built for untrusted code
Agents write code, users upload notebooks, evals run model output. Chalk sandboxes give each of them somewhere safe to run.
A kernel of its own
KernelPolicy.RESTRICTED runs the sandbox under gVisor. Code inside talks to a user-space kernel, never directly to the host's.
No network by default
A sandbox without a network policy has no egress at all, not even DNS. Allow specific hosts or CIDRs when a workload needs them.
Ready in a second
Warm sandboxes start in about 1.5 seconds. Keep a small pool of them and a visitor never waits for one.
Hard limits
CPU, memory, and a lifetime are set per sandbox. When the lifetime runs out, Chalk deletes it, even if your code forgets to.
Exec, stream, or attach
Run a command and collect the result, stream its output as it runs, or attach an interactive PTY session with a real terminal.
Images from Python
Start from the default image with Python and git, or build your own with Image.debian_slim().pip_install(...). No Dockerfile required.
Give your agents a safe place to work
Talk to an engineer about running sandboxes in your cloud, next to your data.