# Docs

- [Introduction](/docs): Welcome to the ScitiX Agent Sandbox documentation.
- [Installation](/docs/installation): Install Agent Sandbox on a Kubernetes cluster with Helm, and the `abx` CLI with its skills on your machine.
- Tutorials
  - [Agent Sandbox CLI Guide](/docs/tutorials/cli): How to drive Agent Sandbox from a shell or from a coding agent — environments and pools with `abx`, sandboxes with the E2B SDK.
  - [E2B Python SDK](/docs/tutorials/e2b): Drive Agent Sandbox sandboxes from the E2B SDK — endpoints, access paths, pools, create parameters and cross-cluster routing.
  - Evals
    - [Harbor benchmarks](/docs/tutorials/evals/harbor): Run Terminal-Bench, SWE-bench or a custom dataset on warm pools with Harbor and the agent-sandbox-harbor environment plugin.
    - [mini SWE Agent](/docs/tutorials/evals/mini-swe-agent): Welcome to the ScitiX Agent Sandbox documentation.
  - Managed Agents
    - [Brain and Hands](/docs/tutorials/managed-agents/brain-hands): Split an agent into the part that decides and the sandbox its tools act on — the architecture, the three bindings, and where the reference implementation lives.
- Examples
  - [What is here](/docs/examples): Manifests from config/samples, rendered on the page — three templates and an environment to apply to your cluster.
  - Templates
    - [Using the templates](/docs/examples/templates): Ready-to-apply SandboxTemplates — the base runtime, Docker inside the sandbox, and a microVM-isolated one.
    - [E2B Basic](/docs/examples/templates/e2b): The base template: envd in a Pod, any image on claim.
    - [E2B Docker](/docs/examples/templates/e2b-docker): Docker inside the sandbox — dockerd and the compose plugin, so a workload can build and run containers.
    - [E2B Kata](/docs/examples/templates/e2b-kata): The same sandbox in its own kernel — a microVM runtime class, for code you do not trust.
  - Environments
    - [Using the environments](/docs/examples/envs): A ready-to-apply SandboxEnv — an environment with a warm pool, and the one line that points it at another template.
    - [A warm pool](/docs/examples/envs/e2b): An environment on the E2B template, with two Pods kept warm — and the one line to change for the other two templates.
- Concepts
  - [The object model](/docs/concepts): Start here — SandboxTemplate, SandboxEnv and SandboxPool, how they relate, and which page answers which question.
  - [Sandbox templates](/docs/concepts/templates): What a SandboxTemplate is, how it differs from an E2B template, and what it does and does not decide.
  - [Sandbox environments](/docs/concepts/envs): A SandboxEnv binds one template, carries the settings every sandbox in it shares, and is the name you create sandboxes with.
  - [Sandbox pools](/docs/concepts/pools): A SandboxPool is a set of pre-warmed Pods of one resource shape — where capacity lives, and what decides how a pool is sized.
  - [Autoscaling](/docs/concepts/autoscaling): Scaling groups, their bounds and policies, and how to reason about cost and concurrency with them.
  - [In-place update](/docs/concepts/inplace-update): Why claiming a sandbox is fast — the idle image, the in-place container swap, and what that design costs.
  - [Cross-cluster](/docs/concepts/cross-cluster): One platform, several clusters — how an env spans them, how requests are routed, and how images follow.
  - [Egress and secrets](/docs/concepts/egress-and-secrets): The env's egress gateway, per-sandbox network policy, and credentials a sandbox can use without being able to read them.
  - [Secured access](/docs/concepts/secured-access): Why a sandbox ID is not a credential — the envd access token, the traffic access token, and what the stock E2B SDK does with them.
- Designs
  - [Design notes](/docs/designs): The decisions behind the platform — what we changed in the runtime, how egress is filtered, and how a create lands on another cluster.
  - [envd, and the patches we carry](/docs/designs/envd): The runtime inside every sandbox is upstream envd, with three changes — what each one fixes, and what it costs.
  - [The egress filter](/docs/designs/egress): How a sandbox's traffic is filtered and a credential is injected on the way out — the sidecar, the iptables redirect, the per-sandbox CA, and the two-tier SSRF baseline.
  - [Cross-cluster routing](/docs/designs/cross-cluster): How a create lands on another cluster, how the sandbox's ports follow it, and what the federation state is allowed to decide.
- Skills
  - [Using the skills](/docs/skills): The nine skills that ship with the CLI — what they are, how to install them, and how an agent picks one up.
  - [abx-common](/docs/skills/abx-common): How to reach an AgentBox platform with `abx` — endpoint and key, choosing a cluster, machine-readable output, and what happens to a write that needs someone's approval. Use when any abx command fails on authentication, addresses the wrong cluster, or comes back asking for approval. Every other abx skill defers here for those four things.
  - [abx-harbor-framework](/docs/skills/abx-harbor-framework): Run Harbor benchmarks (Terminal-Bench, SWE-bench, custom datasets) on AgentBox pre-warmed pools via the agent-sandbox-harbor environment plugin. Use when asked to evaluate an agent, run a benchmark suite, reproduce a leaderboard number, or work out why benchmark tasks are being rejected or timing out. Pool sizing lives in abx-resource-capacity; endpoint and key in abx-common.
  - [abx-managed-agent](/docs/skills/abx-managed-agent): Give your own agent a sandbox for its file and shell tools — the AgentBox hands bindings for Claude Agent SDK, OpenCode and generic MCP, plus the platform side that has to exist first. Use when asked to connect sandboxes to an existing agent or harness, to make an agent's work durable across restarts, or to integrate AgentBox into a product. Pool sizing lives in abx-resource-capacity.
  - [abx-observe](/docs/skills/abx-observe): Work out why an AgentBox sandbox, pool or environment is failing or slow — events, pool status, sandbox logs, and the E2B-native metrics endpoints. Use when a sandbox will not start, a pool sits below target, commands inside a sandbox fail, or someone asks how much CPU and memory sandboxes are using. Authentication and cluster selection live in abx-common.
  - [abx-reinforcement-learning](/docs/skills/abx-reinforcement-learning): Set up and run RL rollouts on AgentBox — choosing a template, sizing a warm pool for the concurrency a trainer needs, and driving the sandboxes with the E2B SDK. Use when asked to run rollouts, collect trajectories, scale an environment for RL training, or work out why a rollout loop is stalling on sandbox creation. Pool mechanics live in abx-resource-capacity; benchmarks in abx-harbor-framework.
  - [abx-resource-capacity](/docs/skills/abx-resource-capacity): Size AgentBox warm pools, configure autoscaling groups, read quota, and recover when a pool will not grow. Use when sandboxes queue or fail to start, when a pool sits below its target, when scaling is too slow or runs away, or when you need N concurrent sandboxes and must work out whether the capacity exists. Authentication and cluster selection live in abx-common.
  - [abx-sandbox-docker](/docs/skills/abx-sandbox-docker): Run Docker inside an AgentBox sandbox — building images, docker compose, and reaching an internal registry from in there. Use when a workload needs a container runtime of its own, when `docker` is not found inside a sandbox, or when someone asks about Docker-in-Docker isolation. Pool sizing lives in abx-resource-capacity.
  - [abx-sandbox-network](/docs/skills/abx-sandbox-network): Control what a sandbox can reach on the network — denying outbound traffic so an agent under evaluation cannot look up answers or pull extra packages, and allowing only the hosts a task genuinely needs. Use for evaluation isolation, egress policy, or "why can my sandbox still reach the internet". Credential injection lives in abx-sandbox-secrets.
  - [abx-sandbox-secrets](/docs/skills/abx-sandbox-secrets): Give a sandbox the use of a credential without giving it the credential — the vault and outbound injection. Use when sandbox code must call a third-party API with a token, when someone is about to put a real key in a sandbox's environment variables, or when an injected credential is not arriving. Egress filtering lives in abx-sandbox-network.