Choose a sandbox

Available environments

Start with Docker or Podman if you want a local container. For hosted execution, use Vercel or Daytona. The sandbox provider determines where commands run; you can select it independently of the agent.

• DockerThe default: a local container started from an image you build. mounted
• PodmanThe same container provider on the Podman engine, rootless included. mounted
• VercelA hosted sandbox that needs no local engine. remote
• DaytonaA hosted sandbox that also supports interactive terminals. remote
• FirecrackerA microVM on a Linux host with KVM that you prepare. remote
• Host executionCommands run directly on your machine, without isolation. host

Choose for your task

1. Docker and PodmanA repeatable environment on your machine or a CI runner. Start here.
2. Cloud sandboxesWork that must run away from the host, with outbound allowlists.
3. Firecracker microVMsA separate guest kernel on infrastructure you operate.
4. Host executionTrusted code that needs the tools installed on your machine.

Use a provider

Import the provider from its subpath and pass it as sandboxProvider. The agent, the brief and the branch stay the same.

import { reportValue } from "./reporter.ts";
import { dispatch } from "@elie-laloum/outpost";
import { createVercelSandboxProvider } from "@elie-laloum/outpost/providers/vercel";
import { coder, repository } from "./outpost.config.ts";

const result = await dispatch({
  agent: coder,
  repository,
  sandboxProvider: createVercelSandboxProvider(),
  brief: { text: "Fix the broken links in the README and commit the change." },
});
reportValue(result.branch, result.commits.length);
// Example output: outpost/job-… 1

Each provider has its own subpath, @elie-laloum/outpost/providers/<name>: docker, podman, vercel, daytona, firecracker and local. Omit sandboxProvider and Outpost uses Docker.

Vercel and Daytona load their SDK when they allocate a sandbox. Install it next to Outpost: npm install @vercel/sandbox or npm install @daytona/sdk. The other providers need no extra package.

Compare environments

	Docker, Podman	Vercel	Daytona	Firecracker	Host
Repository access	Mounted worktree	Uploaded snapshot	Uploaded snapshot	Uploaded snapshot	Host filesystem
Isolation	Container	Hosted sandbox	Hosted sandbox	MicroVM	None
Interactive attach()	Yes	No	Yes	No	Yes
Live input for steering	Yes	Yes	Yes	Yes	Yes
Dependency caches	Yes	No	No	No	No
Egress rules	deny-all only	Yes	Yes, with limits	No	No
Durable speculation recovery	Yes	No	No	No	No
Installs a missing agent CLI	No	Yes	Yes	Yes	No
Default branch mode	current	integrate	integrate	integrate	current
Setup	Engine and image	@vercel/sandbox, credentials	@daytona/sdk, API key	KVM host, kernel, rootfs, TAP, SSH	Agent CLI and tools

Remote providers (Vercel, Daytona, Firecracker) work on a copy of the Git history. They install a missing supported CLI before the first turn unless you pass bootstrap: false, and they reject the current branch mode.

With repositoryMode: "isolated", Docker and Podman behave like a remote provider: see Private Git. They then lose durable speculation recovery, which needs the default mounted mode.

Limits

• Nothing falls back to the host. A missing engine, SDK or credential fails the task; only createLocalSandboxProvider() runs on the host, and you choose it explicitly.
• A mounted container can write the repository’s Git metadata. It is not a boundary against a hostile agent: read Security.
• Remote synchronization stops instead of overwriting concurrent host edits, and keeps recovery data. See Cloud sandboxes.
• A Firecracker provider owns one TAP device and runs one VM at a time. Create one provider per concurrent VM.

API: SandboxProvider · createDockerSandboxProvider · createPodmanSandboxProvider · createVercelSandboxProvider · createDaytonaSandboxProvider · createFirecrackerSandboxProvider · createLocalSandboxProvider.