|
| 1 | +--- |
| 2 | +title: About {% data variables.copilot.sandbox %} |
| 3 | +shortTitle: Cloud and local sandboxes |
| 4 | +allowTitleToDifferFromFilename: true |
| 5 | +intro: '{% data variables.copilot.sandbox_caps %} provide isolated execution environments that let {% data variables.product.prodname_copilot_short %} safely interact with code, tools, filesystem, and network resources securely on your local machine or in fully isolated cloud environments.' |
| 6 | +versions: |
| 7 | + feature: copilot |
| 8 | +redirect_from: |
| 9 | + - /copilot/concepts/about-github-sandbox |
| 10 | +contentType: concepts |
| 11 | +category: |
| 12 | + - Learn about Copilot |
| 13 | + - Learn about Copilot CLI |
| 14 | +docsTeamMetrics: |
| 15 | + - copilot-cli |
| 16 | +--- |
| 17 | + |
| 18 | +{% data reusables.cli.public-preview-sandbox %} |
| 19 | + |
| 20 | +## Introduction |
| 21 | + |
| 22 | +{% data variables.copilot.sandbox_caps %} are the execution platform powering secure sandboxed experiences for {% data variables.copilot.copilot_cli %}, both locally and in the cloud. As {% data variables.product.prodname_copilot_short %} takes more actions on your behalf—running tools, executing commands, and modifying files—{% data variables.copilot.sandbox_short %} provide the isolation, portability, and policy controls needed to adopt agentic workflows safely. {% data variables.copilot.sandbox_caps %} currently apply to {% data variables.copilot.copilot_cli_short %} sessions, and you can also use cloud sandboxes for sessions in the {% data variables.copilot.github_copilot_app %}. |
| 23 | + |
| 24 | +With {% data variables.copilot.sandbox %}, you can choose where {% data variables.product.prodname_copilot_short %} runs: |
| 25 | + |
| 26 | +* **Local sandboxing**: Run {% data variables.product.prodname_copilot_short %} securely on your own machine, with restricted access to filesystem, network, and system capabilities. |
| 27 | +* **Cloud sandboxing**: Run {% data variables.product.prodname_copilot_short %} inside fully isolated, ephemeral Linux environments hosted by {% data variables.product.github %}. |
| 28 | + |
| 29 | +## Local sandboxing |
| 30 | + |
| 31 | +Local sandboxing lets {% data variables.product.prodname_copilot_short %} run in a sandboxed environment directly on your machine, with restricted access to your filesystem, network connectivity, and system capabilities. |
| 32 | + |
| 33 | +### Enabling local sandboxing |
| 34 | + |
| 35 | +To enable local sandboxing inside a {% data variables.copilot.copilot_cli_short %} session, run: |
| 36 | + |
| 37 | +```shell copy |
| 38 | +/sandbox enable |
| 39 | +``` |
| 40 | + |
| 41 | +Once enabled, commands that {% data variables.product.prodname_copilot_short %} executes on your behalf run inside the sandbox, limiting their access to your system. |
| 42 | + |
| 43 | +### Cross-platform support |
| 44 | + |
| 45 | +Local sandboxing is available across macOS, Linux, and Windows, delivering a consistent isolation experience regardless of your operating system. |
| 46 | + |
| 47 | +### Enterprise policy enforcement |
| 48 | + |
| 49 | +For organizations and enterprises, local sandbox policies can be centrally configured and enforced using Microsoft Intune and other MDM (mobile device management) platforms. This gives administrators control over how {% data variables.product.prodname_copilot_short %} interacts with local resources across managed devices. |
| 50 | + |
| 51 | +## Cloud sandboxing |
| 52 | + |
| 53 | +Cloud sandboxing lets you run {% data variables.copilot.copilot_cli_short %} sessions inside fully isolated, ephemeral Linux environments hosted by {% data variables.product.github %}. Each cloud sandbox session is isolated from your local environment and from other sessions. |
| 54 | + |
| 55 | +Cloud sandboxing is built on Azure Container Apps Sandboxes, with {% data variables.product.github %} providing the identity, policy, and billing layer. |
| 56 | + |
| 57 | +### Starting a cloud sandbox session |
| 58 | + |
| 59 | +To start a cloud-backed session, run the following command: |
| 60 | + |
| 61 | +```shell copy |
| 62 | +copilot --cloud |
| 63 | +``` |
| 64 | + |
| 65 | +This launches an interactive {% data variables.copilot.copilot_cli_short %} session inside a cloud sandbox. You can prompt {% data variables.product.prodname_copilot_short %} to perform tasks, run shell commands, and iterate on code, the same way you would in a local session. The commands that {% data variables.product.prodname_copilot_short %} runs execute in the cloud environment, not on your local machine. |
| 66 | + |
| 67 | +### Continue sessions across devices |
| 68 | + |
| 69 | +Because cloud sandbox sessions run in {% data variables.product.github %}-hosted infrastructure, you can pick up a {% data variables.product.prodname_copilot_short %} session on any device, regardless of where the session was originally started. This enables more flexible workflows without needing to copy files or reinstall dependencies. |
| 70 | + |
| 71 | +### Offload compute-intensive workflows |
| 72 | + |
| 73 | +You can run multiple {% data variables.product.prodname_copilot_short %} tasks in parallel in the cloud without consuming local resources. This keeps your local environment lightweight and responsive while scaling agent-driven work. |
| 74 | + |
| 75 | +### Unified governance |
| 76 | + |
| 77 | +Cloud sandbox policies share the same configuration as {% data variables.copilot.copilot_cloud_agent %} policies, extending existing security controls to cloud sandboxed execution without additional setup. |
| 78 | + |
| 79 | +### Session lifecycle |
| 80 | + |
| 81 | +A cloud sandbox session has three main states: |
| 82 | + |
| 83 | +* **Active**: The session is running, and you are interacting with it from {% data variables.copilot.copilot_cli_short %}. |
| 84 | +* **Stopped**: The session is not currently running, but its state is saved. When you resume it, your files, environment variables, and in-progress work are restored. |
| 85 | +* **Deleted**: The session and its saved state are removed and cannot be recovered. |
| 86 | + |
| 87 | +When you stop a session, the cloud sandbox creates a snapshot of its state so you can pick up where you left off later. When you delete a session, both the running environment and the snapshot are removed. |
| 88 | + |
| 89 | +## Authentication and access |
| 90 | + |
| 91 | +{% data variables.copilot.sandbox_short_caps %} use your existing {% data variables.copilot.copilot_cli_short %} authentication. If you can sign in to {% data variables.copilot.copilot_cli_short %} and have access to {% data variables.product.prodname_copilot_short %}, you can use {% data variables.copilot.sandbox_short %}. You don't need to configure a separate cloud provider, manage API keys, or set up infrastructure. |
| 92 | + |
| 93 | +An organization or enterprise owner must enable the **Cloud Sandbox access** policy in the organization or enterprise settings before members can use {% data variables.copilot.sandbox_short %}. |
| 94 | + |
| 95 | +For information about signing in to {% data variables.copilot.copilot_cli_short %}, see [AUTOTITLE](/copilot/how-tos/set-up/install-copilot-cli). |
| 96 | + |
| 97 | +## Billing |
| 98 | + |
| 99 | +Local sandboxing is included in the standard {% data variables.product.prodname_copilot %} seat at no additional cost. |
| 100 | + |
| 101 | +Cloud sandboxing is billed based on usage. {% data variables.product.github %} measures cloud sandbox usage across three meters: |
| 102 | + |
| 103 | +| Meter | Description | Unit | Price (USD) | |
| 104 | +| --- | --- | --- |------------| |
| 105 | +| Compute | Time that a cloud sandbox session is running. | Compute second | $0.000024 | |
| 106 | +| Memory | Memory allocated to a cloud sandbox session while it is running. | GiB second | $0.000003 | |
| 107 | +| Storage | Snapshot storage for stopped sessions. | GiB month | $0.005 | |
| 108 | + |
| 109 | +For more information about how cloud sandbox usage is measured and billed, see [AUTOTITLE](/billing/concepts/product-billing/cloud-and-local-sandboxes). |
| 110 | + |
| 111 | +## Further reading |
| 112 | + |
| 113 | +* [AUTOTITLE](/copilot/concepts/agents/copilot-cli/about-copilot-cli) |
| 114 | +* [AUTOTITLE](/copilot/how-tos/cloud-and-local-sandboxes/enabling-or-disabling-cloud-and-local-sandboxes-for-your-organization) |
| 115 | +* [AUTOTITLE](/copilot/how-tos/set-up/install-copilot-cli) |
0 commit comments