Skip to main content
Private beta: AI SRE is currently in private beta and available to invited accounts only. To join the whitelist test, contact the Flashduty sales team to request access; features and the UI may change during the beta.

Overview


The cloud sandbox is a temporary execution environment managed by Flashduty — an isolated, ready-to-use container. The AI SRE agent’s tool calls (running commands, reading and writing files, running Skills, connecting to MCP) all happen inside it, and you don’t have to install or maintain anything. It is AI SRE’s default fallback: when your account has no online self-hosted Runner (BYOC), sessions automatically run in the cloud sandbox; you can also pin a session to it manually.

Zero install, ready to use

No process to deploy and no credentials to enter. New accounts, ad-hoc investigations, and demos can start chatting right away on a clean sandbox the system allocates.

Auto-pause when idle

The sandbox pauses automatically when the session is idle to free resources, then resumes on your next message, continuing in the same working directory.

When to use the cloud sandbox


The cloud sandbox is best for investigations that don’t depend on your private network, and for getting started quickly:
  • Quick start / demos: you haven’t deployed a Runner yet and want to try AI SRE’s troubleshooting first;
  • Publicly reachable diagnostics: the investigation only needs Flashduty’s own data (incidents, alerts, changes) or trusted public services;
  • One-off, lightweight tasks: you don’t want to set up a dedicated always-on machine for a single investigation.
The cloud sandbox cannot reach your private network: its egress is restricted to a set of trusted public domains and cannot reach databases, APIs, or jump hosts behind your VPC, dedicated line, or intranet. When an investigation needs to connect to those targets directly, use a self-hosted BYOC Runner instead — putting execution on a machine that can reach your internal systems.

Using it in a session


The environment selector at the bottom of the chat box decides where the session executes. Two of its options relate to the cloud sandbox:
OptionBehavior
AutoThe default for new sessions. Prefers an online Runner if the account has one; otherwise falls back to the cloud sandbox.
Cloud sandbox · DefaultForces the cloud sandbox, ignoring all self-hosted Runners.
The environment choice is locked once per session: the environment determined when the session sends its first message is recorded and reused for every later turn; it does not change if you switch the selector afterward. To use a different environment, start a new session. See BYOC · Selecting an environment in a session.

Cloud sandbox vs. self-hosted Runner


DimensionCloud sandboxSelf-hosted Runner (BYOC)
DeploymentNo install, system-managedDeploy a persistent process on your own machine
Private-network reach❌ Trusted public domains only✅ Can reach your VPC / intranet / dedicated line
Data residencyInside the managed environmentStays within your own network boundary
LifecycleTemporary, auto-pauses when idlePersistent, under your control
Best forQuick start, public diagnosticsDeep investigations that reach real production
The two aren’t mutually exclusive: keep sessions on Auto day to day — they fall back to the cloud sandbox when no Runner is available — and connect a BYOC Runner when an investigation needs to reach your internal systems.

BYOC

Deploy a persistent Runner on your own machine so investigations reach your private network.

Console

See the execution environment and status bound to a session.

MCP (External Tools)

MCP connections are established inside the selected environment at agent runtime.

Skill

Skills run inside the selected execution environment.