> ## Documentation Index
> Fetch the complete documentation index at: https://docs.anonalabs.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Run code an agent wrote

> One throwaway microVM per task, deleted when it finishes.

**You want** to execute code you did not write, such as an LLM's output, without risking your machine or other users.

**Why a sandbox fits.** Each sandbox is a KVM microVM with its own kernel, so a bad script can fill its own disk and nothing else. See [Security](https://docs.anonalabs.com/compute/concepts/security.md).

**1. Create one sandbox per task**

Pick the smallest [template](https://docs.anonalabs.com/compute/concepts/templates.md) that has what the code needs: `python` for scripts, `node` for JavaScript. Set a short timeout so a forgotten sandbox is deleted for you.

**2. Run, read, and clean up**

```python run_untrusted.py theme={null}
from anona import Sandbox

with Sandbox.create("python", timeout=120) as sbx:
    sbx.files.write("/home/user/task.py", "print(sum(range(10)))\n")
    result = sbx.commands.run("python /home/user/task.py")
    print(result.stdout, result.exit_code)
```

The `with` block deletes the sandbox on exit.

**3. Decide what it may reach**

Sandboxes can reach the internet by default, minus private ranges and cloud metadata, which are always blocked. Turn egress off or allow only the hosts you name: [Networking](https://docs.anonalabs.com/compute/concepts/networking.md). Give API tokens through the credential vault so the code never sees them.

**Next:** [Run code](https://docs.anonalabs.com/compute/guides/run-code.md) for exit codes and environment, [Processes](https://docs.anonalabs.com/compute/guides/processes.md) for streaming output.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.