gitterm
Get started

Sandbox providers

Which providers run Gitterm sandboxes, what each one supports, and the limits that change how you use them.

View as markdown

This page compares the providers that can run a sandbox for your local agent. Use it to pick a provider, and to know what happens to a sandbox you forget about. The account fields each provider needs are in Account fields.

Capabilities

ProviderAccountsImageAbandoned sandboxPreviews
E2BManaged, directbase templateDeleted at the lifetimePrivate or public
DaytonaManaged, directnode:22-bookworm-slimDeleted at the lifetimePrivate or public
VercelManaged, directnode24 runtimeStopped at the lifetime; files discardedAlways public
BoatManaged, directBoat base imageStopped and archived at the lifetime; storage kept until destroyedAlways private
exe.devManaged, directnode:22-bookwormNever deleted by the providerAlways private, ports 3000 to 9999
RailwayManaged, directnode:22-bookworm-slim with Gitterm's command serverNever deleted by the providerAlways private, port 8080 reserved
AWSManaged onlynode:22-bookworm-slim with Gitterm's command serverNever deleted by the providerAlways private, port 8080 reserved
  • Lifetime is the time you set with lifetimeMinutes when creating the sandbox. The maximum is 24 hours on every provider except Vercel, where it is 5 hours.
  • Abandoned sandbox is what the provider does on its own if OpenCode crashes or your machine goes offline.
  • Previews: the column shows direct accounts. "Private or public" is chosen when the sandbox is created, with publicPreviews. A private preview rejects requests without an access header (a cookie on Boat). On an always-private provider, publicPreviews has no effect. With a managed account, Gitterm serves E2B, Daytona, Boat, and exe.dev previews, so those can be private or public too. See Previews by provider.

Cloudflare is not supported for sandboxes yet. It is planned.

Cleanup after a crash

The "Abandoned sandbox" column matters most for direct accounts:

  • Managed: Gitterm terminates every sandbox at its lifetime, whatever the provider does.
  • Direct: only the provider can clean up. exe.dev and Railway never do. A direct account on either must set "allowUnboundedLifetime": true to accept that a crashed sandbox keeps running and billing. Otherwise creation is refused.

Pausing (managed only)

A managed sandbox pauses after your plan's idle timeout. Paused time is not billed as active. It resumes on its next use: when the agent syncs, runs a command, reads a job, opens a preview, or downloads an artifact. From the CLI you can also run gitterm sandbox resume <sandboxId>.

ProviderOn pause
E2B, Daytona, Vercel, Boat, exe.devFiles are kept.
Railway, AWSFiles and processes are discarded. Sync again after it resumes. Earlier jobs are gone.

Direct sandboxes are never paused or resumed.

Provider notes

E2B. E2B deletes the sandbox at its lifetime even while it is busy. Reconnecting cannot extend that deadline.

Daytona. Set snapshot to start from a Daytona snapshot instead of the default image.

Vercel. Previews are always public URLs. Create the sandbox with public previews, approved when the agent asks or by the publicPreviews option, or sandbox_preview fails. A Vercel sandbox allows five tags, so the purpose and session labels may be dropped.

Boat. The base image cannot be replaced. It includes coding agent CLIs (claude, codex, opencode). Gitterm never starts them and gives them no credentials. At its lifetime the sandbox is archived, not deleted, and the storage remains until you destroy it. A file read returns at most 5 MiB, which limits artifacts. Boat has no labels, so the owning account is kept as a hash in the sandbox name.

exe.dev. The token needs the new, ls, ssh, ssh-key, pause, resume, and rm commands. Each request is limited to 30 seconds and 64 KB, so jobs start detached and large syncs are slow. Previews support ports 3000 to 9999. No labels; the owning account is kept as a hash in the sandbox name.

Railway. Railway has no command API, so the sandbox runs a small Gitterm command server. It is not an agent. It accepts requests only with a token derived from your Railway token and the sandbox name. Port 8080 is reserved for it.

AWS. Managed only, because it runs on the Gitterm deployment's ECS cluster and load balancer. It uses the same command server as Railway, with a token derived from the deployment's encryption key.