Do I need a sandbox to run FastClaw?

No. On a self-hosted install the host shell is the default and the model can opt into the sandbox per call with exec(sandbox:true). Hosted deploys always use it.

How do I force sandboxing on my own server?

Set FASTCLAW_SANDBOX_ENFORCE=1. You get the hosted-style lockdown — recommended whenever agents are exposed to untrusted IM chatters.

What happens to files the agent creates?

They are synced back after each tool call and show up in that chat’s workspace, where you can open or download them.

Feature · Sandbox

Let agents run real code — inside a sandbox

Built-in exec, file and web tools, run in an E2B cloud sandbox or a Docker container, with automatic skill and workspace hydration and file sync.

Get started free See pricing

Built-in tools

exec, read_file, write_file, list_dir, web_fetch, web_search and memory_search are ready out of the box.

E2B or Docker

Pick an E2B cloud sandbox or a local Docker container as the backend, from Settings → Runtime or via environment variables.

Hydrate and sync

Skills and the workspace are copied in automatically, and files the agent writes are mirrored back to the durable store after every tool call.

Boundary on hosted deploys

With FASTCLAW_DEPLOY=hosted, every exec and file call is locked inside the sandbox. No host shell, ever.

Guests stay in the box

Only an agent’s real owner gets host access. API end-users, public-link visitors and IM chatters run their commands in the sandbox.

Big outputs, handled

Tool output over 64 KB is trimmed in context and saved in full under .tool-outputs/, so one huge log never blows the context window.

Tools that do real work

Agents in FastClaw don't just talk. They run shell commands, read and write files, fetch pages and search the web. exec on the host starts in the chat's session folder, so generated files land in that chat's workspace and can be linked straight from the reply. Add more tools through skills, MCP servers and plugins.

A sandbox that is a boundary, or a tool

FastClaw treats the sandbox differently depending on where it runs:

Hosted (FASTCLAW_DEPLOY=hosted): every exec and file call is confined to the sandbox.
Self-hosted: the host shell stays the default and the model opts into the sandbox per call. Set FASTCLAW_SANDBOX_ENFORCE=1 to get the hosted lockdown.

Either way, operator trust follows the agent's real owner. Anyone else — an end-user of your app, a public-link visitor or a stranger in a community chat — is a guest whose commands run in the sandbox, or are refused when there isn't one.

Pick a backend

Use E2B for managed cloud sandboxes or Docker to keep everything on your own machines. Configure it in Settings → Runtime, or pin it with FASTCLAW_SANDBOX_ENABLED, FASTCLAW_SANDBOX_BACKEND and FASTCLAW_SANDBOX_IMAGE. For multi-pod deploys, an S3-compatible object store keeps skills and files in sync across replicas.

Works with

All Integrations

E2B

Run every FastClaw agent command in an isolated E2B cloud sandbox — skills and workspace hydrated in, files synced back after each call.

Docker

Use Docker as FastClaw's sandbox backend to isolate agent commands on your own hardware — or deploy FastClaw itself with Docker Compose.

Frequently asked questions

More Features

All Features

Agents

Create and run many AI agents from one FastClaw install — each with its own SOUL.md personality, memory, skills, model and sharing settings.

Models

Run FastClaw agents on OpenAI, Anthropic, DeepSeek, Ollama, OpenRouter, Groq, Mistral or any OpenAI-compatible API, with per-agent overrides and retries.

Channels

Bind any FastClaw agent to Telegram, Discord, Slack, Feishu, WeCom, WeChat, WhatsApp, LINE or iMessage — with per-chat session isolation and owner pairing.

Try it on your own agents

Start free in FastClaw Cloud, or self-host the single binary in a minute.

Get started free See pricing