Sandbox runtimes overview

Every LaunchKit agent task executes inside an isolated sandbox VM. A sandbox runtime is the workspace-level record of where those sandboxes run. By default that is LaunchKit’s managed plane; enterprises with data-residency or network constraints can instead bring their own E2B-compatible sandbox plane, in one of two modes.

Direct vs bridge

	Direct mode	Bridge mode
Your plane is	Reachable from the LaunchKit cloud over HTTPS	Intranet-only; unreachable from outside
Connection direction	LaunchKit calls your plane	Your network makes outbound-only calls to LaunchKit
Who holds the plane’s API key	LaunchKit, encrypted at rest (AWS KMS envelope, bound to your workspace and runtime)	You. The key never leaves your network; LaunchKit never sees it
What you operate	Nothing	The `launchkit-worker` daemon next to your plane
Inbound ports opened on your side	Your plane’s existing HTTPS endpoint	None

Choose direct when your plane already has a cloud-reachable endpoint and you are comfortable with LaunchKit storing its API key encrypted. Choose bridge when the plane must stay on your intranet or the key must never leave your custody.

What counts as E2B-compatible

A plane that speaks the E2B control-plane API: the real E2B cloud, or a compatible implementation such as Tencent CubeSandbox. Compatibility specifics (pause support, key validation, private CAs) are covered in Compatibility.

Onboarding flow

Runtime records are created by your LaunchKit contact during rollout; you supply the connection details (direct) or run the worker (bridge).

You                                    LaunchKit
──────────────────────────             ─────────────────────────────
Pick direct or bridge      ──────────► Create the runtime record
Direct: hand over URL + key ─────────► Enter key, run conformance probe
Bridge: install + start the ─────────► Mint your runtime worker key,
        worker daemon                  verify an online worker
                            ◄────────  Runtime shows "connected"

Runtime status

Status	Meaning
`connected`	The last probe succeeded; tasks can use this runtime
`needs_credentials`	Direct mode: the record exists but no API key has been entered yet
`error`	The last probe failed; the status message says why

A runtime that is not connected fails closed: tasks will not silently fall back to another plane.

Bring your own box

Sandbox runtimes overview

Direct vs bridge

What counts as E2B-compatible

Onboarding flow

Runtime status

Next steps

​Direct vs bridge

​What counts as E2B-compatible

​Onboarding flow

​Runtime status

​Next steps

Direct vs bridge

What counts as E2B-compatible

Onboarding flow

Runtime status

Next steps