> ## Documentation Index
> Fetch the complete documentation index at: https://docs.trylaunchkit.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Sandbox runtimes overview

> Run agent sandboxes on your own E2B-compatible plane

Every LaunchKit agent task executes inside an isolated sandbox VM. A **sandbox runtime** is the workspace-level record of *where* those sandboxes run. By default that is LaunchKit's managed plane; enterprises with data-residency or network constraints can instead **bring their own** E2B-compatible sandbox plane, in one of two modes.

## Direct vs bridge

|                                   | Direct mode                                                                          | Bridge mode                                                         |
| --------------------------------- | ------------------------------------------------------------------------------------ | ------------------------------------------------------------------- |
| Your plane is                     | Reachable from the LaunchKit cloud over HTTPS                                        | Intranet-only; unreachable from outside                             |
| Connection direction              | LaunchKit calls your plane                                                           | Your network makes **outbound-only** calls to LaunchKit             |
| Who holds the plane's API key     | LaunchKit, encrypted at rest (AWS KMS envelope, bound to your workspace and runtime) | **You.** The key never leaves your network; LaunchKit never sees it |
| What you operate                  | Nothing                                                                              | The `launchkit-worker` daemon next to your plane                    |
| Inbound ports opened on your side | Your plane's existing HTTPS endpoint                                                 | **None**                                                            |

Choose **direct** when your plane already has a cloud-reachable endpoint and you are comfortable with LaunchKit storing its API key encrypted. Choose **bridge** when the plane must stay on your intranet or the key must never leave your custody.

## What counts as E2B-compatible

A plane that speaks the E2B control-plane API: the real E2B cloud, or a compatible implementation such as **Tencent CubeSandbox**. Compatibility specifics (pause support, key validation, private CAs) are covered in [Compatibility](/en/runtimes/compatibility).

## Onboarding flow

Runtime records are created by your **LaunchKit contact** during rollout; you supply the connection details (direct) or run the worker (bridge).

```
You                                    LaunchKit
──────────────────────────             ─────────────────────────────
Pick direct or bridge      ──────────► Create the runtime record
Direct: hand over URL + key ─────────► Enter key, run conformance probe
Bridge: install + start the ─────────► Mint your runtime worker key,
        worker daemon                  verify an online worker
                            ◄────────  Runtime shows "connected"
```

## Runtime status

| Status              | Meaning                                                            |
| ------------------- | ------------------------------------------------------------------ |
| `connected`         | The last probe succeeded; tasks can use this runtime               |
| `needs_credentials` | Direct mode: the record exists but no API key has been entered yet |
| `error`             | The last probe failed; the status message says why                 |

A runtime that is not `connected` **fails closed**: tasks will not silently fall back to another plane.

## Next steps

* [Direct mode](/en/runtimes/direct)
* [Bridge mode](/en/runtimes/bridge)
* [Compatibility](/en/runtimes/compatibility)
* [Troubleshooting](/en/runtimes/troubleshooting)