Skip to main content
Public beta: AI SRE is in public beta, rolling out gradually to accounts on On-call Pro or higher, at no additional charge during the beta. To get access, submit the AI SRE beta application form. Features and the UI may continue to change.

​
Overview

The cloud sandbox is a temporary execution environment managed by Flashduty — an isolated, ready-to-use container. The AI SRE agent’s tool calls (running commands, reading and writing files, running Skills, connecting to MCP) all happen inside it, and you don’t have to install or maintain anything. It is AI SRE’s default fallback: when no usable self-hosted Runner (BYOC Runner) is online for the current member, sessions automatically run in the cloud sandbox; you can also pin a session to it manually.

Zero install, ready to use

No process to deploy and no credentials to enter. New accounts, ad-hoc investigations, and demos can start chatting right away on a clean sandbox the system allocates.

Auto-pause when idle

The sandbox pauses automatically when the session is idle to free resources, then resumes on your next message, continuing in the same working directory.

​
When to use the cloud sandbox

The cloud sandbox is best for investigations that don’t depend on your private network, and for getting started quickly:
  • Quick start / demos: you haven’t deployed a Runner yet and want to try AI SRE’s troubleshooting first;
  • Publicly reachable diagnostics: the investigation only needs Flashduty’s own data (incidents, alerts, changes) or trusted public services;
  • One-off, lightweight tasks: you don’t want to set up a dedicated always-on machine for a single investigation.
The cloud sandbox cannot reach your private network: its egress is restricted to a set of trusted public domains and cannot reach databases, APIs, or jump hosts behind your VPC, dedicated line, or intranet. When an investigation needs to connect to those targets directly, use a self-hosted BYOC Runner instead — putting execution on a machine that can reach your internal systems.

​
Using it in a session

The environment selector at the bottom of the chat box decides where the session executes. Two of its options relate to the cloud sandbox:
The environment choice is locked once per session: the environment determined when the session sends its first message is recorded and reused for every later turn; it does not change if you switch the selector afterward. To use a different environment, start a new session. See BYOC · Selecting an environment in a session.

​
Cloud sandbox vs. self-hosted Runner

The two aren’t mutually exclusive: keep sessions on Auto day to day — they fall back to the cloud sandbox when no Runner is available — and connect a BYOC Runner when an investigation needs to reach your internal systems.

BYOC Runner

Deploy a persistent Runner on your own machine so investigations reach your private network.

Console

See the execution environment and status bound to a session.

MCP (External Tools)

MCP connections are established inside the selected environment at agent runtime.

Skill

Skills run inside the selected execution environment.