Helix Sandbox

Helix executes code inside isolated Daytona sandboxes. Each workspace is a Linux container with a persistent project directory. The sandbox is the source of truth for filesystem and process boundaries.

Workspace lifecycle

• Create — sandbox_create() provisions a new Daytona workspace. For from-scratch work it uses the default image and mounts /workspace/repo.
• Clone — sandbox_clone_repo(repoUrl, targetDir) pulls an additional repository into a named subdirectory.
• Run — sandbox_run_command(command, cwd, background) executes shell commands in the workspace.
• Destroy — sandbox_destroy() tears down the workspace and its volumes.

Working directory tracking

Helix tracks the current working directory per conversation. The first command in a run defaults to /workspace/repo. If a command contains cd, Helix records the final directory and uses it for the next command. This lets multi-step tasks move through subdirectories without the agent having to repeat full paths.

Background commands

Long-running commands such as go run ./cmd/server can be started with background: true. The agent server starts the process with nohup/setsid, returns a PID and a log path, and continues execution. Later commands can read the log or send requests to the running service.

Network policy

The sandbox network is controlled by Daytona. By default the sandbox can reach the public internet. When networkEnabled is true, tools like curl and wget are allowed. When networkEnabled is false, outbound network access is blocked by the runtime, not by a hardcoded string guard in Helix.

Filesystem isolation

Daytona mounts only the project directories. System paths such as /etc, /var, /run, and /usr are part of the container image. Helix does not maintain a separate regex guard that rejects commands touching these paths; the sandbox itself is the boundary.

Tool examples

{
  "tool": "sandbox_create",
  "params": {}
}

{
  "tool": "sandbox_run_command",
  "params": {
    "command": "go test ./...",
    "cwd": "/workspace/repo",
    "background": false
  }
}

Debugging

If a command fails, Helix reads the stdout/stderr from the observation and can inspect surrounding files. You can also open the Workspace panel to see live command output, file tree, and git status.

Related

• Helix Architecture
• Helix Phases
• Helix Security