{
  "schema_version": "1.1",
  "id": "s4:https://vercel.com/changelog/run-multiple-isolated-agents-in-a-single-sandbox",
  "slug": "run-multiple-isolated-agents-in-a-single-sandbox-03i3r7u",
  "url": "https://feed7.dev/p/run-multiple-isolated-agents-in-a-single-sandbox-03i3r7u",
  "title": "Run multiple isolated agents in a single Sandbox",
  "why_included": "Vercel Sandbox can now isolate agents as Linux users while exposing selected files through a shared group directory. This gives multi-agent harnesses a simpler permission boundary.",
  "summary": "The **@vercel/sandbox SDK** now supports multiple Linux users and groups. Each agent gets a **private home directory**; users cannot read, write, or list one another’s files, while a **shared group directory** supports collaboration.",
  "practical_implication": "Create one user per agent and expose only the workspace they need through a group. This makes coder-reviewer or other multi-agent roles easier to separate without provisioning a sandbox for each role.",
  "agent_context": "The **@vercel/sandbox SDK** now supports multiple Linux users and groups. Each agent gets a **private home directory**; users cannot read, write, or list one another’s files, while a **shared group directory** supports collaboration.\n\nCreate one user per agent and expose only the workspace they need through a group. This makes coder-reviewer or other multi-agent roles easier to separate without provisioning a sandbox for each role.\n\nThe boundary is user and group permissions inside one Sandbox. The material does not claim separate kernels, resource quotas, or protection from vulnerabilities that cross operating-system user boundaries.",
  "source": {
    "name": "Vercel",
    "url": "https://vercel.com/changelog/run-multiple-isolated-agents-in-a-single-sandbox",
    "published_at": "2026-07-30T04:00:00.000Z"
  },
  "source_class": "blog_post",
  "content_type": "Engineering Post",
  "layer": "infra",
  "domains": [
    "coding",
    "security"
  ],
  "topics": [
    "sandboxing",
    "multi-agent",
    "agent-reliability"
  ],
  "verification": {
    "status": "official_source",
    "label": "Official Source",
    "method": "source_feed",
    "verified_at": null
  },
  "uncertainty": [
    "The boundary is user and group permissions inside one Sandbox. The material does not claim separate kernels, resource quotas, or protection from vulnerabilities that cross operating-system user boundaries."
  ],
  "connected_context": {
    "meaning": "This adds a practical middle ground between sharing one unrestricted workspace and provisioning a sandbox per agent: role separation through Linux users, private homes, and an explicit collaboration directory. It narrows the security claim to filesystem permissions within one OS boundary, so workflow verification, authority, and stronger kernel isolation remain separate concerns.",
    "corpus_size": 297,
    "generated_at": "2026-07-31T10:05:49.629Z",
    "connections": [
      {
        "title": "From fork() to Fleet: Designing an Agent Sandbox Cloud — Abhishek Bhardwaj, OpenAI",
        "source_name": "YouTube",
        "source_url": "https://www.youtube.com/watch?v=OqM67QG_Ikk",
        "feed7_url": "https://feed7.dev/p/from-fork-to-fleet-designing-an-agent-sandbox-cloud-abhishek-bhardwaj-op-0np9ki3",
        "reason": "The microVM design addresses kernel exposure and fleet-level persistence, whereas this Signal separates agents only through users and groups inside one Sandbox."
      },
      {
        "title": "What Does Done Even Mean? Agents and Paperclip's Liveness Model - Dotta, Paperclip",
        "source_name": "YouTube",
        "source_url": "https://www.youtube.com/watch?v=7P0elyLIxXo",
        "feed7_url": "https://feed7.dev/p/what-does-done-even-mean-agents-and-paperclip-s-liveness-model-dotta-pap-0lx8wfc",
        "reason": "Filesystem separation can enforce role boundaries, but it does not supply the evidence, approval, or ownership model needed to decide when multi-agent work is done."
      },
      {
        "title": "Don't Build Agents You Can't Answer For — Addy Osmani",
        "source_name": "YouTube",
        "source_url": "https://www.youtube.com/watch?v=n97BCfyFIvw",
        "feed7_url": "https://feed7.dev/p/don-t-build-agents-you-can-t-answer-for-addy-osmani-1y9nwej",
        "reason": "Private and shared directories can constrain who handles artifacts, while explainable diffs, tests, logs, and ownership are still required to make those artifacts accountable."
      }
    ]
  },
  "lifecycle": "Current",
  "published_at": "2026-07-30T04:00:00.000Z",
  "modified_at": "2026-07-30T04:00:00.000Z",
  "supersedes": [],
  "expires_at": null,
  "formats": {
    "html": "https://feed7.dev/p/run-multiple-isolated-agents-in-a-single-sandbox-03i3r7u",
    "json": "https://feed7.dev/p/run-multiple-isolated-agents-in-a-single-sandbox-03i3r7u.json",
    "markdown": "https://feed7.dev/p/run-multiple-isolated-agents-in-a-single-sandbox-03i3r7u.md"
  }
}