Sandbox
How to set up, connect, and use a Sandbox - Baz hosted environment
This integration is required for Baz Fixer and enables high quality, CI safe fixes.
1. How Baz Fixer works
When you trigger a fix, Baz spins up an isolated environment with dedicated resources, memory, and filesystem resources.
The repository is cloned into a secure working directory using a short lived access token, then runs any configured setup scripts to prepare the environment.
The AI agent executes within the sandbox where it can access the cloned repository only.
The agent iterates through code edits, runs validation commands, and attempts to resolve the requested fix.
Once complete, Baz retrieves a write token and pushes the fix as a new commit to your branch.
The sandbox environment is cleaned up after the session ends.
2. What is a Sandbox?
Baz Sandbox is an isolated environment where Baz Fixer can read, edit, run and test code. Each fix runs in a temporary, self contained environment powered by AWS Bedrock AgentCore with no access outside the scoped repository.
3. What you need to provide
To define a Sandbox environment, Baz needs the following inputs:
1. Repository
Select the repository Baz should clone and run inside the sandbox, one repository per sandbox configuration.
2. Runtime
Select the runtime Baz should use to execute your code. This determines the base environment Baz provisions for the sandbox. Examples:
Node.js 22
Node.js 24
Python 3.13
Python 3.14
More environments are added every day, if yours isn't supported in the app, email [email protected].
3. Environment Variables
Required to install dependencies, run formatters, linters and tests.
Examples:
URL + tokens for private package registries
Feature flags
Database connection strings
You can:
Set variables manually
Import variables from a .env file
4. Setup Script
A script Baz will run to install dependencies and prepare the environment before running your code.
Typical use cases:
Installing dependencies
Building the project
Preparing test fixtures
Example:
This script runs once per sandbox execution.
5. Validation Script (Optional)
An optional script Baz will run after applying fixes and before committing changes.
Use this to verify that changes are safe and correct.
Common examples:
Running tests
Running linters
Running type checks
Example:
FAQ
How secure is my sandbox?
The sandboxes are built on-demand, using the base image you selected and the setup script. They are created when a baz fix is requested, and maintain their state for 8 hours. After 8 hours of no activity, the sandbox is deleted and it is not possible to restart it.
Each sandbox has a shallow git clone of the relevant repository. Every repository is completely separated from other repositories.
Last updated