Sandbox Overview

Stackie runs each block’s processes inside an OS-level sandbox, providing isolation without the overhead of full container images.

Platform Support

Isolation Model

Each sandbox runs as an isolated process with:

• Filesystem isolation — access restricted to declared volume mounts
• Network isolation — only declared ports are accessible from outside
• Process isolation — cannot see or signal other sandboxes’ processes
• Privilege isolation — runs as a non-root user with minimal capabilities

Sandboxes share the host OS kernel. They are lighter than containers but provide strong boundaries between services in a stack.

Sandbox IDs

Every sandbox has a stable ID derived from its stack name and block name (e.g., myapp-postgres). IDs persist across restarts, so scripts and integrations can reference them reliably.