How I Learned to Stop Worrying and Love the Sandbox — Matt Brockman, E2B

A runaway process consumes 99.7% of a sandbox's CPU, and killing it unlocks the next level of a capture the flag lab. Matt Brockman walks the room through deliberately broken environments to make sandbox operations concrete. Participants identify their sandbox, find memory pressure, locate a file filling the disk, and clean up background processes. Each challenge runs in its own environment, so a mistake can be reset without destroying the rest of the workshop. Brockman explains how E2B templates preserve a running system's state, including memory and the filesystem, so work can resume where it stopped. The exercises begin with Linux commands and configuration before moving into Python. The operational questions become harder when a few sandboxes turn into hundreds or thousands. A simulated lifecycle exercise gives a task enough time to finish, then shortens the idle timeout so unused resources do not keep consuming capacity. Another exercise replaces round robin assignment with a mapping from users to sandbox IDs, allowing each person to return to the same workspace. A cache example separates a template's readable files from the location that should receive runtime writes. Brockman also discusses the tradeoffs of restoring state: startup is convenient, but forgotten processes come back too. Audience questions cover volumes, storage growth, distributed workloads, orchestration, and network restrictions. The recurring task is keeping track of what runs where, what it can access, and when to clean it up. Speaker info: - https://x.com/badphilosopher - https://github.com/e2b-dev/E2B Timestamps: 0:00 - Introduction and capture the flag setup 2:51 - Why agents need sandboxes 4:27 - Snapshots and templates 8:08 - Opening the lab and finding a sandbox ID 16:02 - Runaway processes and isolated environments 18:43 - Debugging CPU usage 20:30 - Memory pressure 21:57 - Finding a full disk 25:12 - Correcting the disk cleanup exercise 31:14 - Sandbox lifetimes and idle timeouts 39:04 - Cleaning up background processes 42:31 - Mapping users to workspaces 48:30 - Filesystem permissions and runtime caches 50:08 - Audience questions on sandbox operations 54:24 - Storage, volumes, and orchestration 57:12 - Templates, local development, and network access