The challenge
Helio wanted its coding agent to run tests, install packages and edit files for every user. Building a safe sandbox runner in-house was estimated at nine months, and the security team would not sign off on shared containers.
The change
The team moved agent runs to Lattis sandboxes: one isolated container per run, a network policy per workspace and secrets scoped to the sandbox. Tools were registered from their existing Python functions.
sandbox:
image: helio/agent-runtime:3.2
network: workspace-policy
secrets: [GITHUB_TOKEN, NPM_TOKEN]
timeout: 15m
Sandboxes gave us the thing we could not build ourselves: isolation we could explain to security.
Daniel Okafor
,
Head of Platform
,
Helio
The result
The agent launched to 40,000 developers six weeks later. Helio now runs 1.2M sandboxes a month with a 99.98% completion rate, and security reviews take a single document.
