Daytona

Run an agent's commands and files in a Daytona sandbox, with snapshots for forking.

Daytona runs each sandbox as a container. It is the provider to pick if you want to fork threads at a sandbox state: threads takes Daytona snapshots.

import { daytona } from "@threads/daytona";

const daytonaSandbox = daytona({ snapshot: "my-snapshot", lifetimeMs: 60 * 60_000 }); // DAYTONA_API_KEY

The key comes from the DAYTONA_API_KEY environment variable unless you pass apiKey / api_key. It is read when you call check() or start the first run, not when you build the sandbox.

Options

TypeScript	Python	Default	What it does
`apiKey`	`api_key`	`DAYTONA_API_KEY`	Authenticates threads' calls to Daytona. Never enters the sandbox.
`apiUrl`	`api_url`	`https://app.daytona.io/api`	Daytona API endpoint.
`snapshot`	`snapshot`	Daytona's default	The Daytona snapshot new sandboxes start from.
`target`	`target`	Daytona's	The Daytona region to place sandboxes in.
`lifetimeMs`	`lifetime_ms`	1 hour	How long a sandbox lives before Daytona deletes it, rounded up to whole minutes.
`autoStopMinutes`	`auto_stop_minutes`	`60`	Idle minutes before Daytona stops a leaked sandbox. A safety net, not the normal cleanup.
`allowInternet`	`allow_internet`	`false`	Opens the network. Also set `egress: "unenforced"` on the agent.
—	`name`	`"daytona"`	Python only: the provider name sandboxes are recorded under.

const open = agent({
  model,
  sandbox: daytona({ allowInternet: true }),
  egress: "unenforced",
});

Good to know

Snapshots stop the sandbox. Daytona can only snapshot a stopped container. threads stops it, captures it and starts it again, so background processes (a dev server, for example) end at each snapshot. Snapshots are taken at the end of turns that changed something.
Snapshots have size and file-type limits. Each capture and restore reads /workspace as a tar archive on the host. A workspace can't be snapshotted, and an older snapshot of it won't restore, if it has a file over 256 MiB, more than 1 GiB in total, a FIFO or device file, a file name that isn't UTF-8, or a path over 4096 bytes.
Crashes park. If the host crashes mid-command, threads can't prove the command's child processes are gone, so the run parks for you instead of re-running it.

See Sandboxes for the tools an agent gets and how internet access works.

Options

Good to know

On this page