# Sealos Devbox Sandbox Configuration

> Configure Sealos Devbox as the remote code execution sandbox provider for FastGPT workflows and agents.

Source: https://doc.fastgpt.io/en/self-host/config/sandbox/sealosdevbox

> This feature is available only to commercial edition users. Contact [Commercial Support](/en/guide/version/commercial) to request a key.
> Billing is usage-based and deducted from your Sealos balance.

## Prerequisites

1. FastGPT commercial edition is deployed, and the team has Agent Sandbox access.
2. Request Sealos Devbox connection details from support: Devbox service URL, access token, and runtime image.
3. Follow [OpenSandbox Configuration](/en/self-host/config/sandbox/opensandbox) to deploy `fastgpt-agent-sandbox-proxy`.

## Configure FastGPT Environment Variables

Add the following environment variables to `fastgpt-app` and `fastgpt-pro`.

```dotenv
# Use Sealos Devbox as the Agent Sandbox provider
AGENT_SANDBOX_PROVIDER=sealosdevbox

# Sealos Devbox Server API URL provided by support. The FastGPT main service must be able to access it.
AGENT_SANDBOX_SEALOS_BASEURL=https://devbox-server.example.com
# Access token provided by support
AGENT_SANDBOX_SEALOS_TOKEN=replace_with_sealos_devbox_token

# Sandbox image version
AGENT_SANDBOX_SEALOS_IMAGE=hub.hzh.sealos.run/labring/devbox-sandbox:v0.2.0

# Per-instance Devbox resource limits. Storage size is in Gi.
AGENT_SANDBOX_CPU_COUNT=1
AGENT_SANDBOX_MEMORY_MIB=2048
AGENT_SANDBOX_STORAGE_SIZE_GI=1
```

## Custom Package Registries

OpenSandbox and Sealos Devbox use the same package registry settings; the apt mirror is effective only for root Agent sandboxes:

```dotenv
AGENT_SANDBOX_NPM_REGISTRY=https://registry.npmmirror.com
AGENT_SANDBOX_PYPI_INDEX_URL=https://pypi.tuna.tsinghua.edu.cn/simple
AGENT_SANDBOX_APT_MIRROR=https://mirrors.tuna.tsinghua.edu.cn/debian
```

For root Agent sandboxes, FastGPT generates and overwrites the standard Ubuntu or Debian `.sources` file for the detected distribution, creating a `.copy` backup before overwriting an existing file. When the variable is removed, files with a `.copy` backup are restored and files without a backup are skipped. Initialization does not run `apt-get update`.
For arm64 runtime images, configure a mirror URL that provides the corresponding architecture packages.

## Configuration and Connection Troubleshooting

### Invalid Agent Sandbox proxy environment variables: AGENT_SANDBOX_PROXY_SECRET, AGENT_SANDBOX_PROXY_URL, AGENT_SANDBOX_PREVIEW_PROXY_URL are required when AGENT_SANDBOX_PROVIDER is sealosdevbox

After `AGENT_SANDBOX_PROVIDER=sealosdevbox` is enabled, `fastgpt-app` requires `AGENT_SANDBOX_PROXY_SECRET`, `AGENT_SANDBOX_PROXY_URL`, and `AGENT_SANDBOX_PREVIEW_PROXY_URL`, while `fastgpt-pro` requires `AGENT_SANDBOX_PREVIEW_PROXY_URL`. The proxy secret must match the value configured for `fastgpt-agent-sandbox-proxy` and contain at least 32 characters.

### Invalid Agent Sandbox environment variables: AGENT_SANDBOX_SEALOS_IMAGE are required when AGENT_SANDBOX_PROVIDER is sealosdevbox

The `sealosdevbox` provider requires `AGENT_SANDBOX_SEALOS_IMAGE`. Use the Agent Sandbox runtime image provided by support or the image that matches your current FastGPT version.

### Browser WebSocket connection fails

Check that the proxy service is reachable from the browser and that your reverse proxy supports WebSocket Upgrade. If FastGPT is accessed over HTTPS, `AGENT_SANDBOX_PROXY_URL` should use `wss://` to avoid mixed-content blocking.

### proxy validation fails or returns 401

Make sure `AGENT_SANDBOX_PROXY_SECRET` is exactly the same in the FastGPT main service and `fastgpt-agent-sandbox-proxy`, and that it is at least 32 characters long.