Self-host on Blaxel sandboxes

Blaxel runs each Session on its sandbox compute platform using the official @blaxel/core SDK (dynamically imported). The driver follows Blaxel’s own lifecycle: pre-claim readiness, stable Session identity via external ID and ownership labels, archive/unarchive of the retained filesystem, named processes, native proxy/firewall, and janitor cleanup.

Prerequisites

BL_API_KEY=           # required — read by the Blaxel SDK

Configuration

Blaxel is wired through the Runtime Host composition, not SANDBOX_PROVIDER. Use createBlaxelProvider, createBlaxelManagedRuntime, or createBlaxelManagedRuntimeDriver from @open-managed-agents/managed-runtime-blaxel:

const driver = createBlaxelManagedRuntimeDriver({
  leaseTtlMs: 90_000,
  image: "node:22-slim",
  memory: 2048,       // MiB
  region: "us-pdx-1",
  ttl: "24h",
});

Base options: image (required), memory, region, ttl, and lifecycle (expirationPolicies with ttl-idle/ttl-max-age/date actions, plus terminatedRetention). Per-allocation extras go through allocationOptions: envs, volumes (persistent or ephemeral), network, and snapshotEnabled. The factory also accepts client, runtimeEnvironment, outputStore, outputKeyPrefix, credentialEgress, sessionInputs, and readiness.

Capabilities


Harness lanes	`ama_worker`, `openma_supervised`
suspendResume	supported (archive/unarchive retained filesystem)
Workspace	`retained_runtime`, best_effort durability
Outputs	`final_collect`, durable
Process checkpoints	none
Credential egress	`unsupported`/`snapshot` by default