---
title: Sandbox
order: 3
description: "The restricted filesystem and environment a target runs in, so builds stay reproducible and side-effect-free."
tags: [glossary, execution-and-caching]
---

# Sandbox

The restricted filesystem and environment a target runs in, so builds stay
reproducible and side-effect-free.

## Elsewhere

An operating-system sandbox (macOS Seatbelt, Linux namespaces) or a browser sandbox confines a
whole process for security. Bazel's sandbox hides undeclared inputs from an action. The magus
sandbox is closest to Bazel's: it holds a target to the inputs and outputs it declared.

## Example

`magus describe target` shows what a target may read and write inside its sandbox.

```sh
magus describe target build docs
```

## Used in

<!-- BEGIN GLOSSARY USAGE (generated by glossary-usage-generate from the knowledge graph; edit the generator, not this list) -->

In the docs:

- [Sandbox model](../concepts/sandbox.md#sandbox-model)
- [Secrets and the sandbox](../concepts/secrets.md#secrets-and-the-sandbox)
- [What the sandbox enforces under a lease](../guides/integrations/agents/leases.md#what-the-sandbox-enforces-under-a-lease)
- [Sandbox env passthrough](../guides/integrations/nx.md#sandbox-env-passthrough)
- [Sandbox](../reference/api/metrics/v1alpha1/metrics.md#sandbox)
- [MGS2004: sandbox config unresolved](../reference/codes/sandbox/MGS2004.md#mgs2004-sandbox-config-unresolved)

In the code (`magus refs <name>` lists every site):

- `spells.Sandbox` (Go)

<!-- END GLOSSARY USAGE -->

## See also

- [Sandbox model](../concepts/sandbox.md)
- [Cache](cache.md)