Manage sandbox operations
The chat sandbox gives each conversation an isolated cloud environment where the assistant can run code, create files, and produce downloadable artifacts. Tailscale provisions and manages the infrastructure that runs the sandbox. This topic explains the security properties you can rely on.
Monitoring and health
Tailscale monitors the health of the sandbox infrastructure that runs your Aperture gateway, including connectivity, file handling, and cleanup. You do not need to watch logs or metrics for these systems.
If the sandbox stops responding, returns repeated errors, or storage usage appears incorrect, contact your Tailscale account manager or email aperture@tailscale.com. For symptom-by-symptom guidance, refer to troubleshoot sandbox issues.
Tailscale handles upgrades to the underlying sandbox infrastructure, and they require no action on your part. In-flight file uploads complete independently across infrastructure maintenance.
Availability
Tailscale enables the chat sandbox for your gateway. There is nothing to set in your Aperture configuration. While the sandbox is enabled, sandbox tools are available to users in the chat interface. To request the sandbox, refer to enable the chat sandbox.
Security considerations
Each conversation gets its own isolated sandbox. The following properties hold:
- Conversations cannot access each other's files or state.
- File downloads require conversation ownership. Users can only download files from their own conversations.
- Sandboxes have outbound-only internet access, restricted to an allowlist of package and source hosts, and cannot reach Aperture's internal infrastructure.
- HTML preview files cannot load external resources or run scripts in your session, and cannot reach parent-page cookies or storage.
- Uploaded files are encrypted at rest and integrity-verified after upload.
The sandbox reaches the internet only through an outbound proxy restricted to approved package registries and source hosts. This greatly limits the ability to transmit data out of the sandbox, but does not eliminate it. Some allowlisted hosts can receive arbitrary content. Avoid placing highly sensitive data in a sandbox conversation.
Operational parameters reference
| Parameter | Value | Description |
|---|---|---|
| Upload size limit, model-readable files | 25 MiB | Maximum size of a single image, PDF, text, or office document upload. These are sent to the model with the message. |
| Upload size limit, other files | 500 MiB | Maximum size of a single upload the model cannot read, such as video, audio, an archive, or an unrecognized binary. These are available to sandbox commands only. |
| Attachments per conversation | 20 | Cumulative limit on uploaded files in one conversation, not per message |
| Conversation storage limit | 5 GiB | Maximum combined uploads and outputs per conversation |
Related
- Aperture chat sandbox for a conceptual overview of the feature.
- Enable the chat sandbox for step-by-step setup instructions.
- Sandbox reference for tool parameters, size limits, timeouts, and error messages.
- Troubleshoot sandbox issues for diagnosing common problems.