# Sandboxing

> Running a program in a closed box so it cannot harm anything outside it.

- Level: Intermediate
- Topics: Security
- URL: https://tidbit.legios.com.ar/sandboxing/
- In Spanish: [Sandboxing](https://tidbit.legios.com.ar/es/sandboxing/)

**Sandboxing** means running a piece of software inside a restricted space, the **sandbox**, where it can only touch what it has been explicitly given. It cannot read your other files, talk to other programs or change the system unless a narrow, controlled door allows it. If the program is buggy or malicious, the damage stays inside the box.

You use sandboxes all day without noticing. Your web browser runs each website in its own sandboxed process, so a malicious page that exploits a bug still cannot read your documents. Phone apps live in sandboxes too, which is why an app has to ask for permission before it sees your photos, contacts or location. Containers and virtual machines are sandboxes at a bigger scale, isolating whole applications on a shared server.

Security teams also use sandboxes on purpose: suspicious email attachments are opened in a disposable environment to watch what they do before anyone opens them for real. And it matters more now with AI: when an assistant writes and runs code, it is usually run in a sandbox so a mistake cannot delete or leak anything important. Sandboxes are not perfect, though. Attackers look for "sandbox escapes", bugs that break through the walls, so the walls also need updates.

## An analogy

A sandbox in a playground: kids can dig, build and wreck whatever they want inside it, and none of the sand ends up in the living room.

## Keep in mind

- A sandbox limits what a program can see and touch to what it was explicitly given.
- Browsers, phone apps, containers and virtual machines all rely on it.
- Used to safely examine suspicious files and to run AI-generated code.
- Bugs that break out of a sandbox are serious, so it still needs updates.

## Go deeper

- [Sandbox (computer security) on Wikipedia](https://en.wikipedia.org/wiki/Sandbox_(computer_security))
- [The Chromium sandbox (design document)](https://www.chromium.org/developers/design-documents/sandbox/)

## Related terms

- [Bug](https://tidbit.legios.com.ar/bug/): A mistake in software that makes it behave differently from what was intended.
- [Web browser](https://tidbit.legios.com.ar/web-browser/): The app that fetches web pages from the internet and draws them on your screen.
- [Container](https://tidbit.legios.com.ar/container/): A sealed box with a program and everything it needs to run anywhere.
- [Virtual machine](https://tidbit.legios.com.ar/virtual-machine/): A complete computer made of software, running inside a real one.
- [Server](https://tidbit.legios.com.ar/server/): A computer whose job is to answer requests from other computers, all day, every day.
- [Artificial intelligence](https://tidbit.legios.com.ar/artificial-intelligence/): Getting computers to do things that, until recently, only people could do.