Sandbox

AI Fix and Implement story are the only Limn features where the AI can run commands. They run it inside a sandbox: a container on your computer that holds the workspace’s repositories, your notes and the task. The AI has a full shell there, but no GitHub sign-in and no route to the internet except the hosts you allow. The Sandbox tab checks the container runtime on this computer and sets what each session gets.

#Container runtime

This part applies to the whole computer. It shows one line: Runs in and the runtime’s name, or No container runtime is running on this computer. Select Check again after you start one, and How to set up for the steps.

Free runtimes: Colima on a Mac, Docker Engine or Podman on Linux, and Docker Engine inside WSL2 on Windows. Docker Desktop also works, under its own licence terms. Give the runtime at least 8 GB of memory. Step-by-step setup is in Docker and microsandbox.

Running sandboxes

Below the runtime line, one line says how many Limn sandboxes are running now, for example 2 Limn sandboxes are running. Limn reads it when you open the tab and when you select Check again. Stop all stops and removes every one of them. Changes a session stored are kept: you can still push them, or resume the session. A turn that is running stops. An automatic AI Fix that is running is cancelled, and nothing is pushed.

#What a session gets

The rest of the tab applies to the current workspace.

Your clones and Claude notes

There is nothing to set. Limn finds your own clones of the workspace’s repositories through the folders where you used Claude Code, and matches them by their git remote. Select Find to see what it found. The code always comes from Limn’s own copy of each repository, synced from GitHub. Your clones only decide where each repository sits inside the sandbox: at the same path, so your Claude notes and the paths they name still work. A repository with no clone found goes under /workspace.

Each repository’s own CLAUDE.md and AGENTS.md are in its code, so the AI reads them. Under Claude notes to bring, the notes of each clone (and of a folder that holds them) are ticked. Untick a project to leave its notes out. You can also tick Bring your ~/.claude/CLAUDE.md and Bring your Claude skills. They are copied in; the originals are never changed. Past AI sessions are never copied in. The AI starts in the repository with the most notes. Skills a repository keeps in .claude/skills come with its code, and the AI is told where each one is. The build tab counts all of this before you press Start.

Hosts always allowed

The sandbox reaches the internet only through Limn’s network filter. Add a host here to allow it for every session in this workspace. During a session, a blocked request shows in the session’s Network list with Allow for this session and Always allow. Always allow adds the host here.

Set HTTP_PROXY for every program: off by default. When off, only npm, pnpm, yarn, pip and git use the network filter, so the code under test still reaches local services.

Services

Compose files Limn may start for a session, for integration tests (a database, a queue). Select Choose compose files: Limn lists every compose file in the workspace’s repositories, from its own copies. Tick the ones you want and select Add. The AI asks Limn to start them; it never gets Docker itself. A file that asks for privileged mode, extra system rights, host folders or the Docker socket is refused, and the session says why. Services reach the internet only when you name them under Online.

The sandbox cannot use services you already run in Docker Desktop. Its only way out is Limn’s network filter, which refuses your computer’s own addresses. Each session gets its own services, so the AI never touches your local data.

Resources

CPUs, Memory (GB) and Disk (GB) for each session. The defaults are 4 CPUs, 8 GB of memory and 30 GB of disk.