A sandbox is an isolated environment where untrusted code can run without freely reaching the rest of the host computer.
It is the place itself, with its own files, limits, and view of the system, not the policy decision to use one.
How it works
Browsers, document viewers, and analysis labs use such places so a crash or a hostile file stays inside.
The boundary may be a restricted process, a container, or a separate virtual machine with little access to the host.
A sandbox is only as strong as what it is allowed to touch.
If it can read the user documents or reach the internal network, the isolation is thinner than the name suggests.
Concrete examples
- A browser renders an untrusted page in a restricted process that cannot read the user mail store.
- An analyst opens a suspicious attachment in a virtual machine that has no path to the office file share.
- A build system compiles contributed code in a container that cannot see production credentials.
Protective measures
- Give each sandbox the minimum files, network, and privileges the task truly needs.
- Reset the environment after each untrusted run so leftovers cannot greet the next sample.
- Watch for attempts to escape by prompting the user to grant more access than the task requires.
- Keep production secrets and personal document folders outside the isolated environment entirely.