Sandbox

A sandbox is an isolated environment in which software or code can be executed without affecting the surrounding system. The term originated from the children’s playground sandbox, and its use in computing borrows the metaphor of a contained play area that prevents spillover.

In computing, a sandbox provides controlled resources, such as CPU time, memory, disk access, and network connectivity. It is used to run untrusted or experimental code, test software, and analyze malware. Common implementations include virtual machines, containerized environments, and browser sandboxes that restrict scripts and plugins. Language-specific sandboxes enforce security policies within a programming language runtime.

Sandboxing reduces risk by preventing unauthorized access to files, processes, or the network. However, no sandbox is perfect; escape from containment can be possible through kernel vulnerabilities, misconfigurations, or side channels, and performance overhead can limit realism.

Applications span software development, quality assurance, security research, and educational settings. In cybersecurity, sandboxing is a fundamental technique for observing malware behavior safely. In browsers, sandboxing limits what web pages can do, improving protection against exploits.

Physical sandbox refers to a shallow enclosure filled with sand for children’s play, commonly found in homes, playgrounds, and recreational areas. It is typically designed to be low to the ground and easy to clean.

See also virtualization, containerization, browser security, malware analysis.