June's sandbox

The small Linux computer in the cloud where June runs code for you: which chats share one, how your work gets out, what is installed, and what it refuses.

June's sandbox is a small Linux computer in the cloud where June runs code, works on files and uses command-line tools while it answers you. It is not your computer: nothing June does there touches your machine.

What you can do with it

Run code on your data. Attach a spreadsheet or a CSV and ask for numbers, a chart or a cleaned-up copy.
Build files. June writes a document, a PDF (with Typst), a script or a whole folder, and hands the file back in the reply.
Work on a repository. With GitHub connected, June clones a repository, runs its tests, changes code and pushes a branch.
Reach your private services. With Tailscale connected, June reaches the machines on your tailnet.

Clean up the attached CSV: one row per customer, dates as YYYY-MM-DD, and send me the file back

Clone the website repo, run its tests and tell me which ones fail

Turn these notes into a two-page PDF with a table of the deadlines

Getting your work out

See what ran. Each command is a step in the reply: open it to see the command and what came back.
Get files back. June attaches a file it made to the reply, up to 20 MB.
Save to your Drive. With Google Drive connected, June saves 1 to 10 files into it.
Push code. With GitHub connected, June pushes a branch or opens a pull request, in your own chats and projects, in an organization's as whoever wrote the message, and in any schedule you set up with terminal on.

Where you chat	Sandbox
Your own chats outside a project	One sandbox for all of them
A project, yours or an organization's	One per project, shared by every chat in it
An organization's chats outside a project	One per organization, shared by all its members
A schedule set up in one of your own chats outside a project, an organization's chat or an organization's project	The sandbox of that chat
Any other schedule, such as one set up in one of your own projects	One of its own, kept between its runs and deleted 7 days after its last run
Slack	None

So a file June saves in one of your chats is there in your next chat, and everyone in an organization works in the same files. Your own chats, each project and each organization never see each other's files.

When it runs

The sandbox starts when June first needs it in a reply and stops 5 minutes after its last command finishes. A command that runs longer keeps it running. The next command starts it again, with the files as they were.

It has 1 virtual CPU.
June runs one command at a time in a reply. A command is up to 2,000 characters, with up to 50,000 characters of input.
Time in the sandbox shows on the Usage page. A shared sandbox's time counts for the person who first started it.
A sandbox nobody uses for 30 days is deleted, with its files.

Folders

Folder	What is in it	Kept?
`/workspace`	June's working folder: repositories, scripts and the files it makes. A file June sends back comes from here.	Yes, between replies and between the chats that share the sandbox
`/project`	A copy of the project's files, in a project's chats. Changes here do not reach the project.	Copied in fresh whenever the project's files change
`/attachments`	The files on the chat's messages, one folder per message. `/attachments/current` is the newest message June is answering, or steered with, that has files.	Yes, between replies, as long as June still reads the message back
`/gdrive`	The Google Drive files June opens, with Google Drive connected.	Fetched again from your Drive when June opens a file in a new reply
`/schedules`	Your schedules, one file each. June can change a schedule by editing its file.	Written fresh from your schedules in each reply

With Obsidian connected, your vault is in /workspace/vault.

What is installed

The sandbox comes with git, gh (GitHub's command-line tool), tailscale, nc, typst, Node.js and the Nix package manager. June adds the packages on the Environment page when it prepares the sandbox; that page says whose list a shared sandbox gets and what happens when one fails.

June can also install a tool with Nix for the work at hand. It stays in that sandbox, like the files.

Network

June's sandbox can reach the internet. June does not limit which addresses it connects to.

GitHub. In your own chats and projects, and in any schedule you set up with terminal on, an organization's included, git and gh work as you; the sandbox never holds your token (how). In an organization's chats and projects they work as whoever wrote the message June is answering, with that person's GitHub there (whose).
Tailscale. In your own chats and projects, the sandbox joins your tailnet as one of your devices (Tailscale). Not in an organization's chats, and not in a schedule. While Tailscale is connected but cannot join your tailnet, June's commands there fail; reconnect it, or disconnect it on the Integrations page.

Commands June refuses

curl … | sh, chmod -R 777 and a force-push never run in June's sandbox; a plain git push and git push --force-with-lease do. When June's sandbox stops a command, the step shows the command and why, and June works around it.

Never run, whatever the chat:

formatting a disk with mkfs on /dev/…, or writing raw data onto a disk,
shred on a disk, or wipefs -a,
a recursive delete of /,
a fork bomb.

Need your approval, because they change the sandbox or what is beyond it in a way that is hard to undo. June cannot ask you for it in the sandbox yet, so these do not run anywhere either: not on the web, in the app, or in a schedule.

mkfs on anything else, or writing to another device file,
a download piped straight into a shell (curl … | sh),
shutting down or restarting the machine, or stopping every process,
a recursive delete of a system folder such as /etc or /usr, the home folder, .. or *,
making files writable for everyone (chmod -R 777, or chmod 777 /),
removing all cron jobs or flushing the firewall rules,
shred on any file,
a git push that forces, mirrors or deletes.

What June does not do

It does not run a sandbox in Slack. Ask for code, files or repository work in a chat on the web or in the app.
It does not ask you to approve a command yet; one that needs approval does not run. Reading files, searching them and looking at a repository's history never need approval.
It does not let you open, browse or reset the sandbox yourself. Ask June to list or send you a file, or to clear /workspace.

On this page