oz0 tenant remote-sandbox
For: Operators and developers looking up a command.
A tool from an OCI image whose manifest says isolation: remote runs in a remote sandbox: an E2B-compatible service, such as E2B Cloud, a self-hosted E2B or CubeSandbox, that a node's operator configured with orchestrator-zero-node run --remote-sandbox. The tool's code and the data of its calls then leave the node for that service, so a tenant's admins decide it here; it is off until they allow it, and the audit log keeps each change (sandbox.remote_allowed, sandbox.remote_denied).
No secret leaves the node: a plugin that declares secrets or connections runs no tool remotely.
The service's egress rules are its own and weaker than the node's egress proxy (E2B filters names only on ports 80 and 443 and lets a sandbox with an allowlist reach a public DNS resolver), and they do not hold as an allowlist: they judge what the client itself says, so assume a tool there can reach hosts its list leaves out (see Sandbox tier 2 in the docs).
Each job's trace says which steps ran remotely, and on which backend.
With no second argument the setting is shown. deny stops remote sandboxes: the tenant's nodes restart their runtimes and start none again.
Usage
oz0 tenant remote-sandbox <tenant> [allow|deny] [flags]
Flags
| Flag | Type | Default | Description |
|---|---|---|---|
--decision-ref | string | the decision or case the change follows, such as a case number (at most 200 characters) | |
--json | bool | print JSON instead of a table | |
--reason | string | why, required for every governance change (at most 500 characters; default $OZ0_REASON); the audit log keeps it |
Inherited flags
| Flag | Type | Default | Description |
|---|---|---|---|
--context | string | $OZ0_CONTEXT or <config dir>/orchestrator-zero/context.json | CLI context file written by server init |
--log-level | string | info | log level: debug, info, warn or error |
See all oz0 commands and the global flags.