---
title: fakeSandbox()
description: >-
  A temporary directory on the host that stands in for a container, for tests
  and the fake harness.
---
> ## Documentation Index
> Fetch the complete documentation index at: https://docs.reeval.ai/llms.txt
> Use this file to discover all available pages before exploring further.

`fakeSandbox()` gives each attempt a temporary directory on the host instead of a container. It's for trying reeval and testing configs without Docker; it isolates nothing. It runs commands with your host's tools, brokers no secrets and enforces no egress, so it can't tell you whether an eval's checks work in the eval's real sandbox: for that, run the [fake harness in it](/recipes/fake-harness#oracle-and-canary).

```ts title="reeval.fake.config.ts"
import { defineConfig, defineEnvironment } from '{{ pkg }}'
import { fakeHarness } from '{{ pkg }}/harness'
import { fakeJudge } from '{{ pkg }}/judge'
import { fakeSandbox } from '{{ pkg }}/sandbox'

const fake = defineEnvironment('fake', { sandbox: fakeSandbox() })

export default defineConfig({
  harness: fakeHarness({ files: { 'greet.js': 'export const greet = 1\n' } }),
  environment: fake,
  judge: { model: fakeJudge() },
})
```

## Options

<Property name="id" type="string" optional>
  The sandbox's id in cell keys. Default `fake`.
</Property>

<Property name="dir" type="string | URL" optional>
  The parent directory for each attempt's temporary directory: a path relative to the file that calls `fakeSandbox()`, an absolute path, or a `file:` URL such as `new URL('./sandboxes', import.meta.url)`. In data, `{ kind: fake, dir }` resolves the same way. Default the OS temp directory.
</Property>

<Property name="maxConcurrent" type="number" optional>
  The most fake sandboxes at once across the run.
</Property>

## What it is

```text
<dir>/reeval-sandbox-*/    the attempt's directory and HOME, where ~/ paths land
  work/                    the workspace, where commands run with sh -c
<dir>/reeval-sandbox-*.state/  the snapshot turns' diff is taken against
```

Each attempt gets a directory `reeval-sandbox-*` under `dir`, with the workspace in `work/`. `HOME` is the attempt's directory, so `~/` paths in `files`, `c.readFile` and skills land there.

`c.exec`, setup steps and the fake agent's `exec` steps run with `sh -c` on the host, in the workspace. Both directories are removed when the attempt ends. Your user can read the `.state` directory, but it holds one commit of the workspace as the agent already sees it, never a file's content from before `c.writeFile` replaced it.

On Windows, `sh` is [Git for Windows](https://git-scm.com/download/win)' `sh.exe`: the one on `PATH`, or else the one in Git's install folder. Without it, the attempt fails with `The fake sandbox runs commands with a POSIX sh, and there's none on this machine.`

## What it can't do

<Warning>
  Commands run on your machine, with your network and your files within reach. Only run evals you trust in it.
</Warning>

| Feature | In `fakeSandbox()` |
|---|---|
| Real harnesses | Refused: `The Cursor harness needs the Docker sandbox: set sandbox: docker() …` |
| Egress policy | Not enforced. A plan with `'deny-all'` or an allowlist stops before it runs. |
| Egress record | Not recorded: the record's `egress.recorded` is `false` |
| Credential brokering | No gateway, so a secret with `hosts` keeps its placeholder, never swapped for its value. The plan's notes say so: `not brokered (fake sandbox, placeholder only): GEMINI_API_KEY → generativelanguage.googleapis.com` |
| Images | None: `docker()` options don't apply |

An eval that asks for an egress policy the fake sandbox can't enforce is an error:

```text
reeval: evals/hello.eval.ts: evaluate("greet module › creates greet.js") runs under egress 'deny-all', which needs turning egress off, but the fake sandbox enforces no egress policy (its commands run on the host). Run it in docker(), or set egress: 'allow-all'.
```

## Related

- [fakeHarness()](/reference/harness/fake)
- [docker()](/reference/sandbox/docker)
- [Egress](/reference/egress)