I run a small ISP and have been building isolated Linux sandboxes (Firecracker microVMs) mainly for AI agents. Each one can get its own public IPv6 address, or run IPv6-only, which turned out handy for testing apps and services over IPv6 when your own network doesn't have it. If anyone needs something like that, feel free to try it at sandbox.wbx.cz, and I'm happy to hear what's missing or broken.
Top comments (3)
Tried it, nice work. MCP setup was quick and the token proxy works as described.
One question: inbound to the sandbox's public IPv6 seems to be blocked (listener on [::] never saw outside connections). Is that intentional, and can it be opened? The post made it sound like you could host services on the address.
Also: the create response returns an empty "ipv6" field even when the sandbox has a global address. Happy to send details.
Thanks for trying it out and for the precise report!
Inbound IPv6: blocking new connections from the internet is intentional for now. The sandbox’s own IPv6 address is used for outgoing traffic (no NAT, not shared with other customers), and the firewall only lets in replies to connections the sandbox opened itself. The post wasn’t clear about that, sorry for the confusion. Following your comment, the address now answers ping (rate-limited), so you can check from outside that your sandbox is up.
Can it be fully opened? Not today. Sandboxes are created self-service in seconds, and a publicly reachable address is exactly what gets abused (phishing pages, open proxies, scanners), with the complaints landing on our network. We’re thinking about how to offer it safely, e.g. as an opt-in for selected ports on verified accounts, with limits and an audit trail. If you tell me what you’d like to run (SSH, a custom TCP/UDP service, …), it helps us decide what to build.
In the meantime, for HTTP and WebSocket apps there’s the port URL: start the app on 0.0.0.0 (or [::]) and call get_public_url (MCP) or the port URL endpoint (API). You get an HTTPS address like 8080-.box.wbxbox.net, reachable over IPv4 and IPv6; only people you share its token with can use it.
Empty “ipv6” field: you were right, that was a bug. Our response filter dropped info.ipv6 and info.ipv6_prefix for customer requests, so the SDK’s sandbox.ipv6 was empty too. It’s fixed now. Thanks for catching it, and happy to get the details if you see anything else!
Having native public IPv6 support out of the box in an isolated Linux sandbox solves so many NAT traversal headaches when testing webhooks or self-hosted MCP servers. Clean setup!