Known Limitations

We document what doesn’t work, on purpose. If you hit something here, it isn’t a bug in your code. It is a known gap. Each item notes the status or planned ship window.

Sandboxes Public V1

Availability is catalog-driven. A named size, including xs, can be selected only when the template catalog and tenant policy admit it. A published contract is not a guarantee of immediate capacity in every environment.
The default is small. It resolves to 2 vCPU, 4096 MiB RAM, and 10240 MiB disk. Raw CPU, memory, and disk fields must form a complete exact match for a published contract.
Timeouts are bounded. timeout_sec defaults to 3600 and has a maximum of 86400. The extend endpoint replaces the timeout instead of adding duration. always_on is policy-dependent.
Usage can be incomplete. Active CPU and network values can be null with measurement_status set to unavailable, or retained with status stale. Clients must not treat unavailable values as zero or stale values as current.
Standalone snapshot management is not in canonical public V1. Public V1 supports snapshot-backed fork plus pause and resume, but not customer-managed snapshot create, list, restore, or delete endpoints.
AWS BYOC sandbox capacity is a gated private preview. Managed and enabled BYOC environments share the sandbox contract, but BYOC placement is unavailable until the customer environment is accepted.
No GPU sandboxes yet. GPU is available on Computers (Desktop) only via BYOC. Native GPU sandboxes are targeted for early 2027.
No nested virtualization. KVM and QEMU cannot run inside a sandbox.
Dedicated test-mode API keys are not yet live. msk_u_* and msk_p_* keys hit the billable production substrate. Test-mode billing isolation is on the roadmap.

Deployments Phase 3/4 complete; dynamic runtime in hardening

Custom domain apex records require ALIAS / ANAME. DNS providers that do not support flattening, such as GoDaddy, require a workaround. Native anycast nameservers are planned for Q4 2026.
No edge functions yet. Only origin compute is available. Edge runtime is targeted for Q1 2027.
Rollback is per-deployment, not per-route. You cannot pin one URL path to version 1 and another to version 2 within the same deployment.
Dockerfile / BuildKit builds use App Engine templates first. General OCI-rootfs build strategy in the standard runtime builder is still hardening; use App Engine for containerized app publishes today.
Railpack / Nixpacks framework detection exists but dynamic generation from buildpacks is not complete.
App Engine is a separate runtime path. It publishes into the workspace App Engine appliance and proves readiness through the docker_deploy_app row, container route, host health, and public URL. Standard MIOSA deployments and App Engine deployments share the deployment API surface, but they do not use the same runtime substrate.

Data Services

Managed Postgres Beta. Provisioning lifecycle and credential injection exist. PgBouncer connection pooling and off-box backup drills are in progress.
Redis Beta. Single-node only. Multi-zone replication is planned.
Object Storage Beta. S3-compatible API is live; pre-signed browser uploads work. CDN distribution and geo-replication rollout are operational work in progress.
Auth-as-a-Service Beta. Per-project email/password signup, login, JWT verify, password reset, and email confirmation endpoints are live. Refresh tokens, magic links, OAuth providers, MFA, passkeys, and enterprise SSO are still planned.
Volumes Beta. Persistent local-backend volumes can be created, attached to computers, detached, deleted, and metered. Local volumes live on one host, so cross-host attach returns an error rather than moving the volume automatically.
Usage / audit query views grouped by external_workspace_id are not yet exposed. Raw audit events exist; cross-workspace aggregation rolls out in a later phase.

Computers (Desktop) GA

Headed-only: no headless mode for Computers. You boot a real Xfce desktop. For headless workloads, use Sandboxes.
Browser cookies do not persist across sessions by default. Use a volume mount or browser profile snapshot to carry cookies across reboots.
No multi-monitor virtualization. Single 1920 × 1080 frame buffer.
Audio not exposed. The stream is video-only; system audio is dropped at the host.

Computer-Use API

No managed agent loop. You bring your own agent (Anthropic SDK, OpenAI computer-use API, or custom). A built-in computer.prompt() convenience will ship when the hosted Optimal session endpoint is publicly available.
Approval gating is not enforced server-side. The approve / reject action protocol is a client-side convention only. Gate sensitive operations in your own agent code.
Computer sub-resources (auto_stop, vnc_credentials, apps, stream_token, metrics, ports, volume attach/detach, clone) have full coverage in the Python SDK. TypeScript, Go, and Java parity is targeted Q3 2026.

SDKs

SDK	P1 + P2 resources	P3 / P4 resources	Computer depth
Python	Full	Full	Full
TypeScript	Full	Full	Partial
Go	Full	Partial	Partial
Java	Full	Partial	Partial
Elixir	Full	Partial	Partial

Deployment proof parity is still uneven. CLI, TypeScript SDK, Python SDK, and Go SDK expose proof checks. Java and Elixir proof helpers are still pending.
embeddings, provider_defaults, benchmarks, command_center, community, email, builder_sessions, snapshots_standalone are Python-only today. Other SDK languages are pending.
Python sync client uses long-poll fallback for streaming events. Use the async client or the TypeScript SDK for proper SSE.
Tab-synced language preference persists in localStorage, not your user account. Switching language on one device does not propagate to another.

API

No GraphQL endpoint. REST + SSE by design.
Webhook delivery retries cap at 24 hours. After that, the event is dropped. Use the audit log to backfill missed events.
Rate limits: 600 requests per minute per workspace, 60 rpm per endpoint group. Higher limits are available on request.
Browser tokens have a fixed 5-minute TTL. Refresh server-side; do not attempt client-side extension.
One sandbox per browser token. A single token cannot scope across multiple sandboxes.

Pricing and Billing

No per-tenant usage budgets yet. You set a workspace cap today; tenant-level caps tied to external_workspace_id roll out with the billing attribution extension.
Dedicated test-mode API keys are not yet live. All traffic is billable against the account’s spendable credit balance.

Observability

No native log aggregation across workspaces. Query per-resource today. Cross-workspace log search is planned.
No OTLP trace export yet. The /events SSE streams provide raw events; bring your own collector. Structured OTLP export is on the roadmap.

What We Are Explicitly Not Building

Managed Kubernetes. Sandboxes and Deployments cover the workloads people would otherwise use K8s for.
Generic VPS hosting. Compute is always tied to a tenant identity (workspace or external_workspace_id).
Cryptocurrency or blockchain primitives.