Sandbox — what it guarantees · Production

Marketplace plugins run in isolated Docker containers. The sandbox isn't a limitation placed on you — it's a set of guarantees made on your behalf.

What the sandbox guarantees you

Your plugin can't leak user tokens, customer DMs, or platform secrets. The environment is empty — no env vars, no DB credentials, no Discord bot tokens. If your code is ever compromised, the blast radius is exactly what the user consented to install. You're not one bad dependency away from a security incident.
Your plugin can't crash the platform for other users. If your plugin spirals, only your plugin dies; the rest of the server keeps running.
One plugin's bugs can't become another plugin's bugs. Each plugin gets its own container, its own KV namespace, its own SQL schema. You can't accidentally read another plugin's data, and another plugin can't corrupt yours.
Customers don't have to audit your code to trust your plugin. The capability picker at install time shows them exactly what your plugin can touch — no mystery imports, no surprise side effects. That's what makes the marketplace work.

How those guarantees are enforced

Network: --network none. Only the JSON-RPC pipe to the runner is reachable. All HTTP goes through ctx.http via the platform proxy — you declare the domains you need, customers see them at install.
Filesystem: read-only root plus a 16 MB /tmp tmpfs mounted noexec; nothing persists between restarts. State lives in ctx.kv / ctx.sql where backups and audits can see it.
Memory: 64 MB hard limit per worker (24 MB per plugin in pool mode). One plugin's leak doesn't take down others.
CPU: 0.25 vCPU (0.1 in pool mode). Background work won't starve other plugins.
Processes: 64 max (PIDs). Caps fork-bomb damage.
User: non-root (nobody, uid 65534), --cap-drop ALL, no-new-privileges, seccomp-filtered syscalls. No privilege escalation paths.
Secrets: env is empty. There's nothing to leak even if you wanted to.
Rate limits per (server, plugin): 50 events/sec, 60 outbound Discord actions/min, 30 proxy HTTP requests/min. One server can't DoS your plugin by flooding it.

If your plugin trips a limit it gets RateLimitError with a retry_after hint — back off, don't busy-loop. The full table of every enforced number lives in Reference: Limits and quotas.

Crash recovery

Backoff first: a crashing worker is restarted with exponential backoff (2 s doubling up to 5 min) before anything drastic happens.
Quarantine: 5 consecutive crashes within 5 minutes stops event delivery and switches the plugin off for affected servers. It clears when the plugin is re-enabled (or reinstalled) from the dashboard, or when you publish a fixed version — so ship the fix, don't wait it out.