Interview Preparation

Two-minute explanation

“Nexus Sandbox is a compute-plane API for agent-generated code. It creates sessions backed by either a local subprocess or an isolated microsandbox VM, tracks lifecycle and TTL, runs commands with limits and captured logs, manages workspace files and archives, exports artifacts with hashes, and snapshots VM state plus optional workspace bundles. FastAPI routes use a runtime protocol, SQLite stores metadata, and a React console makes the service operable.”

Likely questions

Why separate runtime adapters? To keep API and lifecycle semantics stable while swapping isolation mechanisms.

How do you prevent path traversal? Normalize guest paths, reject .., resolve under the session root, reject symlinks, and apply the same check to archive entries.

Why are snapshots stopped first? A stable disk state is required; the API rejects unsafe active-session snapshot requests unless it can stop the session.

What is the scaling limitation? SQLite and local scratch storage assume a colocated, stateful service. Multi-instance deployment needs shared metadata, storage, and runtime ownership.

What would you improve? Per-tenant auth, stronger quotas, streamed execution, runtime contract tests, and operational telemetry.