grok template with Grok Build already installed.
CLI
Create a sandbox with the E2B CLI.Run headless
Use-p for non-interactive mode and --always-approve to auto-approve all tool calls. The sandbox isolates the agent from your host machine, but sandboxes can reach the open internet by default — restrict outbound traffic with network rules. Grok Build authenticates with an API key from the xAI console via the XAI_API_KEY environment variable.
Auto-approving tool calls is contained by the sandbox: the agent cannot touch your host machine, local files, or credentials. It can still make outbound network requests — internet access is enabled by default. To limit where an auto-approved agent can connect, configure outbound network rules (
allowInternetAccess, plus allow/deny lists by CIDR or hostname). Hostname rules apply to HTTP(S) traffic only; use CIDR rules for other protocols.Example: work on a cloned repository
Build a custom template
If you need to customize the environment (e.g. pre-install dependencies, add config files), build your own template on top of the pre-builtgrok template.
Related guides
Sandbox persistence
Auto-pause, resume, and manage sandbox lifecycle
Git integration
Clone repos, manage branches, and push changes
SSH access
Connect to the sandbox via SSH for interactive sessions