# Sandboxing Mode

Sydekyks user and operator guide. Check feature availability and release-specific installation requirements.

Decide how flow code is isolated before you go to production. Here is a simplified way to choose:

Multi-tenant → use V8 / Code Sandboxing. Secure, and needs no privileged Docker access in Kubernetes (privileged Docker is usually disallowed to prevent root escalation).

Single-tenant → use No Sandboxing. Faster, and needs no privileged Docker access.

Set the mode with the AP_EXECUTION_MODE environment variable. The table below lists every mode and its exact value:

 | Name | Supports NPM in Code Piece | Requires Docker to be Privileged | Performance | Secure for Multi Tenant | Reusable Workers | Environment Variable

 | V8/Code Sandboxing | ❌ | No | Fast & Lightweight | ✅ | ✅ | Set AP_EXECUTION_MODE to SANDBOX_CODE_ONLY

 | No Sandboxing | ✅ | No | Fast & Lightweight | ❌ | ✅ | Set AP_EXECUTION_MODE to UNSANDBOXED

 | Kernel Namespaces Sandboxing | ✅ | Yes | Slow & CPU Intensive | ✅ | ❌ | Set AP_EXECUTION_MODE to SANDBOX_PROCESS

 | Combined Sandboxing | ❌ | Yes | Medium & CPU Intensive | ✅ | ✅ | Set AP_EXECUTION_MODE to SANDBOX_CODE_AND_PROCESS

Want the reasoning behind each mode - how fork()/V8 isolation and kernel-namespace isolation actually work, and their security trade-offs? See Sandboxing (https://docs.sydekyks.com/install/architecture/sandboxing) in the Architecture section.