Service eligibility and regional restrictions
PuppyIP serves only compliant overseas businesses and their authorized personnel. Proxy services are not available in mainland China. The service may only be used for lawful business activities outside mainland China. Use of this service within mainland China is prohibited.
Hosting a proxy IP or server overseas does not change these restrictions. The service must not be provided to end users in mainland China through relaying, forwarding, sharing or resale. Before use, read the Terms of Service.
Key Takeaways
- The November 6 release adds Linux ARM64 support. The October 7 launch described Box as a developer preview; the sources reviewed here do not announce general availability.
- Current setup documentation supports Apple silicon macOS and Linux ARM64. The Mac walkthrough requires macOS 15+; Linux guidance specifies Amazon Linux 2023 ARM64, glibc 2.34+ and libgcc.
- box.toml defines the workload and its access envelope; policy.dw decides mediated operations. Review directly granted filesystem access separately.
- The documented Strands CLI example needs a Node preload adapter and routes Bedrock HTTP/2 calls through HTTP/1.1. Connectivity, policy permission and cloud-service eligibility remain separate conditions.
Check the platform before treating Linux support as universal
Strands Box is an open source sandbox for local AI agents that combines operating-system containment with Dogwood policy. Its October 7 announcement introduced a developer preview; version 0.2.1, released on November 6, adds Linux ARM64 support. This guide checks those sources as of November 11, rather than presenting either event as a new launch today or claiming general availability.
The current getting-started page lists Apple silicon Macs and Linux ARM64. Its Mac walkthrough requires macOS 15 or later. Linux guidance specifies Amazon Linux 2023 ARM64 with glibc 2.34 or newer and libgcc. Keep the main executable and both helpers from the same build together in one directory.
These sources do not provide supported installation paths for Windows, WSL, Intel Macs or Linux x86_64, and do not cover every ARM64 distribution. Identify the host that actually executes the agent instead of borrowing a support table from another agent sandbox.
Separate the access envelope from individual policy decisions
box.toml defines the command, workspace, environment, filesystem access and egress destinations. policy.dw expresses request rules in Dogwood. OS containment directs relevant interactions through a policy layer that can understand shell, Python, MCP, filesystem and network operations. MCP is a protocol agents use to connect to external tools.
The walkthrough explicitly says that setting workspace alone grants no file access. Conversely, paths granted directly to the agent process under agent.filesystem do not undergo the same per-operation policy decisions. Review these grants alongside policy.dw; one deny rule does not establish that every path is mediated by it.
Semantic policy means deciding based on a particular operation and its conditions, beyond allowing a process or domain. The announcement demonstrates requiring a successful test before git push, but also warns that the snippet is incomplete: actions such as switching branches can break its assumptions. Treat it as an illustration, not a complete development-workflow policy.
For failed egress, check whether the client actually uses the gateway
Box routes agent network traffic through its egress gateway and sets HTTPS_PROXY. The current Strands CLI walkthrough explains that the AWS SDK for JavaScript opens its own connections and ignores that variable; its Bedrock calls also use HTTP/2. Exporting a proxy variable therefore does not prove that model requests take the intended route.
For this particular Node.js example, the guide supplies proxy-preload.mjs, loaded with node --import. It makes connections use the environment proxy settings and replaces the relevant Bedrock HTTP/2 handler with an HTTP/1.1 handler. Follow the complete current example rather than treating this adaptation as a requirement for every SDK or model.
Then check net:connect host and port decisions separately from http:request rules. The example permits connections to bedrock-runtime.us-west-2.amazonaws.com on port 443 and corresponding requests. Reaching that host does not grant file access, model entitlement or account quota. A different network egress does not grant model or account entitlements or change quotas, billing or organizational policy.
Use refusals to identify the smallest missing permission
In your own test project without sensitive data, the documented exercise first permits reading README.md and asks the agent to append a line. The expected result is a successful read followed by a denied write. This is the official exercise, not a test performed for this article or acceptance evidence for your environment.
Read startup errors on stderr and decisions in my-box/state/private/telemetry/records.jsonl. Distinguish shell:exec from shell:spawn for an external program, and from fs:read, fs:write and network decisions. Permission to execute a shell command does not automatically allow every file that command touches.
Once the need is clear, grant writes only to the required project path and restart Box. The guide says policy is loaded at each startup. A denied telemetry connection or external program may simply be absent from the allowed policy; it is not by itself evidence of a bad proxy IP, service outage or account ban. Keep intended refusals rather than opening everything to silence errors.
Recheck architecture and outer restrictions for cloud deployments
The Linux cloud-deployment reference requires an ARM64 environment and an outer service that permits the necessary namespaces and mounts. Installing packages cannot remove a cloud service restriction. An identical container image does not establish identical execution conditions locally and in the target service.
Native filesystem policy is explicitly macOS-only; a Linux build rejects a configuration that enables it. The documented Linux capabilities explain particular setup operations rather than providing a general container privilege recipe. Running as root or granting all capabilities is not a substitute for adapting the workload.
The announcement acknowledges a larger body of trusted code, including interpreters and protocol mediation, whose bugs could bypass policy. For multitenant cloud deployments, it recommends adding a dedicated MicroVM per session. Successful startup or normal completion also does not establish cleanup after cancellation, timeout, forced termination or restoration. Check those outcomes separately inside the actual service.
List model, region and cost requirements separately
The overall design is not tied to a model, cloud or agent framework. The current macOS walkthrough nevertheless uses Homebrew Node.js 22.21+, Strands CLI, and an AWS account authorized to use Claude Opus 5 through Amazon Bedrock in us-west-2. Framework compatibility does not make that example available to every account or region.
The example leaves real Bedrock credentials for the egress gateway to inject, while the agent and tools inside the box receive a placeholder. The credential owner should configure secrets in their own terminal as directed. Do not submit real API keys, proxy credentials or complete decision logs to an article, chat or public issue.
The reviewed Box sources do not provide a single price table covering model calls, cloud compute, storage and traffic. Open source does not establish that the entire workload is free. Check the selected provider prices and account conditions separately, and validate in an eligible isolated test environment before expanding use.
Sources
Frequently Asked Questions
Does removing the startup opt-in in 0.2.1 mean Box is generally available?
No such conclusion follows. The release notes remove the startup opt-in requirement, while the launch announcement explicitly describes a developer preview. The reviewed sources do not announce a move to GA. A startup requirement and product maturity are separate matters.
Can I follow the entire macOS walkthrough on Linux?
The guide says step 1 installs on either platform; steps 2β8 are a macOS Strands CLI walkthrough. On Linux, use the official EKS, AgentCore and cloud-deployment references, checking ARM64 requirements and actual service restrictions.
Does HTTPS_PROXY mean model processing stays on my computer?
No. The variable routes relevant outbound connections to the gateway; the example still calls Bedrock in us-west-2. Execution isolation, request routing, model processing location and retention terms must be checked separately.