Command history
Every command you run through froog exec or the API gets a record on the control plane: its text (first 64 KiB), mode, status, exit code, start and end time, and its output. Records are kept 90 days and can be read while the sandbox is stopped. In the dashboard, click History on a sandbox.
$ froog history my-box
cmd_4b1e0c9a7d2f3e18 exit 0 detached 2026-11-10 14:02:11 npm run build
$ froog history my-box cmd_4b1e0c9a7d2f3e18 # stdout; exits with the command's exit code
$ froog history my-box cmd_4b1e0c9a7d2f3e18 --stderr
$ froog history my-box cmd_4b1e0c9a7d2f3e18 --follow # until it ends
$ froog history my-box --mode detached # sync, stream or detached
$ froog ps my-box # processes, busiest first
$ froog ps my-box --history --since 6h # the samples, every 30 s| Modes | sync (froog exec, waits for it), stream (--timeout 0), detached (--detach). exec answers with the command_id, and a background job's command_id is in its start answer. |
| Status | running, paused (frozen with a stopped sandbox whose memory is kept, and a start resumes it), exited, timed_out, failed (it couldn't run), killed, lost (the sandbox stopped or restarted under it). |
| Output | stdout and stderr, compressed. A waiting command stores its output when it returns (up to 1 MiB per stream, the same as its answer). A background command's output (stdout and stderr together, under stdout) is copied every 30 seconds, and once more as the sandbox stops. Up to 8 MiB per stream. |
| Cap | An account stores at most 10 MiB of compressed output per hour (about 50 MiB of text). Output past either cap is dropped and the record shows output_truncated. |
| Deletion | Deleting a sandbox deletes its history. |
Reading output: each read returns at most 1 MiB from offset. Read again from next_offset until done is true. Pass encoding=base64 for the exact bytes of binary output.
froog ps lists a running sandbox's processes live, with the history record of each background command's processes in the HISTORY column. froog also samples the 12 busiest processes every 30 seconds while a sandbox runs, and once as it stops, and keeps the samples 7 days: froog ps NAME --history, or GET /v1/sandboxes/{name}/processes/samples?since=&until=&limit= (newest first). A stopped sandbox's froog ps shows its last sample with live: false. With monitoring off no samples are taken. Only commands run through froog are recorded, not the output of SSH sessions or services.
Process records cover everything else that runs, such as services, SSH sessions and what an agent starts: froog ps NAME --records [--running] [--since 6h] or GET /v1/sandboxes/{name}/processes/records?since=&until=&running=&limit= (newest start first, limit 1-1000, default 200). Each is {pid, ppid, user, command, started_at, last_seen_at, ended_at}, kept 72 hours after the process ends. They come from the 30-second checks, so they're an approximation: a process that starts and ends between two checks isn't recorded, and it ended between last_seen_at and ended_at. Kernel threads and froog's own check are left out. Commands run through froog show here too. Output and exit codes of these processes aren't kept (that would need an agent inside the sandbox). Not kept with monitoring off.
A command the kernel killed for using too much memory (exit code 137, with an out-of-memory kill in the kernel log while it ran) has oom_killed: true in its exec answer and its record, and froog exec says so. The sandbox stays up. A larger size has more memory.