# Read what a sandboxed run left behind after its container is gone

> Agno's open_run_checkpoint(run_id) and aopen_run_checkpoint on a sandboxed ClaudeAgent or CodexAgent yield the verified archive a completed run committed, and checkpoint_store returns the store those archives live in.

- Published: 2026-10-19
- Author: Yash Pratap Solanky
- Categories: Changelog
- Canonical: https://www.agno.com/blog/read-what-a-sandboxed-run-left-behind-after-its-container-is-gone
- Markdown: https://www.agno.com/blog/read-what-a-sandboxed-run-left-behind-after-its-container-is-gone.md

Agno's `open_run_checkpoint(run_id)` looks up the checkpoint reference on the run's row, has the checkpoint store verify the archive, and yields its path for the length of the `with` block. `CheckpointArchive.restore` unpacks that path into `workspace/` and `native/`, minus the credential files the capture left out, so a host process can turn an engineer's edits into a patch.

```python
from pathlib import Path

from agno.sandbox.checkpoint import CheckpointArchive

with engineer.open_run_checkpoint(result.run_id) as archive:
    CheckpointArchive().restore(archive, Path("/tmp/review/turn"))

# async code, or an async database:
async with engineer.aopen_run_checkpoint(result.run_id) as archive:
    await CheckpointArchive().arestore(archive, Path("/tmp/review/turn-async"))
```

`engineer.checkpoint_store` returns the sandbox's `checkpoints=` store, or the host-local file default when none is set. Agno refuses that default while a durable queue worker is active, since another replica cannot read this host's disk. A file store now writes its objects read-only, so a reader writing through the yielded path cannot damage the session's recovery point.

We ran a `FixtureAgent` with `Repository("https://github.com/octocat/Hello-World", branch="master")` on a real `DockerSandbox` and Postgres, with the fixture runtime standing in for the model. A shell command in the warm computer appended a line to README, turn 2 committed, and we removed the container. With no container left in the namespace, `open_run_checkpoint` opened turn 2's 12,156-byte archive, and `git diff` in the restored checkout printed the edit.

![A sandboxed run's checkpoint opened on the host after its container was removed, with the fixture runtime standing in for the model, real output. docker ps filtered to the sandbox namespace lists no containers. Inside with agent.open_run_checkpoint(run_id), the 12156-byte archive is verified by the store and restored to native/fixture-session, native/repository.json, workspace/fixture-effects.txt, workspace/fixture-env.txt and workspace/repository. git diff in workspace/repository shows README gaining the line edited by the engineer after Hello World!](https://www.agno.com/images/v3-1-5-open-run-checkpoint.png)

Only a completed run of the same agent opens. On a second session without a repository, an agent with the id `reviewer` got `Run open-26783431-2 belongs to another agent`, and an id that was never run got `Run open-26783431-never does not exist`. A run that failed, was cancelled or is still running is refused the same way, since only a completed turn commits a checkpoint.

See the [cookbook](https://github.com/agno-agi/agno/blob/main/cookbook/frameworks/sandbox/docker/open_checkpoint.py), and learn more about [deploying harness agents](https://docs.agno.com/agent-os/multi-framework/deployment) in the documentation.