Hello @Filip Pohronsky many of the reservable sandboxes that focus on automation and programmability include a DevBox (a jumphost/development VM) with the standard pre-installed tools like Python, Ansible, and Git (others tools where needed). However once you are connect on the VPN you can run your script locally on your machine and connect to sandbox. I do this for SD-WAN with Python, Ansible etc.. or the single device such as XE, XR and NXOS. I do not often find a use case to run code from within the inside of the sandbox (on the devbox).
Your second question, you do have the ability to access the CLI of devices in CML using an external connection in bridge mode, this is not a sandbox feature but rather a CML feature that is possible to be enabled in the sandbox.
Hope this helps.
Please mark this as helpful or solution accepted to help others
Connect with me https://bigevilbeard.github.io