# Cloudflare Sandbox SDK [[Cloudflare]] Sandbox SDK is a managed-container runtime for executing untrusted code from AI agents and applications. Each sandbox is an isolated [[Cloudflare Containers]] instance with a filesystem, command execution, a code interpreter, and preview URLs, addressable from a [[Cloudflare Workers]] via a Durable-Object-backed handle. It's the Cloudflare answer to E2B, Modal sandboxes, and Daytona: a way for LLM-driven agents to run arbitrary Python, Node, shell commands, install packages, and serve HTTP previews, without the host having to trust the code. ## Why It Matters AI agents that write and execute code need a place to run that code that won't compromise the host. Doing this safely yourself (containers, network isolation, filesystem limits, lifecycle management) is operationally heavy. Sandbox SDK handles it: spin up a sandbox, run code, capture output, kill it. Expect milliseconds for a Dynamic Worker and 1 to 3 seconds for a container cold start (Cloudflare's own estimate; image size matters). Pairs naturally with [[Cloudflare Agents SDK]]: the agent owns the sandbox lifecycle, the sandbox isolates the side effects. ## Status in 2026 - **GA on April 13, 2026**, together with [[Cloudflare Containers]]. Workers Paid plan only - **Two backends**: the docs now cover "Sandboxes" in general, either a container (a microVM with its own kernel, any language, long-running processes) or a [[Cloudflare Dynamic Workers|Dynamic Worker]] (JavaScript, Python or WebAssembly in a fresh isolate, much faster to start) - **Deprecations (June 9, 2026)**: the HTTP and WebSocket transports are deprecated in favor of RPC, along with a few low-adoption features. Don't build new work on them - **Sandbox SDK 1.0 (September 30, 2026)**: your own [[Cloudflare Durable Objects|Durable Object]] class now controls each sandbox through `this.ctx.container`. It picks the image and instance size at every start, saves the filesystem as a snapshot (public beta) and decides when the sandbox stops. Outbound requests are handled per hostname in Worker code, so credentials and bindings never enter the sandbox ## Core Primitives - **Sandbox lifecycle**: create, attach, destroy - **Commands**: shell command execution with captured stdout/stderr - **Files**: read, write, list across the sandbox filesystem - **Code interpreter**: Python/Node REPL-style execution - **Preview URLs**: expose any port from the sandbox via a public HTTPS URL ## Common Use Cases - **AI code execution**: agent writes Python, runs it, reads the output - **Code interpreters** for chat apps (think ChatGPT's "advanced data analysis") - **CI/CD-like systems** running untrusted user-submitted code - **Interactive dev environments** spawned on demand for users - **Reproducible script runs** with isolated filesystems ## References - Sandboxes documentation: https://developers.cloudflare.com/sandbox/ - GitHub: https://github.com/cloudflare/sandbox-sdk - Containers FAQ (cold starts, disk persistence): https://developers.cloudflare.com/containers/faq/ - Changelog, Containers and Sandboxes GA (2026-04-13): https://developers.cloudflare.com/changelog/post/2026-04-13-containers-sandbox-ga/ - Changelog, deprecating Sandbox SDK features (2026-06-09): https://developers.cloudflare.com/changelog/post/2026-06-09-deprecating-sandbox-sdk-features/ - Changelog, Sandbox SDK 1.0 (2026-09-30): https://developers.cloudflare.com/changelog/post/2026-09-30-sandbox-sdk-1-0/ ## Related - [[Cloudflare]] - [[Cloudflare Workers]] - [[Cloudflare Durable Objects]] - [[Cloudflare Containers]] - [[Cloudflare Dynamic Workers]] - [[Cloudflare Agents SDK]] - [[Cloudflare Artifacts]] - [[Code Mode MCP Pattern]] - [[Wrangler]] - [[AI Agents]] - [[microVM]] - [[Docker Sandboxes]] - [[OpenSandbox]] - [[Vercel Sandboxes]] - [[Sandcastle (AI)]] - [[GitHub Copilot Sandboxing]]