# Cloudflare Sandboxes

Run untrusted code in isolated environments.

Source: https://wheredoirunthis.com/products/cloudflare-sandboxes · JSON: https://wheredoirunthis.com/api/products/cloudflare-sandboxes · Read on 2026-10-08

## At a glance

- Type: Sandbox
- Kind: Hosted
- Isolation: Firecracker microVM
- Free tier: No
- Starting price: $5/mo
- GPU: Not documented
- Regions: 9
- Coverage: 22 of 61 assessed capabilities supported
- Agent readiness: read 11 of 11 signals, drive 10 of 11 signals

## Links

- Homepage: https://www.cloudflare.com/products/sandboxes/
- Docs: https://developers.cloudflare.com/sandbox/
- Pricing: https://developers.cloudflare.com/containers/platform/pricing/index.md
- Repository: https://github.com/cloudflare/sandbox-sdk

## Pricing

- Model: Workers Paid base plus metered Containers or Dynamic Workers usage
- Unit: Containers: active vCPU-seconds, provisioned GiB-seconds and GB-seconds, regional egress; Workers/Durable Objects billed separately.
- Free tier: No

| Tier | Price | Includes | Notes |
| --- | --- | --- | --- |
| Workers Paid + Containers | $5/month + usage |  | Memory unit is GiB-hours despite schema key. Disk: 200 GB-hours included, $0.000252/GB-hour overage. Egress NA/EU $0.025/GB after 1 TB; Oceania/Korea/Taiwan $0.05 after 500 GB; elsewhere $0.04 after 500 GB. CPU active usage, memory/disk provisioned. Workers, Durable Objects, logs and persistent external storage extra. [source](https://developers.cloudflare.com/containers/platform/pricing/index.md) |
| Workers Paid + Dynamic Workers | $5/month base + usage |  | Same Workers Paid base, not additive to Container base. 1,000 unique-worker daily creations/month included; $0.002 per unique Worker per day beyond. 10M requests and 30M CPU ms included; $0.30/M requests and $0.02/M CPU ms. CPU includes startup. Not a Linux substitute. [source](https://developers.cloudflare.com/dynamic-workers/pricing/index.md) |

- Card required: Not documented
- Source: https://developers.cloudflare.com/containers/platform/pricing/index.md

## Runtime

- **GPU & accelerators**: Not documented [source](https://developers.cloudflare.com/containers/platform/limits/index.md)
- **BYOC (Bring your own cloud)**: Not documented [source](https://developers.cloudflare.com/sandbox/)
- **Secrets management**: Keep credentials in the Worker; inject into approved outbound HTTPS requests, or expose restricted methods to Dynamic Workers. [source](https://developers.cloudflare.com/sandbox/concepts/security/index.md)
- **Storage options**: Ephemeral root disk 2–20 GB by predefined type; explicit snapshots persist filesystem. External storage and mounts are separate. [source](https://developers.cloudflare.com/containers/platform/limits/index.md)
- **Supported workloads**: untrusted code, coding agents, repository tests, Linux toolchains, web previews, code interpreters, restricted JavaScript API orchestration [source](https://developers.cloudflare.com/sandbox/concepts/index.md)
- **Persistence**: Writable root filesystem lasts for the running container; stop/restart loses it unless explicitly snapshotted. [source](https://developers.cloudflare.com/sandbox/concepts/lifetime/index.md)
- **Data jurisdiction**: EU, US and FedRAMP placement constraints for Containers [source](https://developers.cloudflare.com/containers/concepts/placement/index.md)
- **Resource limits & quotas**: Up to 4 vCPU, 12 GiB RAM, 20 GB disk per instance; account concurrent limits 1,500 vCPU / 6 TiB RAM / 30 TB disk; image storage 50 GB; snapshots 20 GB / 30-day TTL. [source](https://developers.cloudflare.com/containers/platform/limits/index.md)
- **SDK languages**: TypeScript, JavaScript [source](https://developers.cloudflare.com/sandbox/sdk/migrate/changes-in-1-0/index.md)
- **Network & egress controls**: Container Internet access defaults off. Worker outbound handlers mediate HTTP/HTTPS; Dynamic Workers can disable direct networking with globalOutbound:null. [source](https://developers.cloudflare.com/sandbox/concepts/security/index.md)
- **Snapshots & forks**: Filesystem snapshots in public beta; restore to a new instance. Excludes memory, running processes and mounted directories. [source](https://developers.cloudflare.com/sandbox/files/save-and-restore-a-workspace/index.md)
- **Deployment methods**: Wrangler CLI, Workers + Durable Objects, Container API, Sandbox SDK helpers [source](https://developers.cloudflare.com/sandbox/get-started/index.md)
- **Isolation**: Firecracker microVM [source](https://developers.cloudflare.com/sandbox/concepts/index.md)

## Capabilities

### AI & agents

| Capability | Status | Evidence |
| --- | --- | --- |
| Agent skills | Supported | "The plugin works with any agent that supports the Agent Skills standard, including Claude Code, OpenCode, OpenAI Codex, and Pi." [source](https://developers.cloudflare.com/agents/model-context-protocol/cloudflare/servers-for-cloudflare/) |
| AI app builder | Not supported | [source](https://developers.cloudflare.com/sandbox/llms.txt) |
| Autonomous QA agent | Not supported | [source](https://developers.cloudflare.com/sandbox/llms.txt) |
| Built-in coding agent | Not supported | [source](https://developers.cloudflare.com/sandbox/llms.txt) |
| BYOK for LLMs | Not supported | [source](https://developers.cloudflare.com/sandbox/llms.txt) |
| Credential-injection proxy | Supported | "A Container can send its request without the credential, and an outbound handler in your Worker adds the credential after the request leaves the sandbox." [source](https://developers.cloudflare.com/sandbox/concepts/security/index.md) |
| LLM gateway | Not supported | [source](https://developers.cloudflare.com/sandbox/llms.txt) |
| MCP client | Not supported | [source](https://developers.cloudflare.com/sandbox/llms.txt) |
| MCP-server hosting | Not supported | [source](https://developers.cloudflare.com/sandbox/llms.txt) |
| MCP server | Supported | "`https://containers.mcp.cloudflare.com/mcp`" [source](https://developers.cloudflare.com/agents/model-context-protocol/cloudflare/servers-for-cloudflare/) |
| Model inference API (first-party) | Not supported | [source](https://developers.cloudflare.com/sandbox/llms.txt) |
| Preinstalled coding agent | Not supported | [source](https://developers.cloudflare.com/sandbox/llms.txt) |

### Networking & delivery

| Capability | Status | Evidence |
| --- | --- | --- |
| Automatic HTTPS | Supported | "Serve each sandbox preview from its own hostname, such as `ada.example-previews.com`." [source](https://developers.cloudflare.com/sandbox/previews/serve-previews-on-their-own-hostnames/index.md) |
| Custom domains | Supported | "Serve each sandbox preview from its own hostname, such as `ada.example-previews.com`." [source](https://developers.cloudflare.com/sandbox/previews/serve-previews-on-their-own-hostnames/index.md) |
| Direct public IPv6 | Not supported | [source](https://developers.cloudflare.com/sandbox/llms.txt) |
| Edge KV store | Not supported | [source](https://developers.cloudflare.com/sandbox/llms.txt) |
| Egress controls | Supported | "A Container starts with `enableInternet: false` by default, so it cannot reach the Internet." [source](https://developers.cloudflare.com/sandbox/concepts/security/index.md) |
| Email send / receive | Not supported | [source](https://developers.cloudflare.com/sandbox/llms.txt) |
| Public preview URLs | Supported | "Serve each sandbox preview from its own hostname, such as `ada.example-previews.com`." [source](https://developers.cloudflare.com/sandbox/previews/serve-previews-on-their-own-hostnames/index.md) |
| Private networking | Not supported | [source](https://developers.cloudflare.com/sandbox/llms.txt) |
| Built-in reverse proxy | Supported | "Serve each sandbox preview from its own hostname, such as `ada.example-previews.com`." [source](https://developers.cloudflare.com/sandbox/previews/serve-previews-on-their-own-hostnames/index.md) |

### Organisation & security

| Capability | Status | Evidence |
| --- | --- | --- |
| Built-in auth | Not supported | [source](https://developers.cloudflare.com/sandbox/llms.txt) |
| BYOC | Not supported | [source](https://developers.cloudflare.com/sandbox/llms.txt) |
| Deploy into customers' VPCs | Not supported | [source](https://developers.cloudflare.com/sandbox/llms.txt) |
| Secrets management | Supported | "Credentials are safer outside the sandbox." [source](https://developers.cloudflare.com/sandbox/concepts/security/index.md) |
| Self-host / OSS core | Not supported | [source](https://developers.cloudflare.com/sandbox/llms.txt) |
| Sharing | Not supported | [source](https://developers.cloudflare.com/sandbox/llms.txt) |
| SSO / SAML | Not supported | [source](https://developers.cloudflare.com/sandbox/llms.txt) |
| Teams | Not supported | [source](https://developers.cloudflare.com/sandbox/llms.txt) |
| Workload identity | Not supported | [source](https://developers.cloudflare.com/sandbox/llms.txt) |

### Developer access

| Capability | Status | Evidence |
| --- | --- | --- |
| CLI | Supported | "wrangler containers ssh <INSTANCE_ID>" [source](https://developers.cloudflare.com/containers/guides/ssh/index.md) |
| E2B-compatible API | Not supported | [source](https://developers.cloudflare.com/sandbox/llms.txt) |
| Filesystem API | Supported | "The package keeps only small helpers, such as the `Files` class." [source](https://developers.cloudflare.com/sandbox/sdk/migrate/changes-in-1-0/index.md) |
| Git deploy | Not supported | [source](https://developers.cloudflare.com/sandbox/llms.txt) |
| HTTP data API | Not supported | [source](https://developers.cloudflare.com/sandbox/llms.txt) |
| OpenAPI spec | Supported | "openapi: 3.0.3" [source](https://raw.githubusercontent.com/cloudflare/api-schemas/main/openapi.yaml) |
| Private container registry | Not supported | [source](https://developers.cloudflare.com/sandbox/llms.txt) |
| Public API | Supported | "It runs commands, connects to ports, intercepts outbound requests, and saves snapshots." [source](https://developers.cloudflare.com/sandbox/sdk/migrate/changes-in-1-0/index.md) |
| SDK | Supported | "The package keeps only small helpers, such as the `Files` class." [source](https://developers.cloudflare.com/sandbox/sdk/migrate/changes-in-1-0/index.md) |
| SSH access | Supported | "Anyone with write access to a Container can SSH into it with Wrangler as long as a matching public key is listed in `authorized_keys`." [source](https://developers.cloudflare.com/containers/guides/ssh/index.md) |

### Compute & storage

| Capability | Status | Evidence |
| --- | --- | --- |
| Cloud-init / ignition config | Not supported | [source](https://developers.cloudflare.com/sandbox/llms.txt) |
| Desktop / computer-use sandbox | Not supported | [source](https://developers.cloudflare.com/sandbox/llms.txt) |
| GPU compute | Not supported | [source](https://developers.cloudflare.com/sandbox/llms.txt) |
| Live-state (memory) snapshots | Not supported | "It does not include mounted directories, memory, or running processes." [source](https://developers.cloudflare.com/sandbox/files/save-and-restore-a-workspace/index.md) |
| Multi-region | Supported | "Use the `regions` constraint to limit container placement to specific geographic areas:" [source](https://developers.cloudflare.com/containers/concepts/placement/index.md) |
| Object storage | Supported | "The `S3Mount` class from `@cloudflare/sandbox` mounts one prefix of a bucket as a directory with `s3fs`." [source](https://developers.cloudflare.com/sandbox/files/mount-an-r2-bucket/index.md) |
| Persistent disk | Partially supported | "A snapshot saves the writable root filesystem." [source](https://developers.cloudflare.com/sandbox/files/save-and-restore-a-workspace/index.md) |
| Sandbox templates / custom images | Supported | "Use standard container images with your own dependencies, tools, and runtimes." [source](https://www.cloudflare.com/products/sandboxes/) |
| Scale to zero | Supported | "This makes it easy to scale to zero, and allows you to get high utilization even with bursty traffic." [source](https://developers.cloudflare.com/containers/platform/pricing/index.md) |
| Selectable isolation runtime | Supported | "Your Worker starts either one, and one Worker can use both." [source](https://developers.cloudflare.com/sandbox/concepts/index.md) |
| Snapshots / forking | Supported | "A Durable Object saves the filesystem of a sandbox as a Container snapshot, stores the snapshot ID, and starts the next instance from the snapshot." [source](https://developers.cloudflare.com/sandbox/files/save-and-restore-a-workspace/index.md) |

### Data

| Capability | Status | Evidence |
| --- | --- | --- |
| Database branching | Not supported | [source](https://developers.cloudflare.com/sandbox/llms.txt) |
| Ephemeral instant DB (no-signup) | Not supported | [source](https://developers.cloudflare.com/sandbox/llms.txt) |
| First-party database | Not supported | [source](https://developers.cloudflare.com/sandbox/llms.txt) |
| Vector search | Not supported | [source](https://developers.cloudflare.com/sandbox/llms.txt) |

### Platform & operations

| Capability | Status | Evidence |
| --- | --- | --- |
| Managed CI/CD runners | Not supported | [source](https://developers.cloudflare.com/sandbox/llms.txt) |
| Built-in observability | Supported | "Containers are integrated with the [Workers Logs]" [source](https://developers.cloudflare.com/containers/platform/pricing/index.md) |
| Preview environments | Not supported | [source](https://developers.cloudflare.com/sandbox/llms.txt) |
| Scheduled tasks | Not supported | [source](https://developers.cloudflare.com/sandbox/llms.txt) |
| Project template marketplace | Not supported | [source](https://developers.cloudflare.com/sandbox/llms.txt) |
| Durable workflows | Not supported | [source](https://developers.cloudflare.com/sandbox/llms.txt) |

## Agent readiness

### Read: 11 of 11 signals present

11/11 signals (9 full, 2 partial)

- Llms txt: pass — "https://developers.cloudflare.com/sandbox/llms.txt"
- Llms full txt: pass — "https://developers.cloudflare.com/sandbox/llms-full.txt — 1,436,527 bytes, comprehensive"
- Robots AI policy: pass — "https://www.cloudflare.com/robots.txt explicit AI user-agent Allow: /"
- JSON LD: partial — "https://www.cloudflare.com/products/sandboxes/ Organization/WebSite/WebPage; no Product offers"
- Sitemap: pass — "https://www.cloudflare.com/sitemap.xml nontrivial XML sitemap"
- Meta quality: pass — "https://www.cloudflare.com/products/sandboxes/ descriptive title, description, Open Graph"
- Markdown negotiation: pass — "https://www.cloudflare.com/products/sandboxes/ clean .md alternative and docs index.md"
- Content efficiency: partial — "https://www.cloudflare.com/products/sandboxes/ text excluding script/style: 3.11% HTML bytes"
- Docs discoverable: pass — "https://www.cloudflare.com/products/sandboxes/ Full Documentation link, server-rendered"
- Pricing machine readable: pass — "https://developers.cloudflare.com/containers/platform/pricing/index.md structured tables"
- Anti bot: pass — "Public pages fetched without challenge; obsolete 404s resolved from indexes."

### Drive: 10 of 11 signals present

10/11 signals (8 full, 2 partial)

- Public API: pass — "https://developers.cloudflare.com/containers/api/durable-object-container/index.md Container API plus parent REST control plane"
- Openapi spec: pass — "https://raw.githubusercontent.com/cloudflare/api-schemas/main/openapi.yaml — openapi: 3.0.3, parent control plane"
- MCP server: pass — "https://developers.cloudflare.com/agents/model-context-protocol/cloudflare/servers-for-cloudflare/ hosted Container and API endpoints"
- SDK packages: pass — "https://developers.cloudflare.com/fundamentals/api/reference/sdks/index.md Go/TypeScript/Python parent API; Sandbox helpers JS/TS"
- Auth docs: pass — "https://developers.cloudflare.com/fundamentals/api/get-started/create-token/index.md scoped token documentation"
- Agent self serve creds: partial — "https://developers.cloudflare.com/fundamentals/api/get-started/create-token/index.md dashboard initial signup/key creation, human step"
- Webhooks: fail — "https://developers.cloudflare.com/sandbox/llms.txt no signed Sandboxes event webhooks found"
- CLI tool: pass — "https://developers.cloudflare.com/containers/guides/ssh/index.md official Wrangler"
- Error model: partial — "https://developers.cloudflare.com/sandbox/files/save-and-restore-a-workspace/index.md missing-snapshot errors documented; user-written HTTP routes lack common JSON contract"
- Rate limit docs: pass — "https://developers.cloudflare.com/fundamentals/api/reference/limits/index.md 1200/5min and rate-limit headers, parent REST API"
- Agent config: pass — "https://www.cloudflare.com/.well-known/agents.json discovery plus https://developers.cloudflare.com/agents/model-context-protocol/cloudflare/servers-for-cloudflare/ skills"

## Coding harnesses

- Claude Code (Anthropic) — "The plugin works with any agent that supports the Agent Skills standard, including Claude Code, OpenCode, OpenAI Codex, and Pi." [source](https://developers.cloudflare.com/agents/model-context-protocol/cloudflare/servers-for-cloudflare/)
- OpenCode (opencode) — "The plugin works with any agent that supports the Agent Skills standard, including Claude Code, OpenCode, OpenAI Codex, and Pi." [source](https://developers.cloudflare.com/agents/model-context-protocol/cloudflare/servers-for-cloudflare/)
- Codex CLI (OpenAI) — "The plugin works with any agent that supports the Agent Skills standard, including Claude Code, OpenCode, OpenAI Codex, and Pi." [source](https://developers.cloudflare.com/agents/model-context-protocol/cloudflare/servers-for-cloudflare/)
- Pi (earendil-works) — "The plugin works with any agent that supports the Agent Skills standard, including Claude Code, OpenCode, OpenAI Codex, and Pi." [source](https://developers.cloudflare.com/agents/model-context-protocol/cloudflare/servers-for-cloudflare/)
- Devin (Cognition) — "Deploy a Devin Outpost that runs each Devin session in its own sandbox on Containers." [source](https://developers.cloudflare.com/sandbox/coding-agents/)
- Cursor (Anysphere) — "Deploy self-hosted machines that run each Cursor session in its own sandbox on Containers." [source](https://developers.cloudflare.com/sandbox/coding-agents/)

Plausible compatibility (derived, not stored):

- Aider
- Amp
- Antigravity
- Droid
- Gemini CLI
- Goose
- Hermes Agent
- Kilo Code
- Kiro CLI
- Qwen Code

## Compliance & regions

- Regions: ENAM, WNAM, EEUR, WEUR, APAC, SAM, ME, OC, AFR
- Regions note: Container placement regions, not a count of edge PoPs. ME/OC/AFR cannot be selected exclusively. EU/US/FedRAMP jurisdiction constraints available; no certification inferred.

## Company & presence

- Headquarters: San Francisco, California, US
- Privacy policy: https://www.cloudflare.com/privacypolicy/
- Terms of service: https://www.cloudflare.com/terms/
- Documentation: https://developers.cloudflare.com/sandbox/
- GitHub SDK: https://github.com/cloudflare/sandbox-sdk
- Blog: https://blog.cloudflare.com/
- MCP: https://developers.cloudflare.com/agents/model-context-protocol/cloudflare/servers-for-cloudflare/

## Nearby in the atlas

- [Agent Safehouse](/products/agent-safehouse.md)
- [Agent Sandbox](/products/agent-sandbox.md)
- [Agent Substrate](/products/agent-substrate.md)
- [Agent37](/products/agent37.md)
- [AgentNest](/products/agentnest.md)
- [Anthropic Sandbox Runtime (srt)](/products/sandbox-runtime.md)

## Method

Facts come from the product's own public pages. Each claim carries its evidence: a quote and the page it came from. We count capabilities rather than grade products, and "Not assessed" means we have not checked, never that the product lacks it.