# Cloudflare Sandbox

> Where an AI product runs code nobody reviewed: an isolated container per session, started and driven from a Worker, billed only for the CPU it actually uses.

- Verdict: Use when it fits
- Vendor: Cloudflare
- Layer: [AI](https://cloudlesslabs.com/stack/layers/ai.md). Job: Running untrusted and AI-written code
- Last reviewed: 20 October 2026, by Nicolas Dao (Cloudless Labs, Sydney)
- Web page: https://cloudlesslabs.com/stack/cloudflare-sandbox/. The whole stack in one file: https://cloudlesslabs.com/stack/brief.md

AI products increasingly run code that nobody reviewed, and that code must never run where your credentials live. A Lambda runs with its function's role and environment variables, and its `/tmp` survives into the next invocation. Hardening it into a sandbox is a project in itself.

Cloudflare Sandbox gives each session its own container, driven from a Worker through an SDK: run commands and Python or JavaScript, read and write files, open a terminal, back the workspace up and restore it. It went GA in April 2026 and bills only for active CPU, so an agent waiting on a model costs almost nothing. It loses a point on infrastructure as code, which still goes through Wrangler.

## Use it when

- Your AI feature writes code and runs it: a data-analysis chat running Python on a user's spreadsheet, an agent that installs packages and runs tests.
- Users upload scripts or code you must run safely.
- You want sessions an agent can come back to: persistent code interpreters, files, a terminal, and backup and restore of the workspace.

## Don't use it when

- The code is yours and reviewed: a normal Worker or Lambda is simpler.
- Jobs that run for hours on fixed infrastructure: Fargate fits better.

## Pricing

On Workers Paid ($5 a month): active CPU at $0.000020 per vCPU-second, with 375 vCPU-minutes, 25 GiB-hours of memory and 200 GB-hours of disk included each month. Egress from Oceania $0.05/GB after 500 GB.

## Gotchas, with fixes

- **Gotcha:** Untrusted code can still try to reach your APIs or leak secrets through the network.
  **Fix:** Never put secrets inside the sandbox. Route its traffic through an outbound Worker, the egress proxy that injects credentials per destination so the code never sees them, and allow only the destinations it needs.
- **Gotcha:** Costs grow with every session left running.
  **Fix:** Give every session a timeout and destroy it when the user leaves; back up the workspace and restore it if they come back.

## Provisioning

No provider · No Terraform provider

Deployed with `wrangler deploy`, which builds and pushes the container image. I found no Terraform or Pulumi resource for it yet: wrap the Wrangler deploy in a Pulumi command resource keyed on a hash of the source.

## Instead, consider

- [Fargate scheduled tasks](https://cloudlesslabs.com/stack/aws-fargate-scheduled-tasks/index.md): Long batch jobs on code you control, inside AWS.
- [Vercel](https://cloudlesslabs.com/stack/vercel/index.md): A team already on Vercel: Vercel Sandbox does the same job there.

## Sources

- [Cloudflare changelog: Containers and Sandboxes are generally available](https://developers.cloudflare.com/changelog/post/2026-04-13-containers-sandbox-ga/)
- [InfoQ: Cloudflare Sandboxes reach general availability](https://www.infoq.com/news/2026/04/cloudflare-sandboxes-ga/)
- [Cloudflare Containers: pricing](https://developers.cloudflare.com/containers/pricing/)

## Related

- [AI](https://cloudlesslabs.com/stack/layers/ai.md): every tool in this layer, with its verdict
- [The whole stack in one file](https://cloudlesslabs.com/stack/brief.md): every use case and tool, for questions that span many
- [Map of every Markdown file on cloudlesslabs.com, with what each one answers](https://ask.cloudlesslabs.com)