# AI that runs the code it writes

> My product runs code nobody on my team reviewed, written by an LLM or uploaded by a customer. Nicolas Dao's picks for this job (Cloudless Labs, Sydney), in order of preference, what he would avoid, and what to use instead.

- Use case 3 of 26 in The Stack, last reviewed 9 November 2026
- Web page: https://cloudlesslabs.com/stack/use-cases/ai-code/

Picks, in order of preference:

1. **[Cloudflare Sandbox](https://cloudlesslabs.com/stack/cloudflare-sandbox/index.md)** (Use when it fits): The default: a container per session with a ready-made toolkit, billed on active CPU. About a quarter of the price for short bursts.
2. **[Lambda MicroVMs](https://cloudlesslabs.com/stack/aws-lambda-microvms/index.md)** (Watching): When the code must run in Australia, reach a private VPC, use more than 4 vCPU, or keep its processes through long sessions.

Don't:

- ~~AWS Lambda~~: Not for code nobody reviewed: it runs with the function's role and environment variables, and its /tmp survives into the next invocation. Instead: [Cloudflare Sandbox](https://cloudlesslabs.com/stack/cloudflare-sandbox/index.md) or [Lambda MicroVMs](https://cloudlesslabs.com/stack/aws-lambda-microvms/index.md).

Questions that change the answer:

- Who wrote the code? If your team reviewed it, you don't need a sandbox.
- Must the code or the data stay in Australia, or reach a private VPC? Then it's Lambda MicroVMs.
- How long is a session? Seconds to minutes points to Cloudflare Sandbox; hours with a running dev server to Lambda MicroVMs.

Worked example: [Cloudflare Sandbox or Lambda MicroVMs?](https://cloudlesslabs.com/stack/guides/sandbox-or-microvms/index.md)

## The picks in brief

- [Cloudflare Sandbox](https://cloudlesslabs.com/stack/cloudflare-sandbox/index.md): Use when it fits. Where an AI product runs code nobody reviewed: an isolated container per session, started and driven from a Worker, billed only for the CPU it actually uses. Pricing: On Workers Paid ($5 a month): active CPU at $0.000020 per vCPU-second, with 375 vCPU-minutes, 25 GiB-hours of memory and 200 GB-hours of disk included each month. Egress from Oceania $0.05/GB after 500 GB.
- [Lambda MicroVMs](https://cloudlesslabs.com/stack/aws-lambda-microvms/index.md): Watching. A Firecracker VM per session for code nobody reviewed, inside your AWS account, in Sydney, with VPC access. It suspends with its memory intact and resumes on the next request. Pricing: Baseline compute billed per second while the MicroVM runs, from 1 vCPU and 2 GB (about $0.126 an hour at US East Arm rates: $0.0000276944 per vCPU-second and $0.0000036667 per GB-second). Resources above the baseline, up to 4×, billed only while used. Suspended: no compute, only snapshots ($0.0038 per GB written, $0.00155 per GB read, $0.08 per GB-month stored). Sydney rates not checked.

## Related

- [Cloudflare Sandbox or Lambda MicroVMs?](https://cloudlesslabs.com/stack/guides/sandbox-or-microvms/index.md): the worked example for this job, with costs
- [Compute](https://cloudlesslabs.com/stack/layers/compute/index.md): every tool in this layer
- [AI](https://cloudlesslabs.com/stack/layers/ai/index.md): every tool in this layer
- [Every use case and tool in one file](https://cloudlesslabs.com/stack/brief.md)
- [Map of every Markdown file on cloudlesslabs.com, with what each one answers](https://ask.cloudlesslabs.com)