@cloudflare/sandbox 0.0.0-8af9edd → 0.0.0-8c1f440

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (79) hide show
  1. package/CHANGELOG.md +183 -0
  2. package/Dockerfile +108 -64
  3. package/README.md +149 -50
  4. package/dist/chunk-BFVUNTP4.js +104 -0
  5. package/dist/chunk-BFVUNTP4.js.map +1 -0
  6. package/dist/chunk-EKSWCBCA.js +86 -0
  7. package/dist/chunk-EKSWCBCA.js.map +1 -0
  8. package/dist/chunk-EXQOIRZI.js +2351 -0
  9. package/dist/chunk-EXQOIRZI.js.map +1 -0
  10. package/dist/chunk-JXZMAU2C.js +559 -0
  11. package/dist/chunk-JXZMAU2C.js.map +1 -0
  12. package/dist/chunk-Z532A7QC.js +78 -0
  13. package/dist/chunk-Z532A7QC.js.map +1 -0
  14. package/dist/file-stream.d.ts +43 -0
  15. package/dist/file-stream.js +9 -0
  16. package/dist/file-stream.js.map +1 -0
  17. package/dist/index.d.ts +9 -0
  18. package/dist/index.js +66 -0
  19. package/dist/index.js.map +1 -0
  20. package/dist/interpreter.d.ts +33 -0
  21. package/dist/interpreter.js +8 -0
  22. package/dist/interpreter.js.map +1 -0
  23. package/dist/request-handler.d.ts +18 -0
  24. package/dist/request-handler.js +12 -0
  25. package/dist/request-handler.js.map +1 -0
  26. package/dist/sandbox-D9K2ypln.d.ts +583 -0
  27. package/dist/sandbox.d.ts +4 -0
  28. package/dist/sandbox.js +12 -0
  29. package/dist/sandbox.js.map +1 -0
  30. package/dist/security.d.ts +31 -0
  31. package/dist/security.js +13 -0
  32. package/dist/security.js.map +1 -0
  33. package/dist/sse-parser.d.ts +28 -0
  34. package/dist/sse-parser.js +11 -0
  35. package/dist/sse-parser.js.map +1 -0
  36. package/package.json +13 -9
  37. package/src/clients/base-client.ts +280 -0
  38. package/src/clients/command-client.ts +115 -0
  39. package/src/clients/file-client.ts +269 -0
  40. package/src/clients/git-client.ts +92 -0
  41. package/src/clients/index.ts +63 -0
  42. package/src/clients/interpreter-client.ts +329 -0
  43. package/src/clients/port-client.ts +105 -0
  44. package/src/clients/process-client.ts +177 -0
  45. package/src/clients/sandbox-client.ts +41 -0
  46. package/src/clients/types.ts +84 -0
  47. package/src/clients/utility-client.ts +94 -0
  48. package/src/errors/adapter.ts +180 -0
  49. package/src/errors/classes.ts +469 -0
  50. package/src/errors/index.ts +105 -0
  51. package/src/file-stream.ts +164 -0
  52. package/src/index.ts +87 -8
  53. package/src/interpreter.ts +159 -0
  54. package/src/request-handler.ts +99 -24
  55. package/src/sandbox.ts +785 -121
  56. package/src/security.ts +104 -0
  57. package/src/sse-parser.ts +143 -0
  58. package/startup.sh +3 -0
  59. package/tests/base-client.test.ts +328 -0
  60. package/tests/command-client.test.ts +407 -0
  61. package/tests/file-client.test.ts +643 -0
  62. package/tests/file-stream.test.ts +306 -0
  63. package/tests/git-client.test.ts +328 -0
  64. package/tests/port-client.test.ts +301 -0
  65. package/tests/process-client.test.ts +658 -0
  66. package/tests/sandbox.test.ts +465 -0
  67. package/tests/sse-parser.test.ts +290 -0
  68. package/tests/utility-client.test.ts +266 -0
  69. package/tests/wrangler.jsonc +35 -0
  70. package/tsconfig.json +9 -1
  71. package/vitest.config.ts +31 -0
  72. package/container_src/index.ts +0 -3252
  73. package/container_src/package.json +0 -9
  74. package/src/client.ts +0 -2089
  75. package/tests/client.example.ts +0 -308
  76. package/tests/connection-test.ts +0 -81
  77. package/tests/simple-test.ts +0 -81
  78. package/tests/test1.ts +0 -281
  79. package/tests/test2.ts +0 -929
package/CHANGELOG.md CHANGED
@@ -1,5 +1,188 @@
1
1
  # @cloudflare/sandbox
2
2
 
3
+ ## 0.4.2
4
+
5
+ ### Patch Changes
6
+
7
+ - [`e53d7e7`](https://github.com/cloudflare/sandbox-sdk/commit/e53d7e7ce185f79bdd899029bb532e9651ae7ba5) Thanks [@threepointone](https://github.com/threepointone)! - fix build by inlining repo/shared
8
+
9
+ ## 0.4.1
10
+
11
+ ### Patch Changes
12
+
13
+ - [#111](https://github.com/cloudflare/sandbox-sdk/pull/111) [`1b5496b`](https://github.com/cloudflare/sandbox-sdk/commit/1b5496bfceaee53c31911b409476ea87bebffe4c) Thanks [@threepointone](https://github.com/threepointone)! - trigger a release
14
+
15
+ ## 0.4.0
16
+
17
+ ### Minor Changes
18
+
19
+ - [#95](https://github.com/cloudflare/sandbox-sdk/pull/95) [`7aee736`](https://github.com/cloudflare/sandbox-sdk/commit/7aee736bf07a4bf9020e2109bdaaa70214d52a01) Thanks [@ghostwriternr](https://github.com/ghostwriternr)! - Rewrite SDK with cleaner design patterns and tests. Remove the unnecessary isolation cruft and fix foundational issues with streaming, sessions, validations and error handling. Cover the SDK with unit & e2e tests.
20
+
21
+ ### Patch Changes
22
+
23
+ - [#106](https://github.com/cloudflare/sandbox-sdk/pull/106) [`da947cd`](https://github.com/cloudflare/sandbox-sdk/commit/da947cd9543fc99831eefb1e8741fc905cb8fa42) Thanks [@jahands](https://github.com/jahands)! - fix examples failing to deploy and prevent committing node_modules
24
+
25
+ ## 0.3.3
26
+
27
+ ### Patch Changes
28
+
29
+ - [#83](https://github.com/cloudflare/sandbox-sdk/pull/83) [`eec5bb6`](https://github.com/cloudflare/sandbox-sdk/commit/eec5bb6203dd5d775b4b54e91c26de25eeb767ce) Thanks [@mikenomitch](https://github.com/mikenomitch)! - Bump containers package version
30
+
31
+ ## 0.3.2
32
+
33
+ ### Patch Changes
34
+
35
+ - [#76](https://github.com/cloudflare/sandbox-sdk/pull/76) [`ef9e320`](https://github.com/cloudflare/sandbox-sdk/commit/ef9e320dcef30e57797fef6ebd9a9383fa9720d9) Thanks [@ghostwriternr](https://github.com/ghostwriternr)! - Replace Jupyter with lightweight interpreters for >90% faster cold starts for `.runCode` calls, while maintaining full code execution capabilities and rich output support.
36
+
37
+ ## 0.3.1
38
+
39
+ ### Patch Changes
40
+
41
+ - [#71](https://github.com/cloudflare/sandbox-sdk/pull/71) [`fb3c9c2`](https://github.com/cloudflare/sandbox-sdk/commit/fb3c9c22242d9d4f157c26f547f1e697ef7875f9) Thanks [@ghostwriternr](https://github.com/ghostwriternr)! - Bump containers package version
42
+
43
+ - [#70](https://github.com/cloudflare/sandbox-sdk/pull/70) [`e1fa354`](https://github.com/cloudflare/sandbox-sdk/commit/e1fa354ab1bc7b0e89db4901b67028ebf1a93d0a) Thanks [@ghostwriternr](https://github.com/ghostwriternr)! - Fix escaped quotes in file write operations
44
+
45
+ - [#68](https://github.com/cloudflare/sandbox-sdk/pull/68) [`69b91d1`](https://github.com/cloudflare/sandbox-sdk/commit/69b91d1a8f6afb63262cc381ea93e94a033ed5e8) Thanks [@CyrusNuevoDia](https://github.com/CyrusNuevoDia)! - Configurable timeouts via environment variables in isolation.ts
46
+
47
+ - [#66](https://github.com/cloudflare/sandbox-sdk/pull/66) [`eca93b9`](https://github.com/cloudflare/sandbox-sdk/commit/eca93b97e40fa0d3bd9dc27af2cc214ec355b696) Thanks [@peterp](https://github.com/peterp)! - Determine if the port is specified in the URL.
48
+
49
+ ## 0.3.0
50
+
51
+ ### Minor Changes
52
+
53
+ - [#59](https://github.com/cloudflare/sandbox-sdk/pull/59) [`b6757f7`](https://github.com/cloudflare/sandbox-sdk/commit/b6757f730c34381d5a70d513944bbf9840f598ab) Thanks [@ghostwriternr](https://github.com/ghostwriternr)! - Add process isolation for sandbox commands
54
+
55
+ Implements PID namespace isolation to protect control plane processes (Jupyter, Bun) from sandboxed code. Commands executed via `exec()` now run in isolated namespaces that cannot see or interact with system processes.
56
+
57
+ **Key security improvements:**
58
+
59
+ - Control plane processes are hidden from sandboxed commands
60
+ - Platform secrets in `/proc/1/environ` are inaccessible
61
+ - Ports 8888 (Jupyter) and 3000 (Bun) are protected from hijacking
62
+
63
+ **Breaking changes:**
64
+
65
+ 1. **Removed `sessionId` parameter**: The `sessionId` parameter has been removed from all methods (`exec()`, `execStream()`, `startProcess()`, etc.). Each sandbox now maintains its own persistent session automatically.
66
+
67
+ ```javascript
68
+ // Before: manual session management
69
+ await sandbox.exec("cd /app", { sessionId: "my-session" });
70
+
71
+ // After: automatic session per sandbox
72
+ await sandbox.exec("cd /app");
73
+ ```
74
+
75
+ 2. **Commands now maintain state**: Commands within the same sandbox now share state (working directory, environment variables, background processes). Previously each command was stateless.
76
+
77
+ ```javascript
78
+ // Before: each exec was independent
79
+ await sandbox.exec("cd /app");
80
+ await sandbox.exec("pwd"); // Output: /workspace
81
+
82
+ // After: state persists in session
83
+ await sandbox.exec("cd /app");
84
+ await sandbox.exec("pwd"); // Output: /app
85
+ ```
86
+
87
+ **Migration guide:**
88
+
89
+ - Remove `sessionId` from all method calls - each sandbox maintains its own session
90
+ - If you need isolated execution contexts within the same sandbox, use `sandbox.createSession()`:
91
+ ```javascript
92
+ // Create independent sessions with different environments
93
+ const buildSession = await sandbox.createSession({
94
+ name: "build",
95
+ env: { NODE_ENV: "production" },
96
+ cwd: "/build",
97
+ });
98
+ const testSession = await sandbox.createSession({
99
+ name: "test",
100
+ env: { NODE_ENV: "test" },
101
+ cwd: "/test",
102
+ });
103
+ ```
104
+ - Environment variables set in one command persist to the next
105
+ - Background processes remain active until explicitly killed
106
+ - Requires CAP_SYS_ADMIN (available in production, falls back gracefully in dev)
107
+
108
+ ### Patch Changes
109
+
110
+ - [#62](https://github.com/cloudflare/sandbox-sdk/pull/62) [`4bedc3a`](https://github.com/cloudflare/sandbox-sdk/commit/4bedc3aba347f3d4090a6efe2c9778bac00ce74a) Thanks [@ghostwriternr](https://github.com/ghostwriternr)! - Fix broken build due to bun lockfile not being used
111
+
112
+ ## 0.2.4
113
+
114
+ ### Patch Changes
115
+
116
+ - [#57](https://github.com/cloudflare/sandbox-sdk/pull/57) [`12bbd12`](https://github.com/cloudflare/sandbox-sdk/commit/12bbd1229c07ef8c1c0bf58a4235a27938155b08) Thanks [@ghostwriternr](https://github.com/ghostwriternr)! - Add listFiles method
117
+
118
+ ## 0.2.3
119
+
120
+ ### Patch Changes
121
+
122
+ - [#53](https://github.com/cloudflare/sandbox-sdk/pull/53) [`c87db11`](https://github.com/cloudflare/sandbox-sdk/commit/c87db117693a86cfb667bf09fb7720d6a6e0524d) Thanks [@ghostwriternr](https://github.com/ghostwriternr)! - Improve jupyterlab config to speed up startup
123
+
124
+ ## 0.2.2
125
+
126
+ ### Patch Changes
127
+
128
+ - [#51](https://github.com/cloudflare/sandbox-sdk/pull/51) [`4aceb32`](https://github.com/cloudflare/sandbox-sdk/commit/4aceb3215c836f59afcb88b2b325016b3f623f46) Thanks [@ghostwriternr](https://github.com/ghostwriternr)! - Handle intermittent interpreter failures and decouple jupyter startup
129
+
130
+ ## 0.2.1
131
+
132
+ ### Patch Changes
133
+
134
+ - [#49](https://github.com/cloudflare/sandbox-sdk/pull/49) [`d81d2a5`](https://github.com/cloudflare/sandbox-sdk/commit/d81d2a563c9af8947d5444019ed4d6156db563e3) Thanks [@ghostwriternr](https://github.com/ghostwriternr)! - Implement code interpreter API
135
+
136
+ ## 0.2.0
137
+
138
+ ### Minor Changes
139
+
140
+ - [#47](https://github.com/cloudflare/sandbox-sdk/pull/47) [`8a93d0c`](https://github.com/cloudflare/sandbox-sdk/commit/8a93d0cae18a25bda6506b8b0a08d9e9eb3bb290) Thanks [@ghostwriternr](https://github.com/ghostwriternr)! - Change default directory to a clean /workspace
141
+
142
+ ## 0.1.4
143
+
144
+ ### Patch Changes
145
+
146
+ - [#46](https://github.com/cloudflare/sandbox-sdk/pull/46) [`7de28be`](https://github.com/cloudflare/sandbox-sdk/commit/7de28be482d9634551572d548c7c4b5842df812d) Thanks [@ghostwriternr](https://github.com/ghostwriternr)! - Update README
147
+
148
+ - [#44](https://github.com/cloudflare/sandbox-sdk/pull/44) [`215ab49`](https://github.com/cloudflare/sandbox-sdk/commit/215ab494427d7e2a92bb9a25384cb493a221c200) Thanks [@ghostwriternr](https://github.com/ghostwriternr)! - Update example to use env & cwd
149
+
150
+ - [#42](https://github.com/cloudflare/sandbox-sdk/pull/42) [`bb72193`](https://github.com/cloudflare/sandbox-sdk/commit/bb72193ad75695979bd1132206f481e91fe37325) Thanks [@jonasnobile](https://github.com/jonasnobile)! - Propagate `cwd` and `env` options in `executeCommand`
151
+
152
+ - [#27](https://github.com/cloudflare/sandbox-sdk/pull/27) [`fd5ec7f`](https://github.com/cloudflare/sandbox-sdk/commit/fd5ec7f34bc12b06320a89356c4af07801f52d64) Thanks [@threepointone](https://github.com/threepointone)! - remove yarn and pnpm from the image
153
+
154
+ ## 0.1.3
155
+
156
+ ### Patch Changes
157
+
158
+ - [#32](https://github.com/cloudflare/sandbox-sdk/pull/32) [`1a42464`](https://github.com/cloudflare/sandbox-sdk/commit/1a4246479369c5d0160705caf192aa1816540d52) Thanks [@ghostwriternr](https://github.com/ghostwriternr)! - Bring back package README
159
+
160
+ ## 0.1.2
161
+
162
+ ### Patch Changes
163
+
164
+ - [#30](https://github.com/cloudflare/sandbox-sdk/pull/30) [`30e5c25`](https://github.com/cloudflare/sandbox-sdk/commit/30e5c25cf7d4b07f9049724206c531e2d5d29d5c) Thanks [@ghostwriternr](https://github.com/ghostwriternr)! - Remove actions timeout
165
+
166
+ - [#29](https://github.com/cloudflare/sandbox-sdk/pull/29) [`d78508f`](https://github.com/cloudflare/sandbox-sdk/commit/d78508f7287a59e0423edd2999c2c83e9e34ccfd) Thanks [@ghostwriternr](https://github.com/ghostwriternr)! - Create multi-platform Docker image and switch to Cloudflare official repo
167
+
168
+ ## 0.1.1
169
+
170
+ ### Patch Changes
171
+
172
+ - [`157dde9`](https://github.com/cloudflare/sandbox-sdk/commit/157dde9b1f23e9bb6f3e9c3f0514b639a8813897) Thanks [@threepointone](https://github.com/threepointone)! - update deps
173
+
174
+ - [`a04f6b6`](https://github.com/cloudflare/sandbox-sdk/commit/a04f6b6c0b2ef9e3ce0851b53769f1c10d8c6de6) Thanks [@threepointone](https://github.com/threepointone)! - trigger a build with updated deps
175
+
176
+ ## 0.1.0
177
+
178
+ ### Minor Changes
179
+
180
+ - [#24](https://github.com/cloudflare/sandbox-sdk/pull/24) [`cecde0a`](https://github.com/cloudflare/sandbox-sdk/commit/cecde0a7530a87deffd8562fb8b01d66ee80ee19) Thanks [@ghostwriternr](https://github.com/ghostwriternr)! - Redesign command execution API
181
+
182
+ ### Patch Changes
183
+
184
+ - [#22](https://github.com/cloudflare/sandbox-sdk/pull/22) [`f5fcd52`](https://github.com/cloudflare/sandbox-sdk/commit/f5fcd52025d1f7958a374e69d75e3fc590275f3f) Thanks [@ghostwriternr](https://github.com/ghostwriternr)! - Allow setting env variables dynamically and remove command restrictions
185
+
3
186
  ## 0.0.9
4
187
 
5
188
  ### Patch Changes
package/Dockerfile CHANGED
@@ -1,93 +1,137 @@
1
- # Sandbox base image with development tools, Python, Node.js, and Bun
2
- FROM ubuntu:22.04
1
+ # Sandbox container image with full development environment
2
+ # Multi-stage build optimized for Turborepo monorepo
3
+
4
+ # ============================================================================
5
+ # Stage 1: Prune monorepo to only include necessary packages
6
+ # ============================================================================
7
+ FROM node:20-alpine AS pruner
8
+
9
+ WORKDIR /app
10
+
11
+ # Install Turborepo globally
12
+ RUN npm install -g turbo
13
+
14
+ # Copy entire monorepo
15
+ COPY . .
16
+
17
+ # Prune to only @repo/sandbox-container and its dependencies (@repo/shared)
18
+ # The --docker flag generates out/json and out/full directories
19
+ RUN turbo prune @repo/sandbox-container --docker
20
+
21
+ # ============================================================================
22
+ # Stage 2: Install dependencies and build packages
23
+ # ============================================================================
24
+ FROM node:20-alpine AS builder
25
+
26
+ WORKDIR /app
27
+
28
+ # Copy pruned lockfile and package.json files (for Docker layer caching)
29
+ COPY --from=pruner /app/out/json/ .
30
+ COPY --from=pruner /app/out/package-lock.json ./package-lock.json
31
+
32
+ # Install ALL dependencies (including devDependencies for build)
33
+ RUN npm ci
34
+
35
+ # Copy pruned source code
36
+ COPY --from=pruner /app/out/full/ .
37
+
38
+ # Build all packages (Turborepo handles dependency order automatically)
39
+ # This builds @repo/shared first, then @repo/sandbox-container
40
+ RUN npx turbo run build
41
+
42
+ # ============================================================================
43
+ # Stage 3: Install production-only dependencies
44
+ # ============================================================================
45
+ FROM node:20-alpine AS prod-deps
46
+
47
+ WORKDIR /app
48
+
49
+ # Copy package files from builder
50
+ COPY --from=builder /app/package.json ./package.json
51
+ COPY --from=builder /app/package-lock.json ./package-lock.json
52
+ COPY --from=builder /app/packages ./packages
53
+ COPY --from=builder /app/tooling ./tooling
54
+
55
+ # Install ONLY production dependencies (excludes typescript, @types/*, etc.)
56
+ RUN npm ci --production
57
+
58
+ # ============================================================================
59
+ # Stage 4: Runtime - Ubuntu 22.04 with only runtime dependencies
60
+ # ============================================================================
61
+ FROM ubuntu:22.04 AS runtime
3
62
 
4
63
  # Prevent interactive prompts during package installation
5
64
  ENV DEBIAN_FRONTEND=noninteractive
6
65
 
7
- # Install essential system packages and development tools
8
- RUN apt-get update && apt-get install -y \
9
- # Basic utilities
66
+ # Install essential runtime packages
67
+ RUN apt-get update && apt-get install -y --no-install-recommends \
10
68
  curl \
11
69
  wget \
70
+ ca-certificates \
71
+ python3.11 \
72
+ python3-pip \
73
+ python3.11-venv \
74
+ procps \
12
75
  git \
13
76
  unzip \
14
77
  zip \
15
- # Process management
16
- procps \
17
- htop \
18
- # Build tools
19
- build-essential \
20
- pkg-config \
21
- # Network tools
22
- net-tools \
23
- iputils-ping \
24
- dnsutils \
25
- # Text processing
26
78
  jq \
27
- vim \
28
- nano \
29
- # Python dependencies
30
- python3.11 \
31
- python3.11-dev \
32
- python3-pip \
33
- # Other useful tools
34
- sudo \
35
- ca-certificates \
36
- gnupg \
37
- lsb-release \
79
+ file \
38
80
  && rm -rf /var/lib/apt/lists/*
39
81
 
40
82
  # Set Python 3.11 as default python3
41
83
  RUN update-alternatives --install /usr/bin/python3 python3 /usr/bin/python3.11 1
42
84
 
43
- # Install Node.js 22 LTS
44
- # Using the official NodeSource repository setup script
45
- RUN apt-get update && apt-get install -y ca-certificates curl gnupg \
46
- && mkdir -p /etc/apt/keyrings \
47
- && curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg \
48
- && echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_22.x nodistro main" | tee /etc/apt/sources.list.d/nodesource.list \
49
- && apt-get update \
85
+ # Install Node.js 20 LTS using official NodeSource setup script
86
+ RUN curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
50
87
  && apt-get install -y nodejs \
51
88
  && rm -rf /var/lib/apt/lists/*
52
89
 
53
- # Install Bun using the official installation script
54
- RUN curl -fsSL https://bun.sh/install | bash \
55
- && mv /root/.bun/bin/bun /usr/local/bin/bun \
56
- && mv /root/.bun/bin/bunx /usr/local/bin/bunx \
57
- && rm -rf /root/.bun
90
+ # Install Bun runtime from official image
91
+ COPY --from=oven/bun:1 /usr/local/bin/bun /usr/local/bin/bun
58
92
 
59
- # Install global npm packages as root
60
- RUN npm install -g yarn pnpm
93
+ # Install essential Python packages for code execution
94
+ RUN pip3 install --no-cache-dir \
95
+ matplotlib \
96
+ numpy \
97
+ pandas \
98
+ ipython
61
99
 
62
- # Create a non-root user for running applications
63
- RUN useradd -m -s /bin/bash sandbox \
64
- && echo "sandbox ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers
100
+ # Set up runtime container server directory
101
+ WORKDIR /container-server
65
102
 
66
- # Set up working directory
67
- WORKDIR /app
103
+ # Copy built sandbox-container package
104
+ COPY --from=builder /app/packages/sandbox-container/dist ./dist
105
+ COPY --from=builder /app/packages/sandbox-container/package.json ./package.json
68
106
 
69
- # Set ownership of the app directory to sandbox user
70
- RUN chown -R sandbox:sandbox /app
107
+ # Copy Python executor to runtime location
108
+ COPY --from=builder /app/packages/sandbox-container/src/runtime/executors/python/ipython_executor.py ./dist/runtime/executors/python/
71
109
 
72
- # Set environment variables
73
- ENV PATH="/home/sandbox/.local/bin:${PATH}"
110
+ # Copy production-only node_modules (excludes typescript, @types/*, etc.)
111
+ # Includes: @repo/shared, zod, esbuild (runtime dependencies)
112
+ COPY --from=prod-deps /app/node_modules ./node_modules
74
113
 
75
- # Switch to non-root user
76
- USER sandbox
114
+ # Copy workspace packages
115
+ COPY --from=prod-deps /app/packages/shared/dist ./packages/shared/dist
116
+ COPY --from=prod-deps /app/packages/shared/package.json ./packages/shared/package.json
77
117
 
78
- # Verify installations
79
- RUN python3 --version && \
80
- node --version && \
81
- npm --version && \
82
- bun --version && \
83
- yarn --version && \
84
- pnpm --version
118
+ # Configure process pool sizes (can be overridden at runtime)
119
+ ENV PYTHON_POOL_MIN_SIZE=3
120
+ ENV PYTHON_POOL_MAX_SIZE=15
121
+ ENV JAVASCRIPT_POOL_MIN_SIZE=3
122
+ ENV JAVASCRIPT_POOL_MAX_SIZE=10
123
+ ENV TYPESCRIPT_POOL_MIN_SIZE=3
124
+ ENV TYPESCRIPT_POOL_MAX_SIZE=10
85
125
 
86
- # Copy container source files
87
- COPY --chown=sandbox:sandbox container_src/* ./
126
+ # Create clean workspace directory for user code
127
+ RUN mkdir -p /workspace
88
128
 
89
- # Expose the application port
129
+ # Expose the application port (3000 for control)
90
130
  EXPOSE 3000
91
131
 
92
- # Run the application
93
- CMD ["bun", "index.ts"]
132
+ # Copy and make startup script executable
133
+ COPY packages/sandbox/startup.sh ./
134
+ RUN chmod +x startup.sh
135
+
136
+ # Use startup script
137
+ CMD ["./startup.sh"]
package/README.md CHANGED
@@ -1,65 +1,164 @@
1
- ## @cloudflare/sandbox
1
+ <img width="1362" height="450" alt="Image" src="https://github.com/user-attachments/assets/6f770ae3-0a14-4d2b-9aed-a304ee5446c5" />
2
2
 
3
- > **⚠️ Experimental** - This library is currently experimental and we're actively seeking feedback. Please try it out and let us know what you think!
3
+ # Cloudflare Sandbox SDK
4
4
 
5
- A library to spin up a sandboxed environment.
5
+ [![npm version](https://img.shields.io/npm/v/@cloudflare/sandbox.svg)](https://www.npmjs.com/package/@cloudflare/sandbox)
6
6
 
7
- First, setup your wrangler.json to use the sandbox:
7
+ **Build secure, isolated code execution environments on Cloudflare.**
8
8
 
9
- ```jsonc
10
- {
11
- // ...
12
- "containers": [
13
- {
14
- "class_name": "Sandbox",
15
- "image": "./node_modules/@cloudflare/sandbox/Dockerfile",
16
- "name": "sandbox"
17
- }
18
- ],
19
- "durable_objects": {
20
- "bindings": [
21
- {
22
- "class_name": "Sandbox",
23
- "name": "Sandbox"
24
- }
25
- ]
26
- },
27
- "migrations": [
28
- {
29
- "new_sqlite_classes": ["Sandbox"],
30
- "tag": "v1"
31
- }
32
- ]
33
- }
9
+ The Sandbox SDK lets you run untrusted code safely in isolated containers. Execute commands, manage files, run background processes, and expose services — all from your Workers applications.
10
+
11
+ Perfect for AI code execution, interactive development environments, data analysis platforms, CI/CD systems, and any application that needs secure code execution at the edge.
12
+
13
+ > **Note:** The latest published version of the SDK is on the [v03 branch](https://github.com/cloudflare/sandbox-sdk/tree/v03). This main branch is currently the development version and is not yet published.
14
+
15
+ ## Getting Started
16
+
17
+ ### Prerequisites
18
+
19
+ 1. Install [Node.js](https://docs.npmjs.com/downloading-and-installing-node-js-and-npm) (version 16.17.0 or later)
20
+ 2. Ensure Docker is running locally
21
+ 3. For deploying to production, sign up for a [Cloudflare account](https://dash.cloudflare.com/sign-up/workers-and-pages)
22
+
23
+ ### 1. Create a new project
24
+
25
+ Create a new Sandbox SDK project using the minimal template:
26
+
27
+ ```bash
28
+ npm create cloudflare@latest -- my-sandbox --template=cloudflare/sandbox-sdk/examples/minimal
29
+ cd my-sandbox
30
+ ```
31
+
32
+ ### 2. Test locally
33
+
34
+ Start the development server:
35
+
36
+ ```bash
37
+ npm run dev
34
38
  ```
35
39
 
36
- Then, export the Sandbox class in your worker:
40
+ > **Note:** First run builds the Docker container (2-3 minutes). Subsequent runs are much faster.
41
+
42
+ Test the endpoints:
43
+
44
+ ```bash
45
+ # Execute Python code
46
+ curl http://localhost:8787/run
47
+
48
+ # File operations
49
+ curl http://localhost:8787/file
50
+ ```
51
+
52
+ ### 3. Deploy to production
53
+
54
+ Deploy your Worker and container:
37
55
 
38
- ```ts
39
- export { Sandbox } from "@cloudflare/sandbox";
56
+ ```bash
57
+ npx wrangler deploy
40
58
  ```
41
59
 
42
- You can then use the Sandbox class in your worker:
60
+ > **Wait for provisioning:** After first deployment, wait 2-3 minutes before making requests.
43
61
 
44
- ```ts
45
- import { getSandbox } from "@cloudflare/sandbox";
62
+ **📖 [View the complete getting started guide](https://developers.cloudflare.com/sandbox/get-started/)** for detailed instructions and explanations.
63
+
64
+ ## Quick API Example
65
+
66
+ ```typescript
67
+ import { getSandbox, proxyToSandbox, type Sandbox } from '@cloudflare/sandbox';
68
+
69
+ export { Sandbox } from '@cloudflare/sandbox';
70
+
71
+ type Env = {
72
+ Sandbox: DurableObjectNamespace<Sandbox>;
73
+ };
46
74
 
47
75
  export default {
48
- async fetch(request: Request, env: Env) {
49
- const sandbox = getSandbox(env.Sandbox, "my-sandbox");
50
- return sandbox.exec("ls", ["-la"]);
51
- },
76
+ async fetch(request: Request, env: Env): Promise<Response> {
77
+ // Required for preview URLs
78
+ const proxyResponse = await proxyToSandbox(request, env);
79
+ if (proxyResponse) return proxyResponse;
80
+
81
+ const url = new URL(request.url);
82
+ const sandbox = getSandbox(env.Sandbox, 'my-sandbox');
83
+
84
+ // Execute Python code
85
+ if (url.pathname === '/run') {
86
+ const result = await sandbox.exec('python3 -c "print(2 + 2)"');
87
+ return Response.json({ output: result.stdout, success: result.success });
88
+ }
89
+
90
+ // Work with files
91
+ if (url.pathname === '/file') {
92
+ await sandbox.writeFile('/workspace/hello.txt', 'Hello, Sandbox!');
93
+ const file = await sandbox.readFile('/workspace/hello.txt');
94
+ return Response.json({ content: file.content });
95
+ }
96
+
97
+ return new Response('Try /run or /file');
98
+ }
52
99
  };
53
100
  ```
54
101
 
55
- ### Methods:
56
-
57
- - `exec(command: string, args: string[], options?: { stream?: boolean })`: Execute a command in the sandbox.
58
- - `gitCheckout(repoUrl: string, options: { branch?: string; targetDir?: string; stream?: boolean })`: Checkout a git repository in the sandbox.
59
- - `mkdir(path: string, options: { recursive?: boolean; stream?: boolean })`: Create a directory in the sandbox.
60
- - `writeFile(path: string, content: string, options: { encoding?: string; stream?: boolean })`: Write content to a file in the sandbox.
61
- - `readFile(path: string, options: { encoding?: string; stream?: boolean })`: Read content from a file in the sandbox.
62
- - `deleteFile(path: string, options?: { stream?: boolean })`: Delete a file from the sandbox.
63
- - `renameFile(oldPath: string, newPath: string, options?: { stream?: boolean })`: Rename a file in the sandbox.
64
- - `moveFile(sourcePath: string, destinationPath: string, options?: { stream?: boolean })`: Move a file from one location to another in the sandbox.
65
- - `ping()`: Ping the sandbox.
102
+ ## Documentation
103
+
104
+ **📖 [Full Documentation](https://developers.cloudflare.com/sandbox/)**
105
+
106
+ - [Get Started Guide](https://developers.cloudflare.com/sandbox/get-started/) - Step-by-step tutorial
107
+ - [API Reference](https://developers.cloudflare.com/sandbox/api/) - Complete API docs
108
+ - [Guides](https://developers.cloudflare.com/sandbox/guides/) - Execute commands, manage files, expose services
109
+ - [Examples](https://developers.cloudflare.com/sandbox/tutorials/) - AI agents, data analysis, CI/CD pipelines
110
+
111
+ ## Key Features
112
+
113
+ - **Secure Isolation** - Each sandbox runs in its own container
114
+ - **Edge-Native** - Runs on Cloudflare's global network
115
+ - **Code Interpreter** - Execute Python and JavaScript with rich outputs
116
+ - **File System Access** - Read, write, and manage files
117
+ - **Command Execution** - Run any command with streaming support
118
+ - **Preview URLs** - Expose services with public URLs
119
+ - **Git Integration** - Clone repositories directly
120
+
121
+ ## Development
122
+
123
+ This repository contains the SDK source code. To contribute:
124
+
125
+ ```bash
126
+ # Clone the repo
127
+ git clone https://github.com/cloudflare/sandbox-sdk
128
+ cd sandbox-sdk
129
+
130
+ # Install dependencies
131
+ npm install
132
+
133
+ # Run tests
134
+ npm test
135
+
136
+ # Build the project
137
+ npm run build
138
+
139
+ # Type checking and linting
140
+ npm run check
141
+ ```
142
+
143
+ ## Examples
144
+
145
+ See the [examples directory](./examples) for complete working examples:
146
+
147
+ - [Minimal](./examples/minimal) - Basic sandbox setup
148
+ - [Code Interpreter](./examples/code-interpreter) - Use sandbox as an interpreter tool with gpt-oss
149
+ - [Complete](./examples/basic) - Huge example integrated with every sandbox feature
150
+
151
+ ## Status
152
+
153
+ **Beta** - The SDK is in active development. APIs may change before v1.0.
154
+
155
+ ## License
156
+
157
+ [MIT License](LICENSE)
158
+
159
+ ## Links
160
+
161
+ - [Documentation](https://developers.cloudflare.com/sandbox/)
162
+ - [GitHub Issues](https://github.com/cloudflare/sandbox-sdk/issues)
163
+ - [Developer Discord](https://discord.cloudflare.com)
164
+ - [Cloudflare Developers](https://twitter.com/CloudflareDev)