@cloudflare/sandbox 0.0.0-f106fda → 0.0.0-f25e9db

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (79) hide show
  1. package/CHANGELOG.md +201 -0
  2. package/Dockerfile +108 -64
  3. package/README.md +147 -50
  4. package/dist/chunk-2P3MDMNJ.js +2367 -0
  5. package/dist/chunk-2P3MDMNJ.js.map +1 -0
  6. package/dist/chunk-BFVUNTP4.js +104 -0
  7. package/dist/chunk-BFVUNTP4.js.map +1 -0
  8. package/dist/chunk-EKSWCBCA.js +86 -0
  9. package/dist/chunk-EKSWCBCA.js.map +1 -0
  10. package/dist/chunk-JXZMAU2C.js +559 -0
  11. package/dist/chunk-JXZMAU2C.js.map +1 -0
  12. package/dist/chunk-Z532A7QC.js +78 -0
  13. package/dist/chunk-Z532A7QC.js.map +1 -0
  14. package/dist/file-stream.d.ts +43 -0
  15. package/dist/file-stream.js +9 -0
  16. package/dist/file-stream.js.map +1 -0
  17. package/dist/index.d.ts +9 -0
  18. package/dist/index.js +66 -0
  19. package/dist/index.js.map +1 -0
  20. package/dist/interpreter.d.ts +33 -0
  21. package/dist/interpreter.js +8 -0
  22. package/dist/interpreter.js.map +1 -0
  23. package/dist/request-handler.d.ts +18 -0
  24. package/dist/request-handler.js +12 -0
  25. package/dist/request-handler.js.map +1 -0
  26. package/dist/sandbox-CZTMzV2R.d.ts +587 -0
  27. package/dist/sandbox.d.ts +4 -0
  28. package/dist/sandbox.js +12 -0
  29. package/dist/sandbox.js.map +1 -0
  30. package/dist/security.d.ts +31 -0
  31. package/dist/security.js +13 -0
  32. package/dist/security.js.map +1 -0
  33. package/dist/sse-parser.d.ts +28 -0
  34. package/dist/sse-parser.js +11 -0
  35. package/dist/sse-parser.js.map +1 -0
  36. package/package.json +13 -9
  37. package/src/clients/base-client.ts +280 -0
  38. package/src/clients/command-client.ts +115 -0
  39. package/src/clients/file-client.ts +269 -0
  40. package/src/clients/git-client.ts +92 -0
  41. package/src/clients/index.ts +63 -0
  42. package/src/clients/interpreter-client.ts +329 -0
  43. package/src/clients/port-client.ts +105 -0
  44. package/src/clients/process-client.ts +177 -0
  45. package/src/clients/sandbox-client.ts +41 -0
  46. package/src/clients/types.ts +84 -0
  47. package/src/clients/utility-client.ts +94 -0
  48. package/src/errors/adapter.ts +180 -0
  49. package/src/errors/classes.ts +469 -0
  50. package/src/errors/index.ts +105 -0
  51. package/src/file-stream.ts +164 -0
  52. package/src/index.ts +87 -8
  53. package/src/interpreter.ts +159 -0
  54. package/src/request-handler.ts +99 -24
  55. package/src/sandbox.ts +805 -121
  56. package/src/security.ts +104 -0
  57. package/src/sse-parser.ts +143 -0
  58. package/startup.sh +3 -0
  59. package/tests/base-client.test.ts +328 -0
  60. package/tests/command-client.test.ts +407 -0
  61. package/tests/file-client.test.ts +643 -0
  62. package/tests/file-stream.test.ts +306 -0
  63. package/tests/git-client.test.ts +328 -0
  64. package/tests/port-client.test.ts +301 -0
  65. package/tests/process-client.test.ts +658 -0
  66. package/tests/sandbox.test.ts +465 -0
  67. package/tests/sse-parser.test.ts +290 -0
  68. package/tests/utility-client.test.ts +266 -0
  69. package/tests/wrangler.jsonc +35 -0
  70. package/tsconfig.json +9 -1
  71. package/vitest.config.ts +31 -0
  72. package/container_src/index.ts +0 -3252
  73. package/container_src/package.json +0 -9
  74. package/src/client.ts +0 -2089
  75. package/tests/client.example.ts +0 -308
  76. package/tests/connection-test.ts +0 -81
  77. package/tests/simple-test.ts +0 -81
  78. package/tests/test1.ts +0 -281
  79. package/tests/test2.ts +0 -929
package/CHANGELOG.md CHANGED
@@ -1,5 +1,206 @@
1
1
  # @cloudflare/sandbox
2
2
 
3
+ ## 0.4.4
4
+
5
+ ### Patch Changes
6
+
7
+ - [#125](https://github.com/cloudflare/sandbox-sdk/pull/125) [`fddccfd`](https://github.com/cloudflare/sandbox-sdk/commit/fddccfdce8204ce2aa7dadc0ad9fb2acbdeaec51) Thanks [@whoiskatrin](https://github.com/whoiskatrin)! - add docker image to pkg workflow
8
+
9
+ ## 0.4.3
10
+
11
+ ### Patch Changes
12
+
13
+ - [#114](https://github.com/cloudflare/sandbox-sdk/pull/114) [`8c1f440`](https://github.com/cloudflare/sandbox-sdk/commit/8c1f440ad6fd89a5c69f9ca9d055ad9b183dd1c3) Thanks [@ghostwriternr](https://github.com/ghostwriternr)! - Debloat base docker image (2.63GB → 1.03GB)
14
+
15
+ ## 0.4.2
16
+
17
+ ### Patch Changes
18
+
19
+ - [`e53d7e7`](https://github.com/cloudflare/sandbox-sdk/commit/e53d7e7ce185f79bdd899029bb532e9651ae7ba5) Thanks [@threepointone](https://github.com/threepointone)! - fix build by inlining repo/shared
20
+
21
+ ## 0.4.1
22
+
23
+ ### Patch Changes
24
+
25
+ - [#111](https://github.com/cloudflare/sandbox-sdk/pull/111) [`1b5496b`](https://github.com/cloudflare/sandbox-sdk/commit/1b5496bfceaee53c31911b409476ea87bebffe4c) Thanks [@threepointone](https://github.com/threepointone)! - trigger a release
26
+
27
+ ## 0.4.0
28
+
29
+ ### Minor Changes
30
+
31
+ - [#95](https://github.com/cloudflare/sandbox-sdk/pull/95) [`7aee736`](https://github.com/cloudflare/sandbox-sdk/commit/7aee736bf07a4bf9020e2109bdaaa70214d52a01) Thanks [@ghostwriternr](https://github.com/ghostwriternr)! - Rewrite SDK with cleaner design patterns and tests. Remove the unnecessary isolation cruft and fix foundational issues with streaming, sessions, validations and error handling. Cover the SDK with unit & e2e tests.
32
+
33
+ ### Patch Changes
34
+
35
+ - [#106](https://github.com/cloudflare/sandbox-sdk/pull/106) [`da947cd`](https://github.com/cloudflare/sandbox-sdk/commit/da947cd9543fc99831eefb1e8741fc905cb8fa42) Thanks [@jahands](https://github.com/jahands)! - fix examples failing to deploy and prevent committing node_modules
36
+
37
+ ## 0.3.3
38
+
39
+ ### Patch Changes
40
+
41
+ - [#83](https://github.com/cloudflare/sandbox-sdk/pull/83) [`eec5bb6`](https://github.com/cloudflare/sandbox-sdk/commit/eec5bb6203dd5d775b4b54e91c26de25eeb767ce) Thanks [@mikenomitch](https://github.com/mikenomitch)! - Bump containers package version
42
+
43
+ ## 0.3.2
44
+
45
+ ### Patch Changes
46
+
47
+ - [#76](https://github.com/cloudflare/sandbox-sdk/pull/76) [`ef9e320`](https://github.com/cloudflare/sandbox-sdk/commit/ef9e320dcef30e57797fef6ebd9a9383fa9720d9) Thanks [@ghostwriternr](https://github.com/ghostwriternr)! - Replace Jupyter with lightweight interpreters for >90% faster cold starts for `.runCode` calls, while maintaining full code execution capabilities and rich output support.
48
+
49
+ ## 0.3.1
50
+
51
+ ### Patch Changes
52
+
53
+ - [#71](https://github.com/cloudflare/sandbox-sdk/pull/71) [`fb3c9c2`](https://github.com/cloudflare/sandbox-sdk/commit/fb3c9c22242d9d4f157c26f547f1e697ef7875f9) Thanks [@ghostwriternr](https://github.com/ghostwriternr)! - Bump containers package version
54
+
55
+ - [#70](https://github.com/cloudflare/sandbox-sdk/pull/70) [`e1fa354`](https://github.com/cloudflare/sandbox-sdk/commit/e1fa354ab1bc7b0e89db4901b67028ebf1a93d0a) Thanks [@ghostwriternr](https://github.com/ghostwriternr)! - Fix escaped quotes in file write operations
56
+
57
+ - [#68](https://github.com/cloudflare/sandbox-sdk/pull/68) [`69b91d1`](https://github.com/cloudflare/sandbox-sdk/commit/69b91d1a8f6afb63262cc381ea93e94a033ed5e8) Thanks [@CyrusNuevoDia](https://github.com/CyrusNuevoDia)! - Configurable timeouts via environment variables in isolation.ts
58
+
59
+ - [#66](https://github.com/cloudflare/sandbox-sdk/pull/66) [`eca93b9`](https://github.com/cloudflare/sandbox-sdk/commit/eca93b97e40fa0d3bd9dc27af2cc214ec355b696) Thanks [@peterp](https://github.com/peterp)! - Determine if the port is specified in the URL.
60
+
61
+ ## 0.3.0
62
+
63
+ ### Minor Changes
64
+
65
+ - [#59](https://github.com/cloudflare/sandbox-sdk/pull/59) [`b6757f7`](https://github.com/cloudflare/sandbox-sdk/commit/b6757f730c34381d5a70d513944bbf9840f598ab) Thanks [@ghostwriternr](https://github.com/ghostwriternr)! - Add process isolation for sandbox commands
66
+
67
+ Implements PID namespace isolation to protect control plane processes (Jupyter, Bun) from sandboxed code. Commands executed via `exec()` now run in isolated namespaces that cannot see or interact with system processes.
68
+
69
+ **Key security improvements:**
70
+
71
+ - Control plane processes are hidden from sandboxed commands
72
+ - Platform secrets in `/proc/1/environ` are inaccessible
73
+ - Ports 8888 (Jupyter) and 3000 (Bun) are protected from hijacking
74
+
75
+ **Breaking changes:**
76
+
77
+ 1. **Removed `sessionId` parameter**: The `sessionId` parameter has been removed from all methods (`exec()`, `execStream()`, `startProcess()`, etc.). Each sandbox now maintains its own persistent session automatically.
78
+
79
+ ```javascript
80
+ // Before: manual session management
81
+ await sandbox.exec("cd /app", { sessionId: "my-session" });
82
+
83
+ // After: automatic session per sandbox
84
+ await sandbox.exec("cd /app");
85
+ ```
86
+
87
+ 2. **Commands now maintain state**: Commands within the same sandbox now share state (working directory, environment variables, background processes). Previously each command was stateless.
88
+
89
+ ```javascript
90
+ // Before: each exec was independent
91
+ await sandbox.exec("cd /app");
92
+ await sandbox.exec("pwd"); // Output: /workspace
93
+
94
+ // After: state persists in session
95
+ await sandbox.exec("cd /app");
96
+ await sandbox.exec("pwd"); // Output: /app
97
+ ```
98
+
99
+ **Migration guide:**
100
+
101
+ - Remove `sessionId` from all method calls - each sandbox maintains its own session
102
+ - If you need isolated execution contexts within the same sandbox, use `sandbox.createSession()`:
103
+ ```javascript
104
+ // Create independent sessions with different environments
105
+ const buildSession = await sandbox.createSession({
106
+ name: "build",
107
+ env: { NODE_ENV: "production" },
108
+ cwd: "/build",
109
+ });
110
+ const testSession = await sandbox.createSession({
111
+ name: "test",
112
+ env: { NODE_ENV: "test" },
113
+ cwd: "/test",
114
+ });
115
+ ```
116
+ - Environment variables set in one command persist to the next
117
+ - Background processes remain active until explicitly killed
118
+ - Requires CAP_SYS_ADMIN (available in production, falls back gracefully in dev)
119
+
120
+ ### Patch Changes
121
+
122
+ - [#62](https://github.com/cloudflare/sandbox-sdk/pull/62) [`4bedc3a`](https://github.com/cloudflare/sandbox-sdk/commit/4bedc3aba347f3d4090a6efe2c9778bac00ce74a) Thanks [@ghostwriternr](https://github.com/ghostwriternr)! - Fix broken build due to bun lockfile not being used
123
+
124
+ ## 0.2.4
125
+
126
+ ### Patch Changes
127
+
128
+ - [#57](https://github.com/cloudflare/sandbox-sdk/pull/57) [`12bbd12`](https://github.com/cloudflare/sandbox-sdk/commit/12bbd1229c07ef8c1c0bf58a4235a27938155b08) Thanks [@ghostwriternr](https://github.com/ghostwriternr)! - Add listFiles method
129
+
130
+ ## 0.2.3
131
+
132
+ ### Patch Changes
133
+
134
+ - [#53](https://github.com/cloudflare/sandbox-sdk/pull/53) [`c87db11`](https://github.com/cloudflare/sandbox-sdk/commit/c87db117693a86cfb667bf09fb7720d6a6e0524d) Thanks [@ghostwriternr](https://github.com/ghostwriternr)! - Improve jupyterlab config to speed up startup
135
+
136
+ ## 0.2.2
137
+
138
+ ### Patch Changes
139
+
140
+ - [#51](https://github.com/cloudflare/sandbox-sdk/pull/51) [`4aceb32`](https://github.com/cloudflare/sandbox-sdk/commit/4aceb3215c836f59afcb88b2b325016b3f623f46) Thanks [@ghostwriternr](https://github.com/ghostwriternr)! - Handle intermittent interpreter failures and decouple jupyter startup
141
+
142
+ ## 0.2.1
143
+
144
+ ### Patch Changes
145
+
146
+ - [#49](https://github.com/cloudflare/sandbox-sdk/pull/49) [`d81d2a5`](https://github.com/cloudflare/sandbox-sdk/commit/d81d2a563c9af8947d5444019ed4d6156db563e3) Thanks [@ghostwriternr](https://github.com/ghostwriternr)! - Implement code interpreter API
147
+
148
+ ## 0.2.0
149
+
150
+ ### Minor Changes
151
+
152
+ - [#47](https://github.com/cloudflare/sandbox-sdk/pull/47) [`8a93d0c`](https://github.com/cloudflare/sandbox-sdk/commit/8a93d0cae18a25bda6506b8b0a08d9e9eb3bb290) Thanks [@ghostwriternr](https://github.com/ghostwriternr)! - Change default directory to a clean /workspace
153
+
154
+ ## 0.1.4
155
+
156
+ ### Patch Changes
157
+
158
+ - [#46](https://github.com/cloudflare/sandbox-sdk/pull/46) [`7de28be`](https://github.com/cloudflare/sandbox-sdk/commit/7de28be482d9634551572d548c7c4b5842df812d) Thanks [@ghostwriternr](https://github.com/ghostwriternr)! - Update README
159
+
160
+ - [#44](https://github.com/cloudflare/sandbox-sdk/pull/44) [`215ab49`](https://github.com/cloudflare/sandbox-sdk/commit/215ab494427d7e2a92bb9a25384cb493a221c200) Thanks [@ghostwriternr](https://github.com/ghostwriternr)! - Update example to use env & cwd
161
+
162
+ - [#42](https://github.com/cloudflare/sandbox-sdk/pull/42) [`bb72193`](https://github.com/cloudflare/sandbox-sdk/commit/bb72193ad75695979bd1132206f481e91fe37325) Thanks [@jonasnobile](https://github.com/jonasnobile)! - Propagate `cwd` and `env` options in `executeCommand`
163
+
164
+ - [#27](https://github.com/cloudflare/sandbox-sdk/pull/27) [`fd5ec7f`](https://github.com/cloudflare/sandbox-sdk/commit/fd5ec7f34bc12b06320a89356c4af07801f52d64) Thanks [@threepointone](https://github.com/threepointone)! - remove yarn and pnpm from the image
165
+
166
+ ## 0.1.3
167
+
168
+ ### Patch Changes
169
+
170
+ - [#32](https://github.com/cloudflare/sandbox-sdk/pull/32) [`1a42464`](https://github.com/cloudflare/sandbox-sdk/commit/1a4246479369c5d0160705caf192aa1816540d52) Thanks [@ghostwriternr](https://github.com/ghostwriternr)! - Bring back package README
171
+
172
+ ## 0.1.2
173
+
174
+ ### Patch Changes
175
+
176
+ - [#30](https://github.com/cloudflare/sandbox-sdk/pull/30) [`30e5c25`](https://github.com/cloudflare/sandbox-sdk/commit/30e5c25cf7d4b07f9049724206c531e2d5d29d5c) Thanks [@ghostwriternr](https://github.com/ghostwriternr)! - Remove actions timeout
177
+
178
+ - [#29](https://github.com/cloudflare/sandbox-sdk/pull/29) [`d78508f`](https://github.com/cloudflare/sandbox-sdk/commit/d78508f7287a59e0423edd2999c2c83e9e34ccfd) Thanks [@ghostwriternr](https://github.com/ghostwriternr)! - Create multi-platform Docker image and switch to Cloudflare official repo
179
+
180
+ ## 0.1.1
181
+
182
+ ### Patch Changes
183
+
184
+ - [`157dde9`](https://github.com/cloudflare/sandbox-sdk/commit/157dde9b1f23e9bb6f3e9c3f0514b639a8813897) Thanks [@threepointone](https://github.com/threepointone)! - update deps
185
+
186
+ - [`a04f6b6`](https://github.com/cloudflare/sandbox-sdk/commit/a04f6b6c0b2ef9e3ce0851b53769f1c10d8c6de6) Thanks [@threepointone](https://github.com/threepointone)! - trigger a build with updated deps
187
+
188
+ ## 0.1.0
189
+
190
+ ### Minor Changes
191
+
192
+ - [#24](https://github.com/cloudflare/sandbox-sdk/pull/24) [`cecde0a`](https://github.com/cloudflare/sandbox-sdk/commit/cecde0a7530a87deffd8562fb8b01d66ee80ee19) Thanks [@ghostwriternr](https://github.com/ghostwriternr)! - Redesign command execution API
193
+
194
+ ### Patch Changes
195
+
196
+ - [#22](https://github.com/cloudflare/sandbox-sdk/pull/22) [`f5fcd52`](https://github.com/cloudflare/sandbox-sdk/commit/f5fcd52025d1f7958a374e69d75e3fc590275f3f) Thanks [@ghostwriternr](https://github.com/ghostwriternr)! - Allow setting env variables dynamically and remove command restrictions
197
+
198
+ ## 0.0.9
199
+
200
+ ### Patch Changes
201
+
202
+ - [#20](https://github.com/cloudflare/sandbox-sdk/pull/20) [`f106fda`](https://github.com/cloudflare/sandbox-sdk/commit/f106fdac98e7ef35677326290d45cbf3af88982c) Thanks [@ghostwriternr](https://github.com/ghostwriternr)! - add preview URLs and dynamic port forwarding
203
+
3
204
  ## 0.0.8
4
205
 
5
206
  ### Patch Changes
package/Dockerfile CHANGED
@@ -1,93 +1,137 @@
1
- # Sandbox base image with development tools, Python, Node.js, and Bun
2
- FROM ubuntu:22.04
1
+ # Sandbox container image with full development environment
2
+ # Multi-stage build optimized for Turborepo monorepo
3
+
4
+ # ============================================================================
5
+ # Stage 1: Prune monorepo to only include necessary packages
6
+ # ============================================================================
7
+ FROM node:20-alpine AS pruner
8
+
9
+ WORKDIR /app
10
+
11
+ # Install Turborepo globally
12
+ RUN npm install -g turbo
13
+
14
+ # Copy entire monorepo
15
+ COPY . .
16
+
17
+ # Prune to only @repo/sandbox-container and its dependencies (@repo/shared)
18
+ # The --docker flag generates out/json and out/full directories
19
+ RUN turbo prune @repo/sandbox-container --docker
20
+
21
+ # ============================================================================
22
+ # Stage 2: Install dependencies and build packages
23
+ # ============================================================================
24
+ FROM node:20-alpine AS builder
25
+
26
+ WORKDIR /app
27
+
28
+ # Copy pruned lockfile and package.json files (for Docker layer caching)
29
+ COPY --from=pruner /app/out/json/ .
30
+ COPY --from=pruner /app/out/package-lock.json ./package-lock.json
31
+
32
+ # Install ALL dependencies (including devDependencies for build)
33
+ RUN npm ci
34
+
35
+ # Copy pruned source code
36
+ COPY --from=pruner /app/out/full/ .
37
+
38
+ # Build all packages (Turborepo handles dependency order automatically)
39
+ # This builds @repo/shared first, then @repo/sandbox-container
40
+ RUN npx turbo run build
41
+
42
+ # ============================================================================
43
+ # Stage 3: Install production-only dependencies
44
+ # ============================================================================
45
+ FROM node:20-alpine AS prod-deps
46
+
47
+ WORKDIR /app
48
+
49
+ # Copy package files from builder
50
+ COPY --from=builder /app/package.json ./package.json
51
+ COPY --from=builder /app/package-lock.json ./package-lock.json
52
+ COPY --from=builder /app/packages ./packages
53
+ COPY --from=builder /app/tooling ./tooling
54
+
55
+ # Install ONLY production dependencies (excludes typescript, @types/*, etc.)
56
+ RUN npm ci --production
57
+
58
+ # ============================================================================
59
+ # Stage 4: Runtime - Ubuntu 22.04 with only runtime dependencies
60
+ # ============================================================================
61
+ FROM ubuntu:22.04 AS runtime
3
62
 
4
63
  # Prevent interactive prompts during package installation
5
64
  ENV DEBIAN_FRONTEND=noninteractive
6
65
 
7
- # Install essential system packages and development tools
8
- RUN apt-get update && apt-get install -y \
9
- # Basic utilities
66
+ # Install essential runtime packages
67
+ RUN apt-get update && apt-get install -y --no-install-recommends \
10
68
  curl \
11
69
  wget \
70
+ ca-certificates \
71
+ python3.11 \
72
+ python3-pip \
73
+ python3.11-venv \
74
+ procps \
12
75
  git \
13
76
  unzip \
14
77
  zip \
15
- # Process management
16
- procps \
17
- htop \
18
- # Build tools
19
- build-essential \
20
- pkg-config \
21
- # Network tools
22
- net-tools \
23
- iputils-ping \
24
- dnsutils \
25
- # Text processing
26
78
  jq \
27
- vim \
28
- nano \
29
- # Python dependencies
30
- python3.11 \
31
- python3.11-dev \
32
- python3-pip \
33
- # Other useful tools
34
- sudo \
35
- ca-certificates \
36
- gnupg \
37
- lsb-release \
79
+ file \
38
80
  && rm -rf /var/lib/apt/lists/*
39
81
 
40
82
  # Set Python 3.11 as default python3
41
83
  RUN update-alternatives --install /usr/bin/python3 python3 /usr/bin/python3.11 1
42
84
 
43
- # Install Node.js 22 LTS
44
- # Using the official NodeSource repository setup script
45
- RUN apt-get update && apt-get install -y ca-certificates curl gnupg \
46
- && mkdir -p /etc/apt/keyrings \
47
- && curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | gpg --dearmor -o /etc/apt/keyrings/nodesource.gpg \
48
- && echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_22.x nodistro main" | tee /etc/apt/sources.list.d/nodesource.list \
49
- && apt-get update \
85
+ # Install Node.js 20 LTS using official NodeSource setup script
86
+ RUN curl -fsSL https://deb.nodesource.com/setup_20.x | bash - \
50
87
  && apt-get install -y nodejs \
51
88
  && rm -rf /var/lib/apt/lists/*
52
89
 
53
- # Install Bun using the official installation script
54
- RUN curl -fsSL https://bun.sh/install | bash \
55
- && mv /root/.bun/bin/bun /usr/local/bin/bun \
56
- && mv /root/.bun/bin/bunx /usr/local/bin/bunx \
57
- && rm -rf /root/.bun
90
+ # Install Bun runtime from official image
91
+ COPY --from=oven/bun:1 /usr/local/bin/bun /usr/local/bin/bun
58
92
 
59
- # Install global npm packages as root
60
- RUN npm install -g yarn pnpm
93
+ # Install essential Python packages for code execution
94
+ RUN pip3 install --no-cache-dir \
95
+ matplotlib \
96
+ numpy \
97
+ pandas \
98
+ ipython
61
99
 
62
- # Create a non-root user for running applications
63
- RUN useradd -m -s /bin/bash sandbox \
64
- && echo "sandbox ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers
100
+ # Set up runtime container server directory
101
+ WORKDIR /container-server
65
102
 
66
- # Set up working directory
67
- WORKDIR /app
103
+ # Copy built sandbox-container package
104
+ COPY --from=builder /app/packages/sandbox-container/dist ./dist
105
+ COPY --from=builder /app/packages/sandbox-container/package.json ./package.json
68
106
 
69
- # Set ownership of the app directory to sandbox user
70
- RUN chown -R sandbox:sandbox /app
107
+ # Copy Python executor to runtime location
108
+ COPY --from=builder /app/packages/sandbox-container/src/runtime/executors/python/ipython_executor.py ./dist/runtime/executors/python/
71
109
 
72
- # Set environment variables
73
- ENV PATH="/home/sandbox/.local/bin:${PATH}"
110
+ # Copy production-only node_modules (excludes typescript, @types/*, etc.)
111
+ # Includes: @repo/shared, zod, esbuild (runtime dependencies)
112
+ COPY --from=prod-deps /app/node_modules ./node_modules
74
113
 
75
- # Switch to non-root user
76
- USER sandbox
114
+ # Copy workspace packages
115
+ COPY --from=prod-deps /app/packages/shared/dist ./packages/shared/dist
116
+ COPY --from=prod-deps /app/packages/shared/package.json ./packages/shared/package.json
77
117
 
78
- # Verify installations
79
- RUN python3 --version && \
80
- node --version && \
81
- npm --version && \
82
- bun --version && \
83
- yarn --version && \
84
- pnpm --version
118
+ # Configure process pool sizes (can be overridden at runtime)
119
+ ENV PYTHON_POOL_MIN_SIZE=3
120
+ ENV PYTHON_POOL_MAX_SIZE=15
121
+ ENV JAVASCRIPT_POOL_MIN_SIZE=3
122
+ ENV JAVASCRIPT_POOL_MAX_SIZE=10
123
+ ENV TYPESCRIPT_POOL_MIN_SIZE=3
124
+ ENV TYPESCRIPT_POOL_MAX_SIZE=10
85
125
 
86
- # Copy container source files
87
- COPY --chown=sandbox:sandbox container_src/* ./
126
+ # Create clean workspace directory for user code
127
+ RUN mkdir -p /workspace
88
128
 
89
- # Expose the application port
129
+ # Expose the application port (3000 for control)
90
130
  EXPOSE 3000
91
131
 
92
- # Run the application
93
- CMD ["bun", "index.ts"]
132
+ # Copy and make startup script executable
133
+ COPY packages/sandbox/startup.sh ./
134
+ RUN chmod +x startup.sh
135
+
136
+ # Use startup script
137
+ CMD ["./startup.sh"]
package/README.md CHANGED
@@ -1,65 +1,162 @@
1
- ## @cloudflare/sandbox
1
+ <img width="1362" height="450" alt="Image" src="https://github.com/user-attachments/assets/6f770ae3-0a14-4d2b-9aed-a304ee5446c5" />
2
2
 
3
- > **⚠️ Experimental** - This library is currently experimental and we're actively seeking feedback. Please try it out and let us know what you think!
3
+ # Cloudflare Sandbox SDK
4
4
 
5
- A library to spin up a sandboxed environment.
5
+ [![npm version](https://img.shields.io/npm/v/@cloudflare/sandbox.svg)](https://www.npmjs.com/package/@cloudflare/sandbox)
6
6
 
7
- First, setup your wrangler.json to use the sandbox:
7
+ **Build secure, isolated code execution environments on Cloudflare.**
8
8
 
9
- ```jsonc
10
- {
11
- // ...
12
- "containers": [
13
- {
14
- "class_name": "Sandbox",
15
- "image": "./node_modules/@cloudflare/sandbox/Dockerfile",
16
- "name": "sandbox"
17
- }
18
- ],
19
- "durable_objects": {
20
- "bindings": [
21
- {
22
- "class_name": "Sandbox",
23
- "name": "Sandbox"
24
- }
25
- ]
26
- },
27
- "migrations": [
28
- {
29
- "new_sqlite_classes": ["Sandbox"],
30
- "tag": "v1"
31
- }
32
- ]
33
- }
9
+ The Sandbox SDK lets you run untrusted code safely in isolated containers. Execute commands, manage files, run background processes, and expose services — all from your Workers applications.
10
+
11
+ Perfect for AI code execution, interactive development environments, data analysis platforms, CI/CD systems, and any application that needs secure code execution at the edge.
12
+
13
+ ## Getting Started
14
+
15
+ ### Prerequisites
16
+
17
+ 1. Install [Node.js](https://docs.npmjs.com/downloading-and-installing-node-js-and-npm) (version 16.17.0 or later)
18
+ 2. Ensure Docker is running locally
19
+ 3. For deploying to production, sign up for a [Cloudflare account](https://dash.cloudflare.com/sign-up/workers-and-pages)
20
+
21
+ ### 1. Create a new project
22
+
23
+ Create a new Sandbox SDK project using the minimal template:
24
+
25
+ ```bash
26
+ npm create cloudflare@latest -- my-sandbox --template=cloudflare/sandbox-sdk/examples/minimal
27
+ cd my-sandbox
28
+ ```
29
+
30
+ ### 2. Test locally
31
+
32
+ Start the development server:
33
+
34
+ ```bash
35
+ npm run dev
34
36
  ```
35
37
 
36
- Then, export the Sandbox class in your worker:
38
+ > **Note:** First run builds the Docker container (2-3 minutes). Subsequent runs are much faster.
37
39
 
38
- ```ts
39
- export { Sandbox } from "@cloudflare/sandbox";
40
+ Test the endpoints:
41
+
42
+ ```bash
43
+ # Execute Python code
44
+ curl http://localhost:8787/run
45
+
46
+ # File operations
47
+ curl http://localhost:8787/file
40
48
  ```
41
49
 
42
- You can then use the Sandbox class in your worker:
50
+ ### 3. Deploy to production
51
+
52
+ Deploy your Worker and container:
53
+
54
+ ```bash
55
+ npx wrangler deploy
56
+ ```
57
+
58
+ > **Wait for provisioning:** After first deployment, wait 2-3 minutes before making requests.
59
+
60
+ **📖 [View the complete getting started guide](https://developers.cloudflare.com/sandbox/get-started/)** for detailed instructions and explanations.
43
61
 
44
- ```ts
45
- import { getSandbox } from "@cloudflare/sandbox";
62
+ ## Quick API Example
63
+
64
+ ```typescript
65
+ import { getSandbox, proxyToSandbox, type Sandbox } from '@cloudflare/sandbox';
66
+
67
+ export { Sandbox } from '@cloudflare/sandbox';
68
+
69
+ type Env = {
70
+ Sandbox: DurableObjectNamespace<Sandbox>;
71
+ };
46
72
 
47
73
  export default {
48
- async fetch(request: Request, env: Env) {
49
- const sandbox = getSandbox(env.Sandbox, "my-sandbox");
50
- return sandbox.exec("ls", ["-la"]);
51
- },
74
+ async fetch(request: Request, env: Env): Promise<Response> {
75
+ // Required for preview URLs
76
+ const proxyResponse = await proxyToSandbox(request, env);
77
+ if (proxyResponse) return proxyResponse;
78
+
79
+ const url = new URL(request.url);
80
+ const sandbox = getSandbox(env.Sandbox, 'my-sandbox');
81
+
82
+ // Execute Python code
83
+ if (url.pathname === '/run') {
84
+ const result = await sandbox.exec('python3 -c "print(2 + 2)"');
85
+ return Response.json({ output: result.stdout, success: result.success });
86
+ }
87
+
88
+ // Work with files
89
+ if (url.pathname === '/file') {
90
+ await sandbox.writeFile('/workspace/hello.txt', 'Hello, Sandbox!');
91
+ const file = await sandbox.readFile('/workspace/hello.txt');
92
+ return Response.json({ content: file.content });
93
+ }
94
+
95
+ return new Response('Try /run or /file');
96
+ }
52
97
  };
53
98
  ```
54
99
 
55
- ### Methods:
56
-
57
- - `exec(command: string, args: string[], options?: { stream?: boolean })`: Execute a command in the sandbox.
58
- - `gitCheckout(repoUrl: string, options: { branch?: string; targetDir?: string; stream?: boolean })`: Checkout a git repository in the sandbox.
59
- - `mkdir(path: string, options: { recursive?: boolean; stream?: boolean })`: Create a directory in the sandbox.
60
- - `writeFile(path: string, content: string, options: { encoding?: string; stream?: boolean })`: Write content to a file in the sandbox.
61
- - `readFile(path: string, options: { encoding?: string; stream?: boolean })`: Read content from a file in the sandbox.
62
- - `deleteFile(path: string, options?: { stream?: boolean })`: Delete a file from the sandbox.
63
- - `renameFile(oldPath: string, newPath: string, options?: { stream?: boolean })`: Rename a file in the sandbox.
64
- - `moveFile(sourcePath: string, destinationPath: string, options?: { stream?: boolean })`: Move a file from one location to another in the sandbox.
65
- - `ping()`: Ping the sandbox.
100
+ ## Documentation
101
+
102
+ **📖 [Full Documentation](https://developers.cloudflare.com/sandbox/)**
103
+
104
+ - [Get Started Guide](https://developers.cloudflare.com/sandbox/get-started/) - Step-by-step tutorial
105
+ - [API Reference](https://developers.cloudflare.com/sandbox/api/) - Complete API docs
106
+ - [Guides](https://developers.cloudflare.com/sandbox/guides/) - Execute commands, manage files, expose services
107
+ - [Examples](https://developers.cloudflare.com/sandbox/tutorials/) - AI agents, data analysis, CI/CD pipelines
108
+
109
+ ## Key Features
110
+
111
+ - **Secure Isolation** - Each sandbox runs in its own container
112
+ - **Edge-Native** - Runs on Cloudflare's global network
113
+ - **Code Interpreter** - Execute Python and JavaScript with rich outputs
114
+ - **File System Access** - Read, write, and manage files
115
+ - **Command Execution** - Run any command with streaming support
116
+ - **Preview URLs** - Expose services with public URLs
117
+ - **Git Integration** - Clone repositories directly
118
+
119
+ ## Development
120
+
121
+ This repository contains the SDK source code. To contribute:
122
+
123
+ ```bash
124
+ # Clone the repo
125
+ git clone https://github.com/cloudflare/sandbox-sdk
126
+ cd sandbox-sdk
127
+
128
+ # Install dependencies
129
+ npm install
130
+
131
+ # Run tests
132
+ npm test
133
+
134
+ # Build the project
135
+ npm run build
136
+
137
+ # Type checking and linting
138
+ npm run check
139
+ ```
140
+
141
+ ## Examples
142
+
143
+ See the [examples directory](./examples) for complete working examples:
144
+
145
+ - [Minimal](./examples/minimal) - Basic sandbox setup
146
+ - [Code Interpreter](./examples/code-interpreter) - Use sandbox as an interpreter tool with gpt-oss
147
+ - [Complete](./examples/basic) - Huge example integrated with every sandbox feature
148
+
149
+ ## Status
150
+
151
+ **Beta** - The SDK is in active development. APIs may change before v1.0.
152
+
153
+ ## License
154
+
155
+ [MIT License](LICENSE)
156
+
157
+ ## Links
158
+
159
+ - [Documentation](https://developers.cloudflare.com/sandbox/)
160
+ - [GitHub Issues](https://github.com/cloudflare/sandbox-sdk/issues)
161
+ - [Developer Discord](https://discord.cloudflare.com)
162
+ - [Cloudflare Developers](https://twitter.com/CloudflareDev)