Sandboxes GA: A Computer Just for Agents

With Cloudflare Sandboxes and Cloudflare Containers reaching GA, AI agents now have something close to a dedicated computer where they can develop and run code. Early partner Figma is also using this in Figma Make to run untrusted agent- and user-authored code.

When Cloudflare first unveiled Sandboxes, the problem it was addressing was clear. Agents need to clone repositories, build in multiple languages, spin up dev servers, and run tests, but existing combinations of VMs or containers alone struggled to cleanly solve all of the following.

• Burstiness: each session needs an independent sandbox, but idle resources must be minimized
• Quick state restoration: fast startup and restart are needed
• Security: authentication must happen without handing over credentials directly
• Control: lifecycle, command execution, and file operations need to be handled programmatically
• Ergonomics: an interface that's easy to use for both humans and agents is needed

Sandboxes is a persistent isolated environment that starts automatically just by specifying a name, sleeps when idle, and wakes back up when a new request comes in. It can be controlled with APIs like exec, gitCheckout, and writeFile, and using the same ID lets you re-access the same sandbox from anywhere in the world.

Recently added features have also expanded to fit agent workflows. Secure credential injection injects credentials via an egress proxy so agents never see raw secrets, and PTY support provides a real terminal connected over WebSocket. Persistent code interpreters carry Python, JavaScript, and TypeScript state over to the next invocation, while background processes and live preview URLs let you spin up dev servers and verify them immediately.

In addition, filesystem watching speeds up iteration through inotify-based change detection, and snapshots save disk state, OS settings, installed dependencies, and modified files and data to quickly restore sessions. Currently, the backup and restore method can also preserve some state, and restoring memory state as well is planned for the future.

Scalability has also increased significantly. On the standard plan, you can run 15,000 lite, 6,000 basic, or 1,000+ larger instances concurrently, and now with Active CPU Pricing, you're only billed for the CPU cycles actually used. As a result, Sandboxes has evolved beyond just a space for executing commands into a real development environment where agents clone repositories, run tests, read failures, and fix code.