# Cloudflare Sandbox

> A Worker that starts a Firecracker microVM, with no public port, no region pinning, and a disk that is wiped when the instance stops.

Website: https://developers.cloudflare.com/sandbox/  
Guide page: https://botperch.com/providers/cloudflare-sandbox/  
Checked: 2026-10-28

**Short answer:** One always-on personal agent (2 vCPU / 4 GiB / 20 GiB) costs about $99.41 a month here, with a catch: A stopped instance loses its disk; files have to be backed up to R2 or a snapshot and restored. The AI model adds about $14.70 a month on top (GLM 5.3, 30 requests a day at 40k tokens each, median zero-retention price; from $6.84 at the cheapest host). Fits well: A Worker that already holds the credentials and decides what the code can reach: the sandbox never gets a public port.

Cloudflare Sandboxes are a feature of the Workers platform: you write a Worker, its Durable Object starts a Linux container on Cloudflare's network, and that container runs untrusted or generated code with its own kernel.
There is no separate sandbox service to sign up for and no sandbox console. Identity is a Durable Object name, compute is a container instance, and persistence is a snapshot you take yourself or a bucket you mount.
A second, lighter environment called Dynamic Workers runs JavaScript, Python or WebAssembly inside the Workers runtime when the code only needs to call methods you pass in.

**Who it is for:** Teams already running a Worker who want untrusted code execution next to their application, with the Worker holding the credentials and deciding reachability.

**Isolation:** A Firecracker microVM per container, with its own kernel and network. Your image runs as a Linux container inside it, and every process has root capabilities, so there is no privilege boundary between users inside one sandbox. No memory snapshot, no pause, no fork. Docker-in-Docker works with iptables and IP forwarding off; linux/amd64 only.

**Sizes and regions:** Six presets from lite (1/16 vCPU, 256 MiB, 2 GB) to standard-4 (4 vCPU, 12 GiB, 20 GB). Custom sizes are capped at 4 vCPU / 12 GiB / 20 GB, with at least 3 GiB of memory per vCPU. No GPU and no ARM. Placement is chosen by Cloudflare near the request, and a sandbox cannot be pinned to a region.

## How it charges

- model: Per-10-millisecond Containers usage on the account's Workers Paid bill, plus Workers, Durable Objects, egress, R2 and optionally Logs.
- meter: Active CPU $0.072 per vCPU-hour, provisioned memory $0.009 per GiB-hour and provisioned disk $0.000252 per GB-hour while the instance runs. Egress is $0.025 per GB in North America and Europe.
- stopped: Nothing. A stopped instance is not billed, and its disk and processes are gone.
- planFee: Workers Paid has a $5 a month minimum for the account. There is no sandbox-specific plan or fee.
- minimum: No free tier for containers: the Free column is N/A for memory, CPU and disk. The plan includes about $0.73 of container usage a month.

Per 10 ms on the Workers Paid bill: CPU only while working, memory and disk for as long as the instance runs.
- Egress is $0.025 per GB in North America and Europe and is not included.
- Workers, Durable Objects and R2 usage are billed separately.

## Monthly cost for each preset workload

- A personal agent that stays on (Hermes, OpenClaw): $99.41 (catch: A stopped instance loses its disk; files have to be backed up to R2 or a snapshot and restored.)
- A coding agent for one developer: $24.20 (catch: No size with 4 vCPU allows 40 GiB of disk; the most is 20 GiB on standard-4. A stopped instance loses its disk; files have to be backed up to R2 or a snapshot and restored.)
- A code interpreter inside your product: $37.78
- A browser agent for a small team: $406.03
- Self-hosted n8n for a small team: $98.99 (catch: A stopped instance loses its disk; files have to be backed up to R2 or a snapshot and restored.)
- A Discord or Slack bot for one server: $47.48 (catch: A stopped instance loses its disk; files have to be backed up to R2 or a snapshot and restored.)
- Claude Code for a team of five: $102.54 (catch: No size with 4 vCPU allows 40 GiB of disk; the most is 20 GiB on standard-4. A stopped instance loses its disk; files have to be backed up to R2 or a snapshot and restored.)
- A scraper that runs four times a day: $5.99
- Your own remote MCP server: $46.95 (catch: A stopped instance loses its disk; files have to be backed up to R2 or a snapshot and restored.)
- A: 1,000 short tasks: $28.95
- B: one always-on box: $107.82 (catch: No size with 4 vCPU allows 50 GiB of disk; the most is 20 GiB on standard-4. A stopped instance loses its disk; files have to be backed up to R2 or a snapshot and restored.)
- C: three hours a day: $17.04 (catch: A stopped instance loses its disk; files have to be backed up to R2 or a snapshot and restored.)

## Fits well

- A Worker that already holds the credentials and decides what the code can reach: the sandbox never gets a public port.
- One microVM per user or per job, with no shared kernel, at a per-second price that reaches zero when it stops.
- A team already on Cloudflare: one account, one bill, Workers and Durable Objects alongside.
- A JavaScript or Python snippet that does not need a container at all: a Dynamic Worker starts faster.

## Fits badly

- A long job with no inbound requests: code inside does not count as activity, so a two-hour build dies at the timeout.
- Any workload needing more than 4 vCPU, 12 GiB or 20 GB, or a GPU.
- EU data residency: a sandbox cannot be pinned to a region.
- An agent that expects a pause or a resumable machine: stopping deletes the disk and every process.

## Features

- **Isolation** (yes): Firecracker; all root. One Firecracker microVM per container with its own kernel and network; the image runs as a Linux container inside it. Every process has root capabilities, so there is no privilege boundary between users. No memory snapshot, pause or fork. [source](https://developers.cloudflare.com/containers/concepts/architecture/) [docs](https://developers.cloudflare.com/containers/concepts/architecture/)
- **Sizes and regions** (partly): 4 vCPU / 12 GiB / 20 GB. Six presets from lite to standard-4; custom sizes are capped at 4 vCPU / 12 GiB / 20 GB with at least 3 GiB of memory per vCPU. No GPU, linux/amd64 only, and placement is chosen by Cloudflare near the request. [source](https://developers.cloudflare.com/containers/platform/limits/) [docs](https://developers.cloudflare.com/containers/platform/limits/)
- **Lifecycle** (no): No pause; stop wipes disk. The instance runs only until something stops it; its processes and the files on its disk end with it. A snapshot carries files into a new instance, not memory. There is no paused state. [source](https://developers.cloudflare.com/sandbox/concepts/lifetime/) [docs](https://developers.cloudflare.com/sandbox/concepts/lifetime/)
- **Snapshots and forks** (partly): Filesystem only; 30 days. snapshotContainer() saves the writable root filesystem of a running instance, 20 GB maximum, and expires 30 days after creation or last restore. No memory and no fork. Directory backups to R2 have no expiry. [source](https://developers.cloudflare.com/sandbox/concepts/lifetime/) [docs](https://developers.cloudflare.com/sandbox/files/save-and-restore-a-workspace/)
- **Storage** (partly): 20 GB; wiped on stop. 20 GB maximum disk, deleted when the instance stops. A snapshot keeps the root filesystem for 30 days; an R2 directory backup or S3/R2 mount outlives every instance. [source](https://developers.cloudflare.com/sandbox/files/) [docs](https://developers.cloudflare.com/sandbox/files/)
- **Idle and waking** (partly): No default; 6 h max. No default inactivity timeout in Sandboxes 1.0, a 6-hour maximum, and the value is lost on a Durable Object restart. Code inside does not count as activity. The 10-minute default belongs to the legacy 0.x SDK. [source](https://developers.cloudflare.com/sandbox/concepts/lifetime/) [docs](https://developers.cloudflare.com/sandbox/concepts/lifetime/#activity-keeps-an-instance-running)
- **Reaching it** (partly): No public port. HTTP from the internet reaches the instance only through your Worker. No built-in preview auth, token or IP allowlist. SSH exists only through Wrangler, does not start a stopped container and does not keep one alive. [source](https://developers.cloudflare.com/sandbox/previews/) [docs](https://developers.cloudflare.com/sandbox/previews/)
- **Custom domains** (partly): Worker route + DNS. Not a sandbox feature: a wildcard DNS record and a Worker route send every preview hostname to your Worker. TLS and authentication are yours. [source](https://developers.cloudflare.com/sandbox/previews/serve-previews-on-their-own-hostnames/) [docs](https://developers.cloudflare.com/sandbox/previews/serve-previews-on-their-own-hostnames/)
- **Outbound network** (partly): 1 TB a month, then $0.025/GB. Off by default; only ports 80 and 443 through allowedHosts or an outbound handler. No static egress IP or private network. 1 TB a month is included in North America and Europe, then $0.025/GB; 500 GB elsewhere, then $0.04–$0.05. [source](https://developers.cloudflare.com/sandbox/concepts/security/) [docs](https://developers.cloudflare.com/containers/configuration/outbound-traffic/)
- **Keys and secrets** (yes): No, Worker injects. The credential stays in the Worker and is added by an outbound handler after the request leaves. Add it only to HTTPS. Once a value is in the sandbox, all code there can read it and send it anywhere. [source](https://developers.cloudflare.com/sandbox/concepts/security/) [docs](https://developers.cloudflare.com/sandbox/network/)
- **Ways to drive it** (partly): No; Worker code. TypeScript in a Worker is the only first-class surface, with a Durable Object container API and the Wrangler CLI. No hosted REST API, no Python or Go SDK, no control-plane MCP and no webhooks. [source](https://developers.cloudflare.com/sandbox/previews/) [docs](https://developers.cloudflare.com/sandbox/reference/)
- **Built-in agents** (partly): None; guides. No preinstalled agents in the 1.0 images. Guides cover Claude Code, Codex, OpenCode and Pi, plus templates where the vendor's loop runs in its own service. The Agents SDK exposes a sandbox tool. [source](https://developers.cloudflare.com/sandbox/coding-agents/claude-code/) [docs](https://developers.cloudflare.com/sandbox/coding-agents/)
- **Teams and accounts** (partly): Alerts only. Budget alerts are informational and do not cap usage. Concurrency is account-wide: 1,500 vCPU, 6 TiB and 30 TB. No per-sandbox IAM; the account audit log records control-plane actions only. [source](https://developers.cloudflare.com/billing/manage/budget-alerts/) [docs](https://developers.cloudflare.com/fundamentals/manage-members/)
- **Billing models** (partly): $0.072/vCPU-hour active. Per 10 ms while running: active CPU $0.072/vCPU-hour, provisioned memory $0.009/GiB-hour and provisioned disk $0.000252/GB-hour. A stopped instance bills nothing. [source](https://developers.cloudflare.com/containers/platform/pricing/) [docs](https://developers.cloudflare.com/containers/platform/pricing/)
- **Trials and free tiers** (no): None; $5 plan. No free tier for containers; the Free column is N/A. Workers Paid has a $5 monthly minimum and includes 25 GiB-hours, 375 vCPU-minutes and 200 GB-hours of container usage. [source](https://developers.cloudflare.com/sandbox/) [docs](https://developers.cloudflare.com/workers/platform/pricing/)
- **The company** (partly): Cloudflare, Inc.; no sandbox SLA. Cloudflare, Inc., Delaware, incorporated July 2009, NYSE: NET, 5,156 staff. The Workers SLA covers Workers only; no sandbox SLA. SOC 2 Type II and ISO 27001 are company-wide, with no published scope for Containers or Sandboxes. [source](https://www.cloudflare.com/workers-service-level-agreement/)

## Capabilities

- Its own virtual machine: yes (Firecracker microVM) [source](https://developers.cloudflare.com/containers/concepts/architecture/)
- Root access: yes (every process is root) [source](https://developers.cloudflare.com/sandbox/concepts/security/)
- Docker inside: partly (docker:dind, no iptables). Docker works through a special image, but the firewall tool Docker normally uses is turned off, so container networking is limited. [source](https://developers.cloudflare.com/containers/faq/)
- Nested virtualisation: not-published [source](https://developers.cloudflare.com/containers/platform/limits/)
- Your own image: yes (your own Dockerfile) [source](https://developers.cloudflare.com/workers/wrangler/configuration/)
- Any size you like: partly (custom within 4 cores / 12 GiB). You can set your own cores and memory, but only inside a ceiling of 4 cores and 12 GB, and each core needs at least 3 GB. [source](https://developers.cloudflare.com/containers/platform/limits/)
- Large machines: no (4 cores / 12 GiB). The largest machine is 4 cores and 12 GB of memory, so a 16-core or 32 GB machine is not available. [source](https://developers.cloudflare.com/containers/platform/limits/)
- Resize while running: no (no resize). The size is fixed when the sandbox is deployed; changing it means deploying again. [source](https://developers.cloudflare.com/containers/platform/limits/)
- GPUs: no (no GPU). There is no graphics processor option; the largest machine is 4 cores of CPU. [source](https://developers.cloudflare.com/containers/platform/limits/)
- Choose the region: no (placement is automatic). Cloudflare puts each sandbox near the request, and a sandbox cannot be pinned to a location. [source](https://developers.cloudflare.com/containers/concepts/placement/)
- Runs in the EU: partly (EU locations, cannot pin). Cloudflare has European locations, but a sandbox cannot be required to stay in one, so it may run outside the EU. [source](https://developers.cloudflare.com/workers/wrangler/configuration/)
- Pause keeps memory: no [source](https://developers.cloudflare.com/sandbox/concepts/lifetime/)
- Pre-started pools: no [source](https://developers.cloudflare.com/sandbox/concepts/lifetime/)
- Starts in under a second: not-published [source](https://developers.cloudflare.com/sandbox/concepts/lifetime/)
- Snapshots of files: partly (20 GB; 30 days). Snapshots are in public beta, hold at most 20 GB, and are deleted 30 days after they were made or last used. [source](https://developers.cloudflare.com/sandbox/concepts/lifetime/)
- Snapshots with memory: no [source](https://developers.cloudflare.com/sandbox/concepts/lifetime/)
- Copy a running machine: no [source](https://developers.cloudflare.com/sandbox/concepts/lifetime/)
- Pick an older snapshot: partly (30-day expiry). You have to store each snapshot’s ID yourself, and every snapshot is deleted 30 days after it was made or last used. [source](https://developers.cloudflare.com/sandbox/concepts/lifetime/)
- Reusable templates: partly. You can start any number of machines from an image you build, but saving a running machine as a reusable template only works through snapshots, which are in beta, keep files only, and expire after 30 days. [source](https://developers.cloudflare.com/sandbox/files/save-and-restore-a-workspace/)
- Automatic backups: partly (On stop, 30 days). A snapshot can be saved automatically when a sandbox stops, but there is no schedule and snapshots expire after 30 days. [source](https://developers.cloudflare.com/sandbox/concepts/lifetime/)
- Files survive a stop: no [source](https://developers.cloudflare.com/sandbox/concepts/lifetime/)
- Separate volumes: partly (20 GB disk). There is no separate disk that outlives the machine; a bucket can be mounted, and a snapshot lasts 30 days. [source](https://developers.cloudflare.com/sandbox/concepts/lifetime/)
- One volume, several machines: partly. The shared option is a bucket, not a disk, so files are not locked and two machines can overwrite each other. [source](https://developers.cloudflare.com/sandbox/files/)
- Mount outside storage: yes [source](https://developers.cloudflare.com/sandbox/files/mount-an-r2-bucket/)
- Large disk: no (20 GB max). The largest disk is 20 GB, short of 100 GB. [source](https://developers.cloudflare.com/containers/platform/limits/)
- Can stay on indefinitely: partly (6 h max). An instance stops when nothing has used it for up to 6 hours, the setting is lost on a restart, and Cloudflare promises no set running time. [source](https://developers.cloudflare.com/sandbox/concepts/lifetime/)
- Choose the idle timeout: partly (Up to 6 h). You can set the wait up to 6 hours, but the setting is lost when the object restarts and there is no never. [source](https://developers.cloudflare.com/sandbox/concepts/lifetime/)
- Wakes on a request: partly. A request starts a fresh machine, not the one that stopped; files come back only from a snapshot your code saved. [source](https://developers.cloudflare.com/sandbox/concepts/lifetime/)
- Scheduled runs: yes [source](https://developers.cloudflare.com/containers/examples/cron/)
- Public link to a port: partly (Through your Worker). There is no address for the machine itself; you publish a small program of your own and anyone who can open that address gets in. [source](https://developers.cloudflare.com/sandbox/previews/)
- Private link: partly (Login is your code). You have to write the login check in your own small program; the machine brings no token or password of its own. [source](https://developers.cloudflare.com/sandbox/concepts/security/)
- Real SSH: partly (One provider tool). You cannot point a normal SSH client at the machine; the only way in is a Cloudflare command-line tool. [source](https://developers.cloudflare.com/containers/guides/ssh/)
- Terminal in the browser: partly (You build it). The provider gives you code for a terminal you host yourself, not a terminal on its own website. [source](https://developers.cloudflare.com/sandbox/commands/open-a-terminal-in-the-browser/)
- Tunnel to your computer: no. There is no way to map a port inside the machine onto your own computer. [source](https://developers.cloudflare.com/containers/concepts/architecture/)
- Non-web ports: no. Web traffic only: no other kind of connection can be made to the machine from outside. [source](https://developers.cloudflare.com/containers/concepts/architecture/)
- Your own domain: partly (Through your Worker). You point a catch-all address at your own small program rather than at the machine, so routing is yours to run. [source](https://developers.cloudflare.com/sandbox/previews/serve-previews-on-their-own-hostnames/)
- Automatic HTTPS: yes (Zone certificate) [source](https://developers.cloudflare.com/sandbox/previews/serve-previews-on-their-own-hostnames/)
- Outbound data included: yes (1 TB a month) [source](https://developers.cloudflare.com/containers/pricing/)
- Allow only some sites: yes (Hosts or handler) [source](https://developers.cloudflare.com/containers/configuration/outbound-traffic/)
- Turn the internet off: yes (Off by default) [source](https://developers.cloudflare.com/sandbox/concepts/security/)
- Fixed outgoing IP: not-published [source](https://developers.cloudflare.com/containers/pricing/)
- Stored secrets: partly (Worker bindings). There is no saved secret inside the machine; you keep the value in your own small program and add it on the way out. [source](https://developers.cloudflare.com/sandbox/concepts/security/)
- Secrets the agent cannot read: yes (Added by your Worker) [source](https://developers.cloudflare.com/sandbox/concepts/security/)
- Limited API keys: yes (Account tokens) [source](https://developers.cloudflare.com/fundamentals/api/reference/permissions/)
- Create from the website: no [source](https://developers.cloudflare.com/sandbox/manage/)
- Command-line tool: partly. The only command-line tool is Wrangler, which deploys the Worker and can open a shell; it does not create or manage sandboxes. [source](https://developers.cloudflare.com/containers/guides/ssh/)
- Python SDK: no [source](https://developers.cloudflare.com/sandbox/reference/)
- TypeScript SDK: yes [source](https://developers.cloudflare.com/sandbox/reference/)
- Documented HTTP API: no. There is no Cloudflare-hosted API to call; you write a Worker and call it yourself. [source](https://developers.cloudflare.com/sandbox/sdk/bridge/)
- MCP server: no. The MCP material is a separate Cloudflare code-mode project, not a server that starts sandboxes. [source](https://developers.cloudflare.com/sandbox/commands/open-a-terminal-in-the-browser/)
- Interactive terminal over the API: partly. A live shell exists only inside a web page you build; there is no call that opens a terminal session for a script. [source](https://developers.cloudflare.com/sandbox/commands/open-a-terminal-in-the-browser/)
- Files over the API: yes [source](https://developers.cloudflare.com/sandbox/files/)
- Coding agents preinstalled: no. The current base images ship no coding agent; you add one in your own Dockerfile, as the guides do. [source](https://developers.cloudflare.com/sandbox/sdk/migrate/changes-in-1-0/)
- Send it a prompt: no. Your Worker holds the credentials and the agent runs as a process you start; there is no prompt endpoint. [source](https://developers.cloudflare.com/sandbox/coding-agents/)
- One-click Hermes: no. No Hermes template; you would install it in your own Dockerfile. [source](https://developers.cloudflare.com/sandbox/coding-agents/)
- One-click OpenClaw: no. No OpenClaw template; the guides cover Claude Code, Codex, OpenCode and Pi. [source](https://developers.cloudflare.com/sandbox/coding-agents/)
- Browser built in: no. The base images ship no browser; you install one in your own Dockerfile. [source](https://developers.cloudflare.com/sandbox/sdk/migrate/changes-in-1-0/)
- Desktop for computer use: no. No desktop or computer-use surface is documented. [source](https://developers.cloudflare.com/sandbox/)
- Runs other platforms' agents: yes [source](https://developers.cloudflare.com/sandbox/coding-agents/)
- Team workspace: partly. People share the Cloudflare account and its Workers, but there is no per-sandbox sharing or sandbox workspace. [source](https://developers.cloudflare.com/fundamentals/manage-members/)
- Roles and permissions: yes [source](https://developers.cloudflare.com/fundamentals/manage-members/)
- Single sign-on: yes [source](https://developers.cloudflare.com/fundamentals/manage-members/dashboard-sso/)
- Hard spending cap: no. Budget alerts only send email; they do not pause or cap anything. [source](https://developers.cloudflare.com/billing/manage/budget-alerts/)
- Usage alerts: yes [source](https://developers.cloudflare.com/billing/manage/budget-alerts/)
- Audit log: yes [source](https://developers.cloudflare.com/fundamentals/account/account-security/audit-logs/)
- Billed per second: yes (per 10 ms) [source](https://developers.cloudflare.com/containers/platform/pricing/)
- CPU billed only while working: yes (active CPU only) [source](https://developers.cloudflare.com/containers/platform/pricing/)
- Paused costs only storage: yes (nothing while stopped) [source](https://developers.cloudflare.com/sandbox/concepts/lifetime/)
- No monthly fee: no ($5 Workers plan). Sandboxes need the $5-a-month Workers Paid plan before anything can run. [source](https://developers.cloudflare.com/sandbox/)
- Flat monthly price: no (per 10 ms). The bill is a sum of active processor time, memory and disk. [source](https://developers.cloudflare.com/containers/platform/pricing/)
- Ongoing free tier: no (none). Sandboxes only run on the paid Workers plan. [source](https://developers.cloudflare.com/sandbox/)
- Free starting credit: no (none). There is no starting credit; you pay the $5 monthly plan from the start. [source](https://developers.cloudflare.com/sandbox/)
- Try without a card: no (paid plan first). You need a paid Workers plan, which means a payment method, before a sandbox can run. [source](https://developers.cloudflare.com/sandbox/)
- Public status page: yes [source](https://developers.cloudflare.com/billing/manage/budget-alerts/)
- Uptime promise (SLA): no. The 99.99% Workers SLA covers Workers only, not Containers or Sandboxes. [source](https://www.cloudflare.com/workers-service-level-agreement/)
- SOC 2 report: yes [source](https://www.cloudflare.com/cloudflare-customer-dpa/)
- Data processing agreement: yes [source](https://www.cloudflare.com/cloudflare-customer-dpa/)
- Open source or self-hostable: partly. The SDK is open source, but the platform it runs on is Cloudflare's and cannot be self-hosted. [source](https://developers.cloudflare.com/sandbox/reference/)

## Usability

- Dashboard: A Cloudflare account dashboard for Workers, containers, instance IDs and logs. There is no sandbox console and no create-a-sandbox button.
- Without code: No. The first step is a Worker with a Durable Object, and the image build needs Docker locally.
- Signup: A Cloudflare account and the Workers Paid plan at a $5 monthly minimum, which needs a payment method. No waitlist.
- Docs: 121 sandbox pages, each with a Markdown twin, plus llms.txt. Support is the community portal, cases, chat or phone depending on plan; no response-time commitment is published for Workers Paid.
- Trips people up: The 10-minute idle stop belongs to the deprecated 0.x SDK, not to Sandboxes 1.0.
- Trips people up: Stopping the instance deletes the files on its disk.
- Trips people up: The 2 vCPU / 4 GiB and 4 vCPU / 8 GiB shapes do not exist.
- Trips people up: Sandbox names are routing keys, not authentication.
- Trips people up: A deploy does not update a running sandbox.

## Company

- Legal entity: Cloudflare, Inc., a Delaware corporation incorporated in July 2009 and listed on the NYSE as NET since 13 September 2019. [source](https://www.sec.gov/Archives/edgar/data/1477333/000147733326000016/cloud-20251231.htm)
- Leadership: Matthew Prince is CEO and co-chair; Michelle Zatlyn is President and co-chair; Thomas Seifert is CFO. [source](https://cloudflare.net/governance/leadership/default.aspx)
- Scale: 5,156 full-time employees at 31 December 2025, and about 332,000 paying customers. [source](https://www.sec.gov/Archives/edgar/data/1477333/000147733326000016/cloud-20251231.htm)
- Status: A Containers component on the status page; no Sandboxes component and no sandbox-specific uptime percentage. [source](https://www.cloudflarestatus.com/api/v2/components.json)
- SLA: No sandbox SLA on any plan. The Workers SLA covers Workers only and does not extend to Containers or Sandboxes. [source](https://www.cloudflare.com/workers-service-level-agreement/)
- Certification: SOC 2 Type II, ISO 27001, PCI DSS L1 and a HIPAA AoC, all company-wide. No public statement puts Containers or Sandboxes inside that scope. [source](https://www.cloudflare.com/trust-hub/compliance-resources/soc-2/)
- Price changes: Thirty days' notice before a fee change. [source](https://www.cloudflare.com/terms/)

## Caveats

- **The 10-minute idle stop is 0.x behaviour, not the current product** (contradiction): The legacy Container class and the 0.x SDK stop after 10 minutes by default. Sandboxes 1.0 has no default inactivity timeout, a 6-hour maximum, and stops shortly after the Durable Object goes inactive. The 0.x SDK gets fixes only until 31 December 2026.
- **Start time is milliseconds on the product page and 1–3 seconds in the docs** (contradiction): The product page promises milliseconds; the Containers FAQ says a cold start is often 1–3 seconds depending on image size and execution time.
- **Outbound internet is off by default, required, or on by default depending on the page** (contradiction): The sandbox security guide says enableInternet: false is the default; the API reference says the field is required when options are passed; the Containers guide says the other API allows internet by default. Treat egress as an explicit per-start decision.
- **Instance maximums are called defaults that can be increased, and a hard table** (contradiction): The limits page says all maximums can be increased, directly above a custom-instance table that states 4 vCPU, 12 GiB and 20 GB as constraints. Whether support can lift them is not published.
- **“Start building for free” does not include a free sandbox** (contradiction): The product page invites you to start for free; the Containers rate card lists N/A for memory, CPU and disk on the Free plan, and the docs require Workers Paid.
- **A sandbox cannot be pinned to a region** (open): Containers support region and jurisdiction constraints, but the durable_object policy that sandboxes use rejects placement constraints. Placement is chosen for latency and can change when an instance restarts.
- **A stop wipes the disk** (open): Stopping the instance deletes the files on its disk. Only a snapshot (30 days, 20 GB maximum) or an R2 directory backup or mount survives it.
- **There is no sandbox SLA** (open): The Workers SLA covers Workers only, and no Containers or Sandboxes SLA page exists. The status page has no Sandboxes component, so an outage surfaces as a Workers, Durable Objects or Containers incident.
- **Compliance scope for this product is unpublished** (open): Cloudflare holds SOC 2 Type II, ISO 27001, PCI DSS L1 and a HIPAA AoC company-wide. No public statement says the audit boundary includes Containers or Sandboxes, and the reports sit behind the dashboard.

## Sources

- [Sandboxes overview](https://developers.cloudflare.com/sandbox/)
- [Sandbox lifetime](https://developers.cloudflare.com/sandbox/concepts/lifetime/)
- [Sandbox security](https://developers.cloudflare.com/sandbox/concepts/security/)
- [Container lifecycle](https://developers.cloudflare.com/containers/concepts/architecture/)
- [Limits and instance types](https://developers.cloudflare.com/containers/platform/limits/)
- [Containers pricing](https://developers.cloudflare.com/containers/platform/pricing/)
- [Placement](https://developers.cloudflare.com/containers/concepts/placement/)
- [Workers SLA](https://www.cloudflare.com/workers-service-level-agreement/)