Botperch

ProvidersChecked 2026-10-28

Cloudflare Sandbox

A Worker that starts a Firecracker microVM, with no public port, no region pinning, and a disk that is wiped when the instance stops.

Short answer: One always-on personal agent (2 vCPU / 4 GiB / 20 GiB) costs about $99.41 a month here, with a catch: A stopped instance loses its disk; files have to be backed up to R2 or a snapshot and restored. The AI model adds about $14.70 a month on top (GLM 5.3, 30 requests a day at 40k tokens each, median zero-retention price; from $6.84 at the cheapest host). Fits well: A Worker that already holds the credentials and decides what the code can reach: the sandbox never gets a public port.

developers.cloudflare.com/sandbox/16 providersSources linked

Cloudflare Sandboxes are a feature of the Workers platform: you write a Worker, its Durable Object starts a Linux container on Cloudflare's network, and that container runs untrusted or generated code with its own kernel.

There is no separate sandbox service to sign up for and no sandbox console. Identity is a Durable Object name, compute is a container instance, and persistence is a snapshot you take yourself or a bucket you mount.

A second, lighter environment called Dynamic Workers runs JavaScript, Python or WebAssembly inside the Workers runtime when the code only needs to call methods you pass in.

At a glance

Who it is forTeams already running a Worker who want untrusted code execution next to their application, with the Worker holding the credentials and deciding reachability.
IsolationA Firecracker microVM per container, with its own kernel and network. Your image runs as a Linux container inside it, and every process has root capabilities, so there is no privilege boundary between users inside one sandbox. No memory snapshot, no pause, no fork. Docker-in-Docker works with iptables and IP forwarding off; linux/amd64 only.
SizesSix presets from lite (1/16 vCPU, 256 MiB, 2 GB) to standard-4 (4 vCPU, 12 GiB, 20 GB). Custom sizes are capped at 4 vCPU / 12 GiB / 20 GB, with at least 3 GiB of memory per vCPU. No GPU and no ARM. Placement is chosen by Cloudflare near the request, and a sandbox cannot be pinned to a region.
A personal agent hereAbout $99.41 a month for one always-on 2 vCPU / 4 GiB machine (standard-4: 4 vCPU / 12 GiB / 20 GiB), before the AI model. The catch: A stopped instance loses its disk; files have to be backed up to R2 or a snapshot and restored. Change the numbers
Recommended in

Fits well, fits badly

Our reading of the sourced material on this page, not a provider claim.

Fits well

  • A Worker that already holds the credentials and decides what the code can reach: the sandbox never gets a public port.
  • One microVM per user or per job, with no shared kernel, at a per-second price that reaches zero when it stops.
  • A team already on Cloudflare: one account, one bill, Workers and Durable Objects alongside.
  • A JavaScript or Python snippet that does not need a container at all: a Dynamic Worker starts faster.

Fits badly

  • A long job with no inbound requests: code inside does not count as activity, so a two-hour build dies at the timeout.
  • Any workload needing more than 4 vCPU, 12 GiB or 20 GB, or a GPU.
  • EU data residency: a sandbox cannot be pinned to a region.
  • An agent that expects a pause or a resumable machine: stopping deletes the disk and every process.

Compare: alternatives to Cloudflare Sandbox · E2B vs Cloudflare Sandbox

How it bills

ModelPer-10-millisecond Containers usage on the account's Workers Paid bill, plus Workers, Durable Objects, egress, R2 and optionally Logs.
MeterActive CPU $0.072 per vCPU-hour, provisioned memory $0.009 per GiB-hour and provisioned disk $0.000252 per GB-hour while the instance runs. Egress is $0.025 per GB in North America and Europe.
While stoppedNothing. A stopped instance is not billed, and its disk and processes are gone.
Plan feeWorkers Paid has a $5 a month minimum for the account. There is no sandbox-specific plan or fee.
MinimumNo free tier for containers: the Free column is N/A for memory, CPU and disk. The plan includes about $0.73 of container usage a month.

How Cloudflare Sandbox lets you try before paying is on Trials and free tiers.

Where it stands out

  • A Firecracker microVM per sandbox with no public port; inbound is HTTP through your Worker only.
  • Active-CPU billing: a stopped instance costs nothing, and idle time bills memory and disk but no CPU.
  • One account and one bill alongside Workers, Durable Objects and R2.
  • Snapshots, R2 directory backups and S3/R2 mounts cover three different persistence needs.
  • A large, mature security programme behind the platform.

Using it without writing code

DashboardA Cloudflare account dashboard for Workers, containers, instance IDs and logs. There is no sandbox console and no create-a-sandbox button.
Without codeNo. The first step is a Worker with a Durable Object, and the image build needs Docker locally.
SignupA Cloudflare account and the Workers Paid plan at a $5 monthly minimum, which needs a payment method. No waitlist.
Docs and support121 sandbox pages, each with a Markdown twin, plus llms.txt. Support is the community portal, cases, chat or phone depending on plan; no response-time commitment is published for Workers Paid.

Capability checklist

Every capability the guide checks, with the catch where Cloudflare Sandbox's version falls short. Compare all providers

Isolation

Sizes and regions

Lifecycle

Snapshots and forks

  • Snapshots of files With a catch Snapshots are in public beta, hold at most 20 GB, and are deleted 30 days after they were made or last used.
  • Snapshots with memory No
  • Copy a running machine No
  • Pick an older snapshot With a catch You have to store each snapshot’s ID yourself, and every snapshot is deleted 30 days after it was made or last used.
  • Reusable templates With a catch You can start any number of machines from an image you build, but saving a running machine as a reusable template only works through snapshots, which are in beta, keep files only, and expire after 30 days.
  • Automatic backups With a catch A snapshot can be saved automatically when a sandbox stops, but there is no schedule and snapshots expire after 30 days.

Storage

Idle and waking

  • Can stay on indefinitely With a catch An instance stops when nothing has used it for up to 6 hours, the setting is lost on a restart, and Cloudflare promises no set running time.
  • Choose the idle timeout With a catch You can set the wait up to 6 hours, but the setting is lost when the object restarts and there is no never.
  • Wakes on a request With a catch A request starts a fresh machine, not the one that stopped; files come back only from a snapshot your code saved.
  • Scheduled runs Yes

Reaching it

  • Public link to a port With a catch There is no address for the machine itself; you publish a small program of your own and anyone who can open that address gets in.
  • Private link With a catch You have to write the login check in your own small program; the machine brings no token or password of its own.
  • Real SSH With a catch You cannot point a normal SSH client at the machine; the only way in is a Cloudflare command-line tool.
  • Terminal in the browser With a catch The provider gives you code for a terminal you host yourself, not a terminal on its own website.
  • Tunnel to your computer No
  • Non-web ports No

Custom domains

  • Your own domain With a catch You point a catch-all address at your own small program rather than at the machine, so routing is yours to run.
  • Automatic HTTPS Yes

Outbound network

Keys and secrets

Ways to drive it

Built-in agents

Teams and accounts

Billing models

Trials and free tiers

The company

The company

From the profile's company section: the legal entity, who funds it, and what a buyer can check before signing.

Legal entity

Cloudflare, Inc., a Delaware corporation incorporated in July 2009 and listed on the NYSE as NET since 13 September 2019.

“The Company was incorporated in Delaware in July 2009.” sec.gov third-party

Leadership

Matthew Prince is CEO and co-chair; Michelle Zatlyn is President and co-chair; Thomas Seifert is CFO.

“Mr. Prince is one of our Co-Founders and has served as our Chief Executive Officer and Chair of our Board of Directors since July 2009.” cloudflare.net docs-confirmed

Scale

5,156 full-time employees at 31 December 2025, and about 332,000 paying customers.

“As of December 31, 2025, we had 5,156 full-time employees” sec.gov third-party

Status

A Containers component on the status page; no Sandboxes component and no sandbox-specific uptime percentage.

“Containers” cloudflarestatus.com docs-confirmed

SLA

No sandbox SLA on any plan. The Workers SLA covers Workers only and does not extend to Containers or Sandboxes.

“This Workers Service Level Agreement (“Workers SLA”) applies to use of Workers only.” cloudflare.com docs-confirmed

Certification

SOC 2 Type II, ISO 27001, PCI DSS L1 and a HIPAA AoC, all company-wide. No public statement puts Containers or Sandboxes inside that scope.

“Cloudflare's SOC 2 Type II report covers security, confidentiality, and availability controls to protect customer data and is available to download from the Cloudflare dashboard.” cloudflare.com docs-confirmed

Price changes

Thirty days' notice before a fee change.

“provided that we give you at least thirty (30) days' prior notice of such changes” cloudflare.com docs-confirmed

Caveats and contradictions

Shown as the research found them. A contradiction means the provider's own pages disagree; an open question means the answer is not published.

  1. 01

    The 10-minute idle stop is 0.x behaviour, not the current product Contradiction

    The legacy Container class and the 0.x SDK stop after 10 minutes by default. Sandboxes 1.0 has no default inactivity timeout, a 6-hour maximum, and stops shortly after the Durable Object goes inactive. The 0.x SDK gets fixes only until 31 December 2026.

    “After a period of inactivity (10 minutes by default, configurable via sleepAfter), the container stops to free resources.”
    Cloudflare Sandboxdocs-confirmed
    “Without a timeout, Cloudflare stops the instance shortly after the Durable Object becomes inactive.”
    Cloudflare Sandboxdocs-confirmed
  2. 02

    Start time is milliseconds on the product page and 1–3 seconds in the docs Contradiction

    The product page promises milliseconds; the Containers FAQ says a cold start is often 1–3 seconds depending on image size and execution time.

    “Sandboxes start in milliseconds, not minutes.”
    Cloudflare Sandboxdocs-confirmed
    “Container cold starts can often be in the 1-3 second range, but this is dependent on image size and code execution time, among other factors.”
    Cloudflare Sandboxdocs-confirmed
  3. 03

    Outbound internet is off by default, required, or on by default depending on the page Contradiction

    The sandbox security guide says enableInternet: false is the default; the API reference says the field is required when options are passed; the Containers guide says the other API allows internet by default. Treat egress as an explicit per-start decision.

    “A Container starts with enableInternet: false by default, so it cannot reach the Internet.”
    Cloudflare Sandboxdocs-confirmed
    “By default, a Container will allow internet access”
    Cloudflare Sandboxdocs-confirmed
  4. 04

    Instance maximums are called defaults that can be increased, and a hard table Contradiction

    The limits page says all maximums can be increased, directly above a custom-instance table that states 4 vCPU, 12 GiB and 20 GB as constraints. Whether support can lift them is not published.

    “All instance size maximums and account limits on this page are defaults and can be increased.”
    Cloudflare Sandboxdocs-confirmed
    “Maximum vCPU | 4”
    Cloudflare Sandboxdocs-confirmed
  5. 05

    “Start building for free” does not include a free sandbox Contradiction

    The product page invites you to start for free; the Containers rate card lists N/A for memory, CPU and disk on the Free plan, and the docs require Workers Paid.

    “Start building for free”
    Cloudflare Sandboxdocs-confirmed
    “Available on Workers Paid plan”
    Cloudflare Sandboxdocs-confirmed
  6. 06

    A sandbox cannot be pinned to a region Open question

    Containers support region and jurisdiction constraints, but the durable_object policy that sandboxes use rejects placement constraints. Placement is chosen for latency and can change when an instance restarts.

  7. 07

    A stop wipes the disk Open question

    Stopping the instance deletes the files on its disk. Only a snapshot (30 days, 20 GB maximum) or an R2 directory backup or mount survives it.

  8. 08

    There is no sandbox SLA Open question

    The Workers SLA covers Workers only, and no Containers or Sandboxes SLA page exists. The status page has no Sandboxes component, so an outage surfaces as a Workers, Durable Objects or Containers incident.

  9. 09

    Compliance scope for this product is unpublished Open question

    Cloudflare holds SOC 2 Type II, ISO 27001, PCI DSS L1 and a HIPAA AoC company-wide. No public statement says the audit boundary includes Containers or Sandboxes, and the reports sit behind the dashboard.

Sources

The three shared workloads

List-price illustrations from the calculator, not quotes. Prices checked 29 October 2026.

A · 1,000 short tasks

$28.95

standard-3: 2 vCPU / 8 GiB / 16 GiB (plan: Workers Paid)

  • CPU, while working166.67 h × 1 vCPU busy × $0.072$12.00
  • Memory166.67 h × 8 GiB × $0.009$12.00
  • Disk while running166.67 h × 16 GiB × $0.000252$0.67
  • Included in the plan−6.25 vCPU-h × $0.072$-0.45
  • Included in the plan−25 GiB-h × $0.009$-0.22
  • Included in the plan−200 GB-h × $0.000252$-0.05
  • Workers Paid: $5.00 plan, $23.95 over.
  • Egress is $0.025 per GB in North America and Europe and is not included.
  • Workers, Durable Objects and R2 usage are billed separately.

B · One always-on box

$107.82, with a catch

standard-4: 4 vCPU / 12 GiB / 20 GiB (plan: Workers Paid)

  • CPU, while working730 h × 0.4 vCPU busy × $0.072$21.02
  • Memory730 h × 12 GiB × $0.009$78.84
  • Disk while running730 h × 20 GiB × $0.000252$3.68
  • Included in the plan−6.25 vCPU-h × $0.072$-0.45
  • Included in the plan−25 GiB-h × $0.009$-0.22
  • Included in the plan−200 GB-h × $0.000252$-0.05
  • Workers Paid: $5.00 plan, $102.82 over.
  • Egress is $0.025 per GB in North America and Europe and is not included.
  • Workers, Durable Objects and R2 usage are billed separately.

It cannot run this exactly as described: No size with 4 vCPU allows 50 GiB of disk; the most is 20 GiB on standard-4. A stopped instance loses its disk; files have to be backed up to R2 or a snapshot and restored.

C · Three hours a day

$17.04, with a catch

standard-4: 4 vCPU / 12 GiB / 20 GiB (plan: Workers Paid)

  • CPU, while working90 h × 0.4 vCPU busy × $0.072$2.59
  • Memory90 h × 12 GiB × $0.009$9.72
  • Disk while running90 h × 20 GiB × $0.000252$0.45
  • Included in the plan−6.25 vCPU-h × $0.072$-0.45
  • Included in the plan−25 GiB-h × $0.009$-0.22
  • Included in the plan−200 GB-h × $0.000252$-0.05
  • Workers Paid: $5.00 plan, $12.04 over.
  • Egress is $0.025 per GB in North America and Europe and is not included.
  • Workers, Durable Objects and R2 usage are billed separately.

It cannot run this exactly as described: A stopped instance loses its disk; files have to be backed up to R2 or a snapshot and restored.