Devtoolwatch BoardCloudflare Sandbox SDK review
Cloudflare Sandbox SDK runs untrusted or generated code in per-user Linux sandboxes built on Cloudflare Durable Objects and Containers.
TL;DR
Cloudflare Sandbox SDK lets a Worker run untrusted or generated code in a Linux sandbox that belongs to one user, task, or session. It is for developers building AI code interpreters, coding agent runners, and similar apps on Cloudflare. Version 1.0 adds file streaming, S3-compatible bucket mounts, and directory backups to the native Container API.
- 1.2kGitHub stars
- +1new stars, week of Oct 25
- ~1.2Mdownloads a week, +40% vs 4-week avg
- #7in Sandboxes and runtimes this week
Cloudflare Sandbox SDK at a glance
- Category
- Sandboxes and runtimes
- Maintained by
- Cloudflare (organization, @cloudflare on GitHub)
- Language
- TypeScript, Rust, JavaScript
- Repository
- github.com/cloudflare/sandbox-sdk
- Website
- sandbox.cloudflare.com
- npm package
- @cloudflare/sandbox 1.0.2
- Latest release
- @cloudflare/[email protected] on GitHub, Oct 21, 2026
- First published
- Jun 22, 2025
What Cloudflare Sandbox SDK does
- Cloudflare Sandbox SDK's Files API streams files in and out of a running container and reports Linux errors such as ENOENT.
- Cloudflare Sandbox SDK's S3Mount mounts an S3-compatible bucket at a path. The Worker signs each request, so credentials never enter the sandbox.
- Cloudflare Sandbox SDK's DirectoryBackup saves a directory to R2 and restores it into any Container, including one on a newer image.
- Cloudflare Sandbox SDK lets your Worker decide who gets a sandbox, which hosts it can reach, and which credentials stay out.
- Cloudflare Sandbox SDK examples cover background processes, browser terminals, web app previews, shared ports on their own URLs, and network access control.
- Cloudflare Sandbox SDK has guides for running coding agents such as Claude Code, Codex, OpenCode, Devin, and Cursor on a repository.
How it works
A sandbox is a Durable Object plus the Container it starts. Your Durable Object starts the instance and runs commands through the native ctx.container API. The @cloudflare/sandbox package adds file operations, bucket mounts, and backups. These run a Linux helper, sandbox-shim, which application images copy from the cloudflare/sandbox image. Your Worker routes each request to a sandbox by name.
How to install and start using Cloudflare Sandbox SDK
From the minimal template
npm create cloudflare@latest -- my-sandbox --template=cloudflare/sandbox-sdk/examples/minimalRequirements
- A Cloudflare Workers Paid plan.
- The Worker needs the nodejs_compat flag.
- The container image must include the sandbox-shim helper, copied from docker.io/cloudflare/sandbox.
- Node.js and Docker to build and test the repository.
First steps
- Create a project from the minimal template, which gives each name in the URL its own sandbox.
- Make sure the container image includes the sandbox-shim helper that Files runs.
- Enable nodejs_compat for your Worker.
- Authenticate requests in your Worker, then pick a sandbox per user or task with env.SANDBOX.getByName().
Who Cloudflare Sandbox SDK is for
- Developers running agent-written or user-uploaded code who need isolation from application data.
- Teams building AI code interpreters or coding agent runners on Cloudflare Workers.
- Apps that need one Linux sandbox per user, task, or session.
Limitations to know
- Cloudflare Sandbox SDK runs on Cloudflare's platform. It needs Workers, Durable Objects, and Containers, plus a Workers Paid plan.
- Cloudflare Sandbox SDK 1.0 is a ground-up rewrite. Moving from 0.12 is a migration, not a version bump.
- Cloudflare Sandbox SDK 1.0 leaves command execution to your Durable Object. The package provides only file operations, bucket mounts, and backups.
- Cloudflare Sandbox SDK is not needed for JavaScript or Python that doesn't require Linux. Cloudflare points to Dynamic Workers for that.
Is Cloudflare Sandbox SDK growing? Usage data
In the week of Oct 25–31, 2026, Cloudflare Sandbox SDK ranked #216 on the Devtoolwatch Board and #7 in Sandboxes and runtimes, with a momentum score of 43 out of 100. Its main package had about 1.2M downloads that week, +40% against its own 4-week average.
Show the weekly numbers
| Week of | New stars |
|---|---|
| Aug 9, 2026 | 12 |
| Aug 16, 2026 | 5 |
| Aug 23, 2026 | 8 |
| Aug 30, 2026 | 4 |
| Sep 6, 2026 | 2 |
| Sep 13, 2026 | 5 |
| Sep 20, 2026 | 8 |
| Sep 27, 2026 | 5 |
| Oct 4, 2026 | 5 |
| Oct 11, 2026 | 4 |
| Oct 18, 2026 | 6 |
| Oct 25, 2026 | 1 |
On Hacker News
- Cloudflare Sandbox SDK, 256 points and 90 comments (Oct 16, 2025)
- Cloudflare Sandboxes, 8 points and 1 comments (Oct 15, 2025)
The Board ranks tools by four signals each week: new stars, new stars for the repo's size, added downloads and download growth beyond the market. How the ranking works.
Cloudflare Sandbox SDK alternatives
Other AI sandboxes and runtimes on the Board in the week of Oct 25–31, 2026, by momentum:
| Rank | Tool | Stars | Downloads/wk |
|---|---|---|---|
| #1 | OpenSandboxOpenSandbox is a sandbox runtime that gives AI agents isolated environments to run code, commands, files, browsers, and desktops on your… | 16.3k | 328.9k |
| #2 | microsandboxmicrosandbox is a local-first microVM runtime and library for running untrusted workloads like AI agents, user code, and CI jobs in… | 8.9k | 26.8k |
| #3 | E2BE2B is open-source infrastructure for running AI-generated code in secure, isolated cloud sandboxes, controlled through JavaScript and… | 14.6k | 5M |
| #4 | Agent Sandboxagent-sandbox enables easy management of isolated, stateful, singleton workloads, ideal for use cases like AI agent runtimes and… | 4.5k | – |
| #5 | Trigger.devTrigger.dev is an open-source TypeScript platform for building and deploying durable AI agents, workflows, and long-running background… | 16.7k | 1.7M |
| #6 | InngestInngest is a workflow orchestration platform for running durable step functions, background jobs, and AI workflows on serverless,… | 6k | 3.7M |
Recent Cloudflare Sandbox SDK releases
- @cloudflare/[email protected], Oct 21, 2026
- @cloudflare/[email protected], Oct 20, 2026
- @cloudflare/[email protected], Oct 20, 2026
- @cloudflare/[email protected], Oct 19, 2026
- @cloudflare/[email protected], Oct 13, 2026
Cloudflare Sandbox SDK FAQ
Is Cloudflare Sandbox SDK free and open source?
Cloudflare Sandbox SDK's code is on GitHub (cloudflare/sandbox-sdk), but the repository doesn't declare a standard open-source license. Check its license file before using it commercially. Its website links to a pricing page: https://sandbox.cloudflare.com/sandbox/sdk/platform/pricing/.
How do I install Cloudflare Sandbox SDK?
Run npm create cloudflare@latest -- my-sandbox --template=cloudflare/sandbox-sdk/examples/minimal. The install section above has the other options from the project's README.
Is Cloudflare Sandbox SDK still maintained?
Yes. The cloudflare/sandbox-sdk repository was last updated on Oct 21, 2026, and the latest release, @cloudflare/[email protected] on GitHub, came out on Oct 21, 2026.
How popular is Cloudflare Sandbox SDK?
Cloudflare Sandbox SDK has 1.2k GitHub stars as of Nov 1, 2026. It gained 1 new stars in the week of Oct 25–31, 2026, against a 12-week average of 5 a week. Its main package had about 1.2M downloads that week, +40% against its own 4-week average. That made it #7 among AI sandboxes and runtimes on the Devtoolwatch Board.
What are the best alternatives to Cloudflare Sandbox SDK?
Other AI sandboxes and runtimes on the Devtoolwatch Board in the week of Oct 25–31, 2026, by momentum: OpenSandbox (#1), microsandbox (#2), E2B (#3), Agent Sandbox (#4), Trigger.dev (#5). The alternatives table above has their numbers.
What changed in Cloudflare Sandbox SDK 1.0?
Cloudflare Sandbox SDK 1.0 removed the 0.x Sandbox class that owned the Container. Your own Durable Object now starts the Container through ctx.container. The package adds Files, S3Mount, and DirectoryBackup. A migration guide maps each 0.x API to its replacement, and the 0.x source is on the v0 branch.
Can a Cloudflare Sandbox SDK sandbox access the internet?
Cloudflare Sandbox SDK leaves internet access up to your Worker. Your Worker decides whether the code can reach the public Internet and which hosts it can reach. The minimal example starts the container with enableInternet set to false.
How does Cloudflare Sandbox SDK keep credentials out of the sandbox?
Cloudflare Sandbox SDK's S3Mount has the Worker sign each storage request, so bucket credentials never enter the sandbox. DirectoryBackup gives the Container access only to the one object each operation needs.
When should I use Dynamic Workers instead of Cloudflare Sandbox SDK?
Use Dynamic Workers when you need to run JavaScript or Python without a Linux environment. Cloudflare Sandbox SDK is for code that needs a Linux container.
Sources
- cloudflare/sandbox-sdk on GitHub
- Cloudflare Sandbox SDK README
- @cloudflare/sandbox on npm
- Cloudflare Sandbox SDK website
- Release @cloudflare/[email protected] (Oct 21, 2026)
- Release @cloudflare/[email protected] (Oct 20, 2026)
- Release @cloudflare/[email protected] (Oct 20, 2026)
- Hacker News: Cloudflare Sandbox SDK
- Hacker News: Cloudflare Sandboxes
- Devtoolwatch Board, the week of Oct 25–31, 2026
Cloudflare Sandbox SDK README badge
Maintainers can show the tool's weekly Board rank in their README:
[](https://index.devtoolwatch.com/tools/cloudflare-sandbox/)How this page is made: Devtoolwatch writes each review from the project's README, releases, package metadata and website, with an AI model, then checks every claim against the source it cites and drops what the sources don't support. The numbers come from Devtoolwatch's daily GitHub snapshots, GitHub's stargazer history, and the npm and PyPI download APIs. Spotted an error? Email [email protected].