Skip to main content
Cloud Run sandboxes (Google Cloud, Preview) let a Cloud Run service, job or instance launch isolated sandboxes via an in-container sandbox CLI; ComputeSDK’s gateway is a Cloud Run service the customer deploys in their own GCP project to drive them over HTTP. The following table shows what CostGraph runs on this provider. CI runners: no. AutoPilot compares runners by price, and this provider publishes no sandbox price.

​
Connect

Run the dispatcher with provider set to cloud-run and these variables:
  • CLOUD_RUN_SANDBOX_URL
  • CLOUD_RUN_SANDBOX_SECRET

​
Key and permissions

CLOUD_RUN_SANDBOX_URL is the run.app URL of the ComputeSDK gateway service the customer deploys (npx -p @computesdk/gcp computesdk-cloud-run, which deploys with --sandbox-launcher). CLOUD_RUN_SANDBOX_SECRET is the shared secret that gateway checks on every sandbox operation. The gateway secret has no scopes: it grants all sandbox operations on that gateway. To deploy the gateway, Google documents Cloud Run Developer (roles/run.developer) on the service and Service Account User (roles/iam.serviceAccountUser) on its service identity (plus Cloud Build roles for source deploys); the Cloud Build and Cloud Run APIs must be enabled and the gateway allows unauthenticated invocation (roles/run.invoker for allUsers) unless CLOUD_RUN_AUTH_TOKEN is used. Sources: docs.cloud.google.com: code execution, docs.cloud.google.com: sandboxes, docs.cloud.google.com: request timeout, docs.computesdk.com: cloud run.

​
Limits

  • Launch stage: Preview, subject to the Pre-GA Offerings Terms; commands use “gcloud beta”. ComputeSDK states the GCP project must be allow-listed by the Cloud Run team. (source)
  • Sandboxes share the CPU and memory of the host container, which must be sized for the app plus all concurrent sandboxes; requires the second-generation execution environment. (source)
  • Each request to a Cloud Run service times out after 5 minutes by default, max 60 minutes, which bounds any single synchronous command through the gateway. (source)
  • CostGraph: default command timeout 5 minutes; list returns only sandboxes tracked in-process; no per-sandbox URLs. (source)