> ## Documentation Index
> Fetch the complete documentation index at: https://docs.costgraph.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Google Cloud Run sandboxes

> Run CostGraph workflows and CI jobs in Google Cloud Run sandboxes: the key to create, its permissions, and its limits

Cloud Run sandboxes (Google Cloud, Preview) let a Cloud Run service, job or instance launch isolated sandboxes via an in-container sandbox CLI; ComputeSDK's gateway is a Cloud Run service the customer deploys in their own GCP project to drive them over HTTP.

The following table shows what CostGraph runs on this provider.

| Workflows | CI runners | Connect with |
| - | - | - |
| Yes | No | Integrations or your own dispatcher |

CI runners: no. AutoPilot compares runners by price, and this provider publishes no sandbox price.

## Connect

Connect Google Cloud Run on Integrations, and CostGraph starts sandboxes in your Google Cloud Run account. You don't run anything yourself.

1. In CostGraph, go to **Integrations > Sandbox > Google Cloud Run**.

2. Enter these fields:

   * **Gateway URL** (`CLOUD_RUN_SANDBOX_URL`, required): The run.app URL of the sandbox gateway service in your Google Cloud project.
   * **Gateway secret** (`CLOUD_RUN_SANDBOX_SECRET`, required): The shared secret that gateway checks.

3. Click **Connect**.

### Your own dispatcher

To keep the key out of CostGraph or reach a private network, run your own dispatcher instead.
Set `provider` to `cloud-run` and the preceding fields as environment variables, as described in [Run your own dispatcher](https://docs.costgraph.ai/costgraph/workflows/managed-sandboxes.md#run-your-own-dispatcher).

## Key and permissions

CLOUD\_RUN\_SANDBOX\_URL is the run.app URL of the ComputeSDK gateway service the customer deploys (`npx -p @computesdk/gcp computesdk-cloud-run`, which deploys with `--sandbox-launcher`). CLOUD\_RUN\_SANDBOX\_SECRET is the shared secret that gateway checks on every sandbox operation.

The gateway secret has no scopes: it grants all sandbox operations on that gateway. To deploy the gateway, Google documents Cloud Run Developer (roles/run.developer) on the service and Service Account User (roles/iam.serviceAccountUser) on its service identity (plus Cloud Build roles for source deploys); the Cloud Build and Cloud Run APIs must be enabled and the gateway allows unauthenticated invocation (roles/run.invoker for allUsers) unless CLOUD\_RUN\_AUTH\_TOKEN is used.

Sources: [docs.cloud.google.com: code execution](https://docs.cloud.google.com/run/docs/code-execution), [docs.cloud.google.com: sandboxes](https://docs.cloud.google.com/run/docs/configuring/services/sandboxes), [docs.cloud.google.com: request timeout](https://docs.cloud.google.com/run/docs/configuring/request-timeout), [docs.computesdk.com: cloud run](https://docs.computesdk.com/providers/cloud-run.md).

## Limits

* Launch stage: Preview, subject to the Pre-GA Offerings Terms; commands use "gcloud beta". ComputeSDK states the GCP project must be allow-listed by the Cloud Run team. ([source](https://docs.cloud.google.com/run/docs/code-execution))
* Sandboxes share the CPU and memory of the host container, which must be sized for the app plus all concurrent sandboxes; requires the second-generation execution environment. ([source](https://docs.cloud.google.com/run/docs/configuring/services/sandboxes))
* Each request to a Cloud Run service times out after 5 minutes by default, max 60 minutes, which bounds any single synchronous command through the gateway. ([source](https://docs.cloud.google.com/run/docs/configuring/request-timeout))
* CostGraph: default command timeout 5 minutes; list returns only sandboxes tracked in-process; no per-sandbox URLs. ([source](https://docs.computesdk.com/providers/cloud-run.md))

## Related

* [Supported sandbox providers](https://docs.costgraph.ai/costgraph/workflows/sandbox-providers.md)
* [Run workflows on a managed sandbox provider](https://docs.costgraph.ai/costgraph/workflows/managed-sandboxes.md)
* [Run CI jobs in sandboxes](https://docs.costgraph.ai/costgraph/autopilot/ci-sandboxes.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.