Skip to main content
Cloudflare Sandbox SDK runs isolated Linux containers on Cloudflare Containers controlled from a Worker; the sandbox bridge is a reference Worker the customer deploys in their own account to expose that SDK as an HTTP API. The following table shows what CostGraph runs on this provider.

​
Connect

Run the dispatcher with provider set to cloudflare and these variables:
  • CLOUDFLARE_SANDBOX_URL
  • CLOUDFLARE_SANDBOX_API_KEY
Size and image come from the sandbox Worker you deploy. To see what Cloudflare costs, connect the Cloudflare integration.

​
Key and permissions

CLOUDFLARE_SANDBOX_URL is the URL of the bridge Worker deployed in the customer’s Cloudflare account (Deploy to Cloudflare button or “wrangler deploy”). CLOUDFLARE_SANDBOX_API_KEY is the bridge’s SANDBOX_API_KEY Worker secret, generated by the deploy button or set with wrangler secret put SANDBOX_API_KEY, sent as a Bearer token. The bridge key is a single shared bearer secret with no scopes: anyone holding it can create, exec in, list and delete every sandbox behind that bridge. Deploying the bridge needs a Cloudflare account on the Workers Paid plan with Containers/Sandbox enabled; the doc names no narrower Cloudflare API token permissions. Sources: developers.cloudflare.com: bridge, developers.cloudflare.com: sandboxes, developers.cloudflare.com: lifetime, developers.cloudflare.com: limits, developers.cloudflare.com: limits.

​
Limits

  • Sandbox SDK 0.x: container sleeps after 10 minutes of inactivity by default (sleepAfter) and all state is lost. (source)
  • Code running inside the instance does not count as activity: ‘the instance stops when the inactivity timeout ends, even while a build, a test suite, or an agent task still runs inside it.’ Inactivity timeout max 6 hours; ‘Cloudflare does not guarantee that an instance runs for a set time.’ (source)
  • Instance types up to standard-4 (4 vCPU, 12 GiB, 20 GB disk); custom types max 4 vCPU / 12 GiB; account concurrent limits 1,500 vCPU / 6 TiB memory (defaults, raisable). (source)
  • Container images must run on linux/amd64. (source)
  • Bridge requires an account with the Containers / Sandbox beta enabled; Containers is available on the Workers Paid plan. (source)