> ## Documentation Index
> Fetch the complete documentation index at: https://docs.costgraph.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Cloudflare sandboxes

> Run CostGraph workflows and CI jobs in Cloudflare sandboxes: the key to create, its permissions, and its limits

Cloudflare Sandbox SDK runs isolated Linux containers on Cloudflare Containers controlled from a Worker; the sandbox bridge is a reference Worker the customer deploys in their own account to expose that SDK as an HTTP API.

The following table shows what CostGraph runs on this provider.

| Workflows | CI runners | Connect with |
| - | - | - |
| Yes | Yes | Integrations or your own dispatcher |

## Connect

Connect Cloudflare on Integrations, and CostGraph starts sandboxes in your Cloudflare account. You don't run anything yourself.

1. In CostGraph, go to **Integrations > Sandbox > Cloudflare**.

2. Enter these fields:

   * **Sandbox Worker URL** (`CLOUDFLARE_SANDBOX_URL`, required): The URL of the sandbox Worker deployed in your Cloudflare account.
   * **Sandbox Worker key** (`CLOUDFLARE_SANDBOX_API_KEY`, required): The SANDBOX\_API\_KEY secret of that Worker.

3. Click **Connect**.

Size and image come from the sandbox Worker you deploy.

### Your own dispatcher

To keep the key out of CostGraph or reach a private network, run your own dispatcher instead.
Set `provider` to `cloudflare` and the preceding fields as environment variables, as described in [Run your own dispatcher](https://docs.costgraph.ai/costgraph/workflows/managed-sandboxes.md#run-your-own-dispatcher).

To see what Cloudflare costs, connect the [Cloudflare integration](https://docs.costgraph.ai/costgraph/integrations/cloudflare.md).

## Key and permissions

CLOUDFLARE\_SANDBOX\_URL is the URL of the bridge Worker deployed in the customer's Cloudflare account (Deploy to Cloudflare button or "wrangler deploy"). CLOUDFLARE\_SANDBOX\_API\_KEY is the bridge's SANDBOX\_API\_KEY Worker secret, generated by the deploy button or set with `wrangler secret put SANDBOX_API_KEY`, sent as a Bearer token.

The bridge key is a single shared bearer secret with no scopes: anyone holding it can create, exec in, list and delete every sandbox behind that bridge. Deploying the bridge needs a Cloudflare account on the Workers Paid plan with Containers/Sandbox enabled; the doc names no narrower Cloudflare API token permissions.

Sources: [developers.cloudflare.com: bridge](https://developers.cloudflare.com/sandbox/sdk/bridge/), [developers.cloudflare.com: sandboxes](https://developers.cloudflare.com/sandbox/sdk/concepts/sandboxes/), [developers.cloudflare.com: lifetime](https://developers.cloudflare.com/sandbox/concepts/lifetime/), [developers.cloudflare.com: limits](https://developers.cloudflare.com/sandbox/sdk/platform/limits/), [developers.cloudflare.com: limits](https://developers.cloudflare.com/containers/platform/limits/).

## Limits

* Sandbox SDK 0.x: container sleeps after 10 minutes of inactivity by default (sleepAfter) and all state is lost. ([source](https://developers.cloudflare.com/sandbox/sdk/concepts/sandboxes/))
* Code running inside the instance does not count as activity: 'the instance stops when the inactivity timeout ends, even while a build, a test suite, or an agent task still runs inside it.' Inactivity timeout max 6 hours; 'Cloudflare does not guarantee that an instance runs for a set time.' ([source](https://developers.cloudflare.com/sandbox/concepts/lifetime/))
* Instance types up to standard-4 (4 vCPU, 12 GiB, 20 GB disk); custom types max 4 vCPU / 12 GiB; account concurrent limits 1,500 vCPU / 6 TiB memory (defaults, raisable). ([source](https://developers.cloudflare.com/containers/platform/limits/))
* Container images must run on linux/amd64. ([source](https://developers.cloudflare.com/containers/get-started/))
* Bridge requires an account `with the Containers / Sandbox beta enabled`; Containers is available on the Workers Paid plan. ([source](https://developers.cloudflare.com/sandbox/sdk/bridge/))

## Related

* [Supported sandbox providers](https://docs.costgraph.ai/costgraph/workflows/sandbox-providers.md)
* [Run workflows on a managed sandbox provider](https://docs.costgraph.ai/costgraph/workflows/managed-sandboxes.md)
* [Run CI jobs in sandboxes](https://docs.costgraph.ai/costgraph/autopilot/ci-sandboxes.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.