> ## Documentation Index
> Fetch the complete documentation index at: https://docs.costgraph.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Fly Machines sandboxes

> Run CostGraph workflows and CI jobs in Fly Machines sandboxes: the key to create, its permissions, and its limits

Fly Machines are fast-launching Firecracker VMs inside a Fly.io app, created, exec'd into and destroyed through the Machines REST API.

The following table shows what CostGraph runs on this provider.

| Workflows | CI runners | Connect with |
| - | - | - |
| Yes | Yes | Integrations or your own dispatcher |

## Connect

Connect Fly Machines on Integrations, and CostGraph starts sandboxes in your Fly Machines account. You don't run anything yourself.

1. In CostGraph, go to **Integrations > Sandbox > Fly Machines**.

2. Enter these fields:

   * **Organization token** (`FLY_API_TOKEN`, required): A Fly.io token for the organization, created with fly tokens create org.
   * **Organization** (`FLY_ORG`, required): The Fly.io organization slug. CostGraph creates an app there for each job and deletes it after.
   * **App name** (`FLY_APP_NAME`, optional): An existing Fly.io app to run every job in, instead of an app per job.
   * **Region** (`FLY_REGION`, optional): The Fly.io region machines run in, if not the default.
   * **CPU kind** (`FLY_CPU_KIND`, optional): Use shared for organizations without performance machines. The default is performance.

3. Click **Connect**.

### Your own dispatcher

To keep the key out of CostGraph or reach a private network, run your own dispatcher instead.
Set `provider` to `fly` and the preceding fields as environment variables, as described in [Run your own dispatcher](https://docs.costgraph.ai/costgraph/workflows/managed-sandboxes.md#run-your-own-dispatcher).

## Key and permissions

`FLY_API_TOKEN` is a Fly.io organization token, created with `fly tokens create org`. `FLY_ORG` is the organization slug. CostGraph creates an app in that organization for each job and deletes it after the job. To run every job in one existing app instead, set `FLY_APP_NAME`.

An organization token covers every app in the organization. With `FLY_APP_NAME` set, an app-scoped deploy token (`fly tokens create deploy -a <app>`) is enough for that app. Don't use the short-lived `fly auth token`.

Sources: [docs.fly.io: tokens](https://docs.fly.io/security/tokens.md), [docs.fly.io: fly tokens create deploy](https://docs.fly.io/flyctl/cmd/fly_tokens_create_deploy.md), [docs.fly.io: execute command](https://docs.fly.io/api/machines/machines/execute-command.md), [docs.fly.io: machine sizing](https://docs.fly.io/machines/guides-examples/machine-sizing.md).

## Limits

* Memory limits: up to 2 GB per shared CPU or 8 GB per performance CPU; minimum 2048 MB per performance CPU, with memory in multiples of 256 MB (shared) or 2048 MB (performance). ([source](https://docs.fly.io/machines/guides-examples/machine-sizing.md))
* Deploy tokens are valid for 20 years by default (set `--expiry`). ([source](https://docs.fly.io/flyctl/cmd/fly_tokens_create_deploy.md))

## Related

* [Supported sandbox providers](https://docs.costgraph.ai/costgraph/workflows/sandbox-providers.md)
* [Run workflows on a managed sandbox provider](https://docs.costgraph.ai/costgraph/workflows/managed-sandboxes.md)
* [Run CI jobs in sandboxes](https://docs.costgraph.ai/costgraph/autopilot/ci-sandboxes.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.