> ## Documentation Index
> Fetch the complete documentation index at: https://docs.costgraph.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Modal sandboxes

> Run CostGraph workflows and CI jobs in Modal sandboxes: the key to create, its permissions, and its limits

Modal Sandboxes are secure containers on Modal's serverless platform for running arbitrary code at runtime, with elastic CPU and memory.

The following table shows what CostGraph runs on this provider.

| Workflows | CI runners | Connect with |
| - | - | - |
| Yes | Yes | Integrations or your own dispatcher |

## Connect

Connect Modal on Integrations, and CostGraph starts sandboxes in your Modal account. You don't run anything yourself.

1. In CostGraph, go to **Integrations > Sandbox > Modal**.

2. Enter these fields:

   * **Token ID** (`MODAL_TOKEN_ID`, required): The ID of a Modal service user token.
   * **Token secret** (`MODAL_TOKEN_SECRET`, required): The secret of that Modal token.

3. Click **Connect**.

### Your own dispatcher

To keep the key out of CostGraph or reach a private network, run your own dispatcher instead.
Set `provider` to `modal` and the preceding fields as environment variables, as described in [Run your own dispatcher](https://docs.costgraph.ai/costgraph/workflows/managed-sandboxes.md#run-your-own-dispatcher).

To see what Modal costs, connect the [Modal integration](https://docs.costgraph.ai/costgraph/integrations/modal.md).

## Key and permissions

MODAL\_TOKEN\_ID and MODAL\_TOKEN\_SECRET are the two halves of a Modal token. For CI, create a Service User at Settings > Tokens > Service users (or `modal workspace service-users create <name>`), which prints both values once. A personal token can also be created with "modal token new".

Documented (Team/Enterprise with RBAC): a service user starts with no access to any Environment. Grant it the Contributor role (full read/write) on the one Environment where the sandboxes run; Viewer is read-only. Creating a service user needs workspace owner or manager. Without RBAC, tokens are workspace-wide.

Sources: [modal.com: sandboxes](https://modal.com/docs/guide/sandboxes.md), [modal.com: sandbox resources](https://modal.com/docs/guide/sandbox-resources.md), [modal.com: resources](https://modal.com/docs/guide/resources.md), [modal.com: service users](https://modal.com/docs/guide/service-users.md), [modal.com: rbac](https://modal.com/docs/guide/rbac.md).

## Limits

* Default maximum lifetime is 5 minutes, and timeout can be raised to 24 hours. idle\_timeout ends a sandbox after inactivity. ([source](https://modal.com/docs/guide/sandboxes.md))
* The default request is 0.125 CPU cores and 128 MiB, and sandboxes can burst above it. 1 core = 2 vCPUs. The default soft CPU limit is 16 cores above the request. A maximum is enforced at creation, but its value is not stated on the page. ([source](https://modal.com/docs/guide/resources.md))
* Setting a region (for example us-west) adds a price multiplier. GPU sandboxes can be preempted. ([source](https://modal.com/docs/guide/region-selection.md))
* Service users are a Team/Enterprise plan feature. ([source](https://modal.com/docs/guide/service-users.md))

## Related

* [Supported sandbox providers](https://docs.costgraph.ai/costgraph/workflows/sandbox-providers.md)
* [Run workflows on a managed sandbox provider](https://docs.costgraph.ai/costgraph/workflows/managed-sandboxes.md)
* [Run CI jobs in sandboxes](https://docs.costgraph.ai/costgraph/autopilot/ci-sandboxes.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.