> ## Documentation Index
> Fetch the complete documentation index at: https://docs.costgraph.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Runtime sandboxes

> Run CostGraph workflows and CI jobs in Runtime sandboxes: the key to create, its permissions, and its limits

Runtime Cloud (withruntime) provides Linux sandboxes for AI agents' code, each a Firecracker microVM that can pause with memory kept, fork and snapshot.

The following table shows what CostGraph runs on this provider.

| Workflows | CI runners | Connect with |
| - | - | - |
| Yes | Yes | Integrations or your own dispatcher |

## Connect

Connect Runtime on Integrations, and CostGraph starts sandboxes in your Runtime account. You don't run anything yourself.

1. In CostGraph, go to **Integrations > Sandbox > Runtime**.

2. Enter these fields:

   * **API key** (`RUNTIME_API_KEY`, required): A Runtime API key from withruntime.com/account/keys.

3. Click **Connect**.

For CI runners, CostGraph sets CPU and memory.

### Your own dispatcher

To keep the key out of CostGraph or reach a private network, run your own dispatcher instead.
Set `provider` to `runtime` and the preceding fields as environment variables, as described in [Run your own dispatcher](https://docs.costgraph.ai/costgraph/workflows/managed-sandboxes.md#run-your-own-dispatcher).

To see what Runtime costs, connect the [Runtime integration](https://docs.costgraph.ai/costgraph/integrations/runtime.md).

## Key and permissions

RUNTIME\_API\_KEY is a Runtime Cloud API key created at withruntime.com/account/keys, with "runtime keys create" (npx withruntime keys create), or POST /v1/keys. Owners, admins and developers can create keys; billing members cannot. Sent as Authorization: Bearer.

Keys are configured with access (full|read), reach (agent default|account), optional sandboxes+actions limit (1-20 named sandboxes; actions get, create, stop, exec, read\_file, write\_file) and dailyLimitMicros. Minimum for create/exec/list/delete: access=full, reach=agent (default; the key sees only sandboxes it created, others return 404), with a daily spend limit. A sandbox/action-limited key covers only named existing sandboxes and lists no delete action, so it does not fit. A key can never do more than the person who made it.

Sources: [withruntime.com: teams](https://withruntime.com/docs/teams.md), [withruntime.com: limits](https://withruntime.com/docs/limits.md), [withruntime.com: api](https://withruntime.com/docs/api.md), [withruntime.com: products](https://withruntime.com/docs/products.md), [withruntime.com: keys](https://withruntime.com/account/keys).

## Limits

* Per sandbox: up to 16 vCPU / 64 GiB RAM / 400 GiB disk with credit; 2 vCPU / 4 GiB / 10 GiB without. ([source](https://withruntime.com/docs/limits.md))
* Account: 100 running sandboxes with credit (200 with auto top-up), 200 vCPU and 400 GiB across running sandboxes; 4 sandboxes / 8 vCPU without credit. ([source](https://withruntime.com/docs/limits.md))
* timeoutSeconds 60-86,400 (24 h) or 0 = no limit (default); idlePauseSeconds default 300 (0 = never); onTimeout default pause. ([source](https://withruntime.com/docs/api.md))
* Regions are per account (GET /v1/limits); CPU architecture not documented. Sandboxes listed as Available (not beta). ([source](https://withruntime.com/docs/products.md))

## Related

* [Supported sandbox providers](https://docs.costgraph.ai/costgraph/workflows/sandbox-providers.md)
* [Run workflows on a managed sandbox provider](https://docs.costgraph.ai/costgraph/workflows/managed-sandboxes.md)
* [Run CI jobs in sandboxes](https://docs.costgraph.ai/costgraph/autopilot/ci-sandboxes.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.