--- title: Cloudflare Sandbox slug: cloudflare-sandbox url: "https://toolweight.com/options/cloudflare-sandbox" homepage: "https://developers.cloudflare.com/sandbox/" categories: sandbox-providers last_verified: 2026-01-15 license: CC-BY-4.0 --- # Cloudflare Sandbox > Container sandboxes driven from a Worker, addressed through Durable Objects. Cloudflare's Sandbox SDK runs containers on Cloudflare Containers and gives each one a Durable Object as its control plane, so a sandbox becomes addressable, stateful and callable directly from Worker code. Billing is metered in 10 ms increments and stops when the container sleeps. It is the lowest-friction option if your app already lives on Workers, and largely irrelevant if it does not. ## Identity | | | | --- | --- | | Name | Cloudflare Sandbox | | Company | Cloudflare | | One-liner | Container sandboxes driven from a Worker, addressed through Durable Objects. | | Site | https://developers.cloudflare.com/sandbox/ | | Docs | https://developers.cloudflare.com/containers/ | | Repo | https://github.com/cloudflare/sandbox-sdk | | Founded | 2009 | | Funding | Public | | Open source | Yes | | Licence | MIT | | Brand | https://toolweight.com/vendors/Cloudflare | | Compared in | 1 | ## Where it is compared ### [Sandbox providers](https://toolweight.com/compare/sandbox-providers) Ranked **#18 of 20** on default weights. | Field | Value | Confidence | Verified | Source | Note | | --- | --- | --- | --- | --- | --- | | Cold start | 3 s | Inferred | - | - | Estimate for a cold container instance. A warm instance behind a Durable Object responds in milliseconds; the first request after scale-to-zero is the expensive one. | | Cold start (claimed) | - | Unknown | - | - | Cloudflare publishes no single cold-start figure for Containers, which is unusually honest of them. | | Isolation | container | Vendor-claimed | 2026-01-15 | https://developers.cloudflare.com/containers/ | Containers on Cloudflare's own runtime, addressed by a Durable Object. | | Root in guest | ● | Inferred | - | - | Root inside the container image. | | Egress control | allowlist | Inferred | - | - | Outbound traffic routes through the Worker, so you can gate it in code, the most programmable egress control here. | | Max runtime | 60 min | Inferred | - | - | Instances sleep after a configurable inactivity timeout; long-lived processes are not the intended shape. | | Persistent FS | ○ | Inferred | - | - | Container disk is ephemeral; durable state belongs in the Durable Object, R2 or D1. | | Snapshot & fork | ○ | Inferred | - | - | - | | Custom images | ● | Vendor-claimed | 2026-01-15 | https://developers.cloudflare.com/containers/ | Your Dockerfile, pushed to Cloudflare's registry. | | GPU | ○ | Inferred | - | - | Workers AI is a separate product. | | Runtimes | any-oci-image | Inferred | - | - | - | | Preview URLs | ● | Vendor-claimed | 2026-01-15 | https://developers.cloudflare.com/sandbox/ | Ports are exposed through the Worker. | | Browser inside | ◐ | Inferred | - | - | Cloudflare Browser Rendering is a separate product; you can also run Chromium in the container. | | File up/download | ● | Vendor-claimed | 2026-01-15 | https://developers.cloudflare.com/sandbox/ | - | | Sydney region | ◐ | Inferred | - | - | Cloudflare has Sydney presence, but container placement follows their topology rather than a region you choose. | | Concurrent limit | 100 sandboxes | Inferred | - | - | Account-level container instance limits, raised on request. | | MCP server | ◐ | Inferred | - | - | Cloudflare invests heavily in MCP across its platform; the sandbox-specific server is less established than the SDK. | | SDKs | typescript | Inferred | - | - | - | | Streaming output | ● | Vendor-claimed | 2026-01-15 | https://developers.cloudflare.com/sandbox/ | - | | Price / hour | $0.18 /hr | Inferred | - | - | Approximate: 2 vCPU + 4 GiB at published Containers vCPU and memory rates, before the required paid Workers plan. | | Meter | per-10ms | Vendor-claimed | 2026-01-15 | https://developers.cloudflare.com/containers/pricing/ | The finest meter in this roster. | | Idle cost | free-when-stopped | Vendor-claimed | 2026-01-15 | https://developers.cloudflare.com/containers/pricing/ | Billing stops when the instance sleeps. | | GitHub stars | - | Inferred | - | - | - | | Funding | public | Vendor-claimed | 2026-01-15 | https://cloudflare.net | - | | Shipped | 2025 | Vendor-claimed | 2026-01-15 | https://blog.cloudflare.com/containers-are-available-in-public-beta-for-simple-global-and-programmable/ | - | | Positioning | Containers you can call from a Worker, with a Durable Object as the control plane. | Inferred | - | - | - | **Verdict.** Structurally the most interesting design here, a sandbox that is an addressable object in your app, with egress you gate in Worker code, and the slowest to cold start. Take it if your stack is already Workers; do not migrate to Cloudflare for the sandbox alone. ## Alternatives - [ascii](https://toolweight.com/options/ascii), Agent orchestration over Telegram, running on box's VM infrastructure. - [Blaxel](https://toolweight.com/options/blaxel), Agent-first cloud claiming ~25 ms microVM boots from snapshots. - [box](https://toolweight.com/options/box), Persistent Linux VMs with SSH, per-VM IPv4 and disk-level forking, priced flat. - [CodeSandbox SDK](https://toolweight.com/options/codesandbox-sdk), Firecracker VMs with memory snapshots, from the online IDE, now owned by Together AI. - [Daytona](https://toolweight.com/options/daytona), Sub-second container sandboxes for agent workloads, from a team that built a dev-env manager. - [Self-hosted Firecracker](https://toolweight.com/options/diy-firecracker), The baseline: Firecracker on your own metal, plus every hard part you now own. - [E2B](https://toolweight.com/options/e2b), Open-source Firecracker sandboxes with Python and TypeScript SDKs for AI agents. - [exe.dev](https://toolweight.com/options/exe-dev), Persistent VMs you SSH into, with root, apt and systemd, on a flat monthly plan. - [Fly.io Machines](https://toolweight.com/options/fly-machines), Raw Firecracker microVMs with a REST API, durable volumes and 35+ regions. - [Freestyle](https://toolweight.com/options/freestyle), Run untrusted JavaScript and full dev servers, with git hosting and domains built in. - [GitHub Codespaces](https://toolweight.com/options/github-codespaces), Devcontainer-backed cloud VMs built for humans, occasionally repurposed for agents. - [Islo](https://toolweight.com/options/islo), Per-agent isolated cloud sandboxes with enterprise policy controls, from Incredibuild. ## Licence and attribution Data from toolweight (https://toolweight.com), licensed CC-BY-4.0. - Licence: [CC-BY-4.0](https://creativecommons.org/licenses/by/4.0/) - Canonical HTML: https://toolweight.com/options/cloudflare-sandbox - Machine-readable: https://toolweight.com/options/cloudflare-sandbox.md · https://toolweight.com/api/v1 · https://toolweight.com/mcp - toolweight takes no affiliate revenue and sells no placements. Corrections: https://toolweight.com/suggest