Run untrusted or agent-generated code in an isolated Cloudflare Sandbox from a Worker using RPC transport, with commands, files, sessions, and tunnels

Documented steps

1. Confirm the account is on the Workers Paid plan; the Sandbox SDK requires it (https://developers.cloudflare.com/sandbox/).
2. Scaffold: npm create cloudflare@latest -- my-sandbox --template=cloudflare/sandbox-sdk/examples/minimal . The runtime package is @cloudflare/sandbox .
3. Pin the Dockerfile base image to the exact npm package version, e.g. FROM docker.io/cloudflare/sandbox:0.7.0 (or the -python / -opencode variant). Reference: https://developers.cloudflare.com/sandbox/configuration/dockerfile/
4. Configure wrangler.jsonc: "containers": [{ "class_name": "Sandbox", "image": "./Dockerfile", "instance_type": "lite", "max_instances": 1 }], "durable_objects": { "bindings": [{ "name": "Sandbox", "class_name": "Sandbox" }] }, "migrations": [{ "tag": "v1", "new_sqlite_classes": ["Sandbox"] }]
5. Select RPC transport explicitly: set SANDBOX_TRANSPORT: 'rpc' in wrangler config or pass { transport: 'rpc' } to getSandbox(). HTTP and WebSocket transports are being removed (https://developers.cloudflare.com/sandbox/guides/2026-deprecation/).
6. Get an instance keyed per tenant or per user so workloads stay isolated: const sandbox = getSandbox(env.Sandbox, 'user-123', { transport: 'rpc' });
7. Execute a command: const result = await sandbox.exec('python3 -c "print(2+2)"'); which returns { stdout, stderr, exitCode, success }.
8. Move files in and out: await sandbox.writeFile('/workspace/hello.txt', 'Hello, Sandbox!'); const contents = await sandbox.readFile('/workspace/hello.txt');
9. For persistent shell state across requests use explicit sessions: const session = await sandbox.createSession({ id, env, cwd }); await session.exec(...); then sandbox.deleteSession(sessionId) when done (https://developers.cloudflare.com/sandbox/api/sessions/).
10. Expose a service running inside the sandbox with the Tunnels API, which is RPC-only: const tunnel = await sandbox.tunnels.get(8080); returns a https://<random-words>.trycloudflare.com URL. Use sandbox.tunnels.get(8080, { name: 'app' }) for a stable named tunnel.
11. Deploy with npx wrangler deploy (Docker must be running locally so the image can be built and pushed).