Intro to Render Sandboxes

Run untrusted code in an isolated, on-demand environment.

Render Sandboxes is in public beta.

APIs, defaults, and limits might change during the beta period.

Render Sandboxes provides managed, ephemeral environments for executing untrusted code. Use sandboxes for AI agents, code interpreters, builds, tests, and other workloads that need an isolated OS environment.

At a glance

You create a sandbox with the Render CLI or SDK.
Inside the sandbox, you (and your agents) can execute commands and manage files.
When you're finished with the sandbox, terminate it.
- A sandbox also terminates automatically when its configured runtime timeout expires.
- You can disable a sandbox's timeouts so it runs indefinitely.

Termination permanently deletes the sandbox's filesystem. Before terminating, you can download any files you need or capture a snapshot to reuse state in a new sandbox.

Core features

Isolated execution

Execute commands and agent-generated code in a contained environment with its own filesystem.
Reusable snapshots

Capture sandbox state to reuse a prepared filesystem or resume a process in a new sandbox.
File transfers

Upload any code and files, then download the output your sandbox produces.
Automatic idle suspension

Sandboxes can suspend when idle and resume automatically when you next interact.
Configurable compute

Choose a compute plan with the CPU and RAM each workload needs.
Network controls

Configure access to allow outbound traffic to a specific set of destinations (or none at all).

Quickstart

1. Install the CLI or SDK

Requires Render CLI version 2.34.0 or later.

Use any of the following methods to install the Render CLI or upgrade to the latest version:

Run the following commands:

shell

$ brew update
$ brew install render

Run the following command:

shell

$ winget install render.cli

Installing with `curl`

Run the following command:

shell

$ curl -fsSL https://raw.githubusercontent.com/render-oss/cli/refs/heads/main/bin/install.sh | sh

We recommend building from source only if no other installation method works for your system.

Install the Go programming language if you haven't already.
Clone and build the CLI project with the following commands:
shell
```
$ git clone git@github.com:render-oss/cli.git
$ cd cli
$ go build -o render
```

After installation completes, open a new terminal tab and run render with no arguments to confirm.

From your TypeScript project directory:

shell

$ npm install @renderinc/sdk@latest

(Or pnpm install, bun add, etc.)

If you already have the SDK installed, make sure you're using version 1.8.0 or later:

shell

$ npm install @renderinc/sdk@latest

After installing, make sure @renderinc/sdk is listed as a dependency in your package.json file at version ^1.8.0 or later.

From your Python project directory:

shell

$ pip install render

If you already have the SDK installed, make sure you're using version 1.8.0 or later:

shell

$ pip install --upgrade render

After installing, make sure to add render>=1.8.0 as a dependency in your application's requirements.txt, pyproject.toml, or equivalent.

2. Set up credentials

Create an API key from your Account Settings page in the Render Dashboard.
Set the following environment variables wherever the CLI or SDK will run, replacing values as indicated:
shell
```
$ export RENDER_API_KEY='rnd_abc123'
$ export RENDER_WORKSPACE_ID='tea-def456'
```
- Replace rnd_abc123 with your API key.
- Replace tea-def456 with your workspace's ID, available at the top of its Settings page in the Render Dashboard.
For the CLI, also set your active workspace:
shell
```
$ render workspace set tea-abc123
```
- Replace tea-abc123 with your workspace's ID.

3. Create a sandbox and execute a command

The following example creates a sandbox with a five-minute runtime timeout, waits until it's running, executes a basic echo command, then terminates the sandbox:

shell

  # Create a sandbox and wait until it's running.
$ render sandboxes create --timeout=300 --wait
  
  # Replace sbx-abc123 with the ID returned by create.
$ render sandboxes exec sbx-abc123 -- echo hello from Render
  
  # Terminate the sandbox.
$ render sandboxes stop sbx-abc123 --confirm

index.ts

typescript

import { Render } from '@renderinc/sdk'

const sandboxes = new Render().sandboxes
const sandbox = await sandboxes.create({ timeoutSeconds: 300, wait: true })

try {
  const events = await sandboxes.exec(sandbox.id, 'echo hello from Render')

  for await (const event of events) {
    if (event.type === 'output') {
      const stream = event.stream === 'stderr' ? process.stderr : process.stdout
      stream.write(event.data)
    } else if (event.type === 'exit') {
      console.log(`Exit code: ${event.exit_code}`)
    }
  }
} finally {
  await sandboxes.terminate(sandbox.id)
}

main.py

python

import sys
from render import Render
from render.sandbox import SandboxExecExit, SandboxExecOutput

sandboxes = Render().sandboxes
sandbox = sandboxes.create(timeout_seconds=300, wait=True)

try:
    for event in sandboxes.exec(sandbox.id, "echo hello from Render"):
        if isinstance(event, SandboxExecOutput):
            stream = sys.stderr if event.stream == "stderr" else sys.stdout
            print(event.data, end="", file=stream, flush=True)
        elif isinstance(event, SandboxExecExit):
            print(f"Exit code: {event.exit_code}")
finally:
    sandboxes.terminate(sandbox.id)

main.py

python

import asyncio
import sys
from render import RenderAsync
from render.sandbox import SandboxExecExit, SandboxExecOutput

async def main():
    sandboxes = RenderAsync().sandboxes
    sandbox = await sandboxes.create(timeout_seconds=300, wait=True)

    try:
        async for event in sandboxes.exec(sandbox.id, "echo hello from Render"):
            if isinstance(event, SandboxExecOutput):
                stream = sys.stderr if event.stream == "stderr" else sys.stdout
                print(event.data, end="", file=stream, flush=True)
            elif isinstance(event, SandboxExecExit):
                print(f"Exit code: {event.exit_code}")
    finally:
        await sandboxes.terminate(sandbox.id)

asyncio.run(main())

Next steps

After creating your first sandbox, explore how to:

Execute commands, process their output, and handle command failures.
Upload and download files, including entire directories.
Capture snapshots and restore from them to reuse files, installed packages, and running processes in new sandboxes.
Configure sandbox behavior, including compute, timeouts, environment variables, and network access.
Manage sandbox groups to organize workloads and set separate concurrency limits.

References

For detailed command and SDK reference material, see:

Limits

For available compute plans, sandbox runtime timeouts, concurrency, and API rate limits, see Limits for Render Sandboxes.

Beta limitations

We'll address these limitations during the beta period:

Sandboxes do not yet support private networking to connect to your other Render services and datastores.
Sandboxes do not yet provide public URLs for accessing applications running inside them.
Credential brokering is not yet generally available.
Scoped API keys are not yet generally available.

Interested in early access to some of these additions?

Reach out with details about your use case:

Talk to our team

Intro to Render Sandboxes

Run untrusted code in an isolated, on-demand environment.

At a glance

Core features

Quickstart

1. Install the CLI or SDK

Homebrew installation

WinGet installation

Installing with `curl`

Direct download

Building from source

2. Set up credentials

3. Create a sandbox and execute a command

Next steps

References

Limits

Beta limitations

Intro to Render Sandboxes

At a glance

Core features

Quickstart

1. Install the CLI or SDK

Homebrew installation

WinGet installation

Installing with curl

Direct download

Building from source

2. Set up credentials

3. Create a sandbox and execute a command

Next steps

References

Limits

Beta limitations

Intro to Render Sandboxes

Installing with `curl`