Google Cloud Run Sandboxes: Safe AI Code Execution

Ever had that sinking feeling when an AI-generated script starts poking around your production database? You’re not alone. Google Cloud just threw us a lifebuoy: Cloud Run sandboxes are now in public preview. These lightweight, isolated environments let you run untrusted code—from LLM-generated Python to headless browsers—without risking your host app, data, or credentials.

Think of it as a secure, fenced-off pool within your serverless swamp. No more building complex sandboxing infrastructure or paying for pricey microVM runtimes. Just a simple flag and you’re good to go.

What’s a Cloud Run Sandbox?

It’s a near-instant, isolated execution boundary that lives inside your existing Cloud Run service instances. Whether you need to let an LLM crunch numbers or spin up a headless browser for web research, sandboxes keep things separate without leaving your serverless environment.

Core Use Cases

• LLM Code Interpreters: Let your AI write and execute Python, R, or SQL to analyze data, generate charts, and do math—safely.
• Headless Browsers: Give agents a secure environment to scrape pages, take screenshots, and automate web workflows.
• User-Submitted Code: Run custom scripts, plugins, or webhooks from end-users without fear.

How It Works

Enabling sandboxes is as simple as adding a --sandbox-launcher flag to your deployment. Then, a lightweight sandbox CLI binary is mounted into your container. Spawn a sandbox with a subprocess call:

import subprocess

def run_untrusted_code(llm_code: str):
    with open("/tmp/generated_script.py", "w") as f:
        f.write(llm_code)
    result = subprocess.run(
        ["sandbox", "do", "--", "python3", "/tmp/generated_script.py"],
        capture_output=True, text=True, timeout=10
    )
    return result.stdout if result.returncode == 0 else result.stderr

Security by Design

Cloud Run sandboxes enforce three critical boundaries:

• Credential isolation: No access to environment variables or the metadata server.
• Locked-down egress: Zero outbound network by default. Enable explicitly with --allow-egress.
• Safe filesystem overlay: Read-only view of your container’s filesystem; writes go to a temporary memory overlay that’s discarded after execution. You can import/export files as needed.

Built-in Support for ADK and ComputeSDK

The next version of Agent Development Kit will include CloudRunSandboxCodeExecutor for one-line code execution. ComputeSDK also supports Cloud Run sandboxes, allowing remote or local invocation.

Pricing: No Extra Cost

Unlike dedicated sandbox platforms that charge premiums, Cloud Run sandboxes run on your existing allocated CPU and memory—no additional cost. Check out the documentation to get started.

For more on Google Cloud’s serverless offerings, see our Google Cloud Review. And if you’re comparing AI model costs, our pricing comparison might help.

Original announcement published on Google Cloud.