Cloudflare Sandbox SDK
Untrusted code executed in a per-session isolated Linux container with a persistent filesystem.
- Provider
- cloudflare
- Category
- Compute
- Official docs
- https://developers.cloudflare.com/sandbox/
| property | type | values | required | kind default | this component |
|---|---|---|---|---|---|
| autoscaling | boolean | — | no | false | ▸ true |
| containerBacked | boolean | — | no | true | inherited |
| criticality | enum | low | medium | high | no | medium | inherited |
| instancePerEntity | boolean | — | no | false | ▸ true |
| instances | integer | — | no | — | inherited |
| managed | boolean | — | no | false | ▸ true |
| ownsData | boolean | — | no | true | inherited |
| persistentFilesystem | boolean | — | no | true | inherited |
| runtime | string | — | no | — | inherited |
| sessionScoped | boolean | — | no | true | inherited |
| shardingStrategy | enum | none | consistent-hash | range | lookup | no | none | inherited |
| singleWriter | boolean | — | no | false | ▸ true |
| stateless | boolean | — | no | true | ▸ false |
Every rule whose selector covers this component's kind or its category. Whether a rule fires depends on the design: its properties, its edges and its groups.
A service that calls a third party synchronously, with no queue or workflow engine attached, has nowhere to park the request when the third party is slow or down. The failure becomes the user's problem instead of a retried job.
- — all of these hold:
- — the node has at least one synchronous outgoing edge to a third-party-api
- — this does not hold:
- — the node has at least one connected edge joining a workflow-engine or queue
Calling a worker synchronously puts the background job on the request path. The caller waits for the slowest part of the fan-out.
- — the node has at least one synchronous outgoing edge to a worker
A stateful service on a consistent hash ring needs something that owns the ring: detect a dead host, pick a replacement, tell everyone. Without a coordination service the ring is edited by hand during the outage.
- — all of these hold:
- — the node's `shardingStrategy` is "consistent-hash"
- — this does not hold:
- — the node has at least one connected edge joining a coordination-service
A stateful compute node pinned to exactly one availability zone disappears with that zone, and its state goes with it. Nodes inside a cell are exempt, because there the cell is deliberately single-zone and redundancy comes from the other cells.
- — all of these hold:
- — the node's `stateless` is false
- — the node sits inside exactly 1 availability-zone group
- — this does not hold:
- — the node sits inside at least one cell group
nodes:
- { id: "sandbox", component: "cloudflare-sandbox" }# yaml-language-server: $schema=../../schema/component.schema.json # Sandbox SDK: untrusted code run in a full Linux container addressed by a sandbox id. The "Sandbox # SDK" overview states each sandbox gets its own isolated container and that Durable Objects keep the # environment persistent with strong consistency, so it is a per-entity, stateful instance. schemaVersion: "1" type: "component" id: "cloudflare-sandbox" kind: "app-server" provider: "cloudflare" docs: "https://developers.cloudflare.com/sandbox/" defaults: managed: true stateless: false instancePerEntity: true singleWriter: true autoscaling: true properties: containerBacked: type: "boolean" default: true persistentFilesystem: type: "boolean" default: true sessionScoped: type: "boolean" default: true