Preinstalled sandbox software

Every Runtype Sandbox container starts from the same Linux image. The software on this page is installed in that image, so your code can use it without an install step and without network access.

The image backs these features:

• Custom Tools that set sandboxProvider to runtype-sandbox. For more information, see Creating custom tools.
• An Agent’s Linux computer, which gives the Agent the bash, file, and process tools. For more information, see Agent Sandbox tools.
• Sandbox deployments that run a server at a preview URL. For more information, see Deploy a sandbox preview.

Preinstalled software matters most for a custom Tool. Tool code has no network access unless the Tool sets networkAccess, so it can’t download a package at run time. Code runs as root, and an Agent’s commands start in /workspace.

Operating system

The image runs Ubuntu 22.04 LTS on the x86_64 (amd64) architecture. The following table lists the build tools that the image adds to the operating system:

Languages and runtimes

The following table lists the language runtimes:

Package managers

The following table lists the package managers. Each one needs network access to download a package:

Python packages

The following Python packages are installed for the default python3. Import them directly from a Python Tool:

The installation also includes the packages that these depend on, such as python-dateutil. matplotlib uses the Agg backend, so a plot renders to a file instead of a window. Call savefig to write an image to disk.

Command-line tools

The following table lists the command-line tools:

Network commands such as git clone and curl reach only the hosts that the sandbox’s network settings allow.

Runtype CLI

The Runtype CLI is installed so that code in the sandbox can call Runtype. The following table lists its version:

For commands, see Runtype CLI reference.

Coding agents

Five coding-agent command-line programs are installed and configured to use Runtype’s in-sandbox model endpoint. None of them needs an API key. The following table lists them:

The model endpoint is available in an Agent’s Linux computer and in a Flow’s transform-data step that sets inference to true. For more information, see Run a coding agent in the step. In custom Tools and sandbox deployments, the coding agents are installed but have no model endpoint. Each agent has its own default model:

• opencode, pi and fx default to the @cf/zai-org/glm-5.2 Workers AI model. They can also use @cf/moonshotai/kimi-k2.7-code, @cf/openai/gpt-oss-120b, or any other Workers AI text model ID.
• Claude Code defaults to claude-sonnet-4-5 and can use any Claude model. To choose one, pass --model.
• Codex defaults to gpt-5.1-codex and can use any OpenAI model. To choose one, pass --model.

Any program in the sandbox can call the endpoint without an API key, in one of three formats:

To point an Anthropic or OpenAI client library at the endpoint, set its base URL to https://inference.sandbox.runtype.internal (Anthropic) or https://inference.sandbox.runtype.internal/v1 (OpenAI). If the library requires an API key, any placeholder value works.

• Billing. If your organization added its own key for the model’s provider, the request uses that key and the provider bills you directly. Otherwise, it runs on Runtype platform credit and is metered as usage for your organization, like any other model call. Platform credit serves only models with catalog pricing.
• Spend cap. Platform-credit requests from one Linux computer are capped at $10 for as long as it keeps running. After that, the endpoint answers 402 with the code sandbox_spend_cap_reached until the computer restarts. Requests that use your own provider key don’t count toward the cap. Token counting (/v1/messages/count_tokens) is free and never counts toward the cap.
• Options not available on platform credit. Background responses aren’t supported on any key. On platform credit, the Anthropic Messages and OpenAI Responses formats also refuse premium service tiers, fast mode, and provider-billed server tools such as code execution. Web search is supported and is billed as usage. To use the other options, add your own provider key.
• Zero data retention. If your organization requires zero data retention, use the OpenAI Chat Completions format. The Anthropic Messages and OpenAI Responses formats answer 400 with the code zero_data_retention_unsupported.

To let an Agent hand a task to opencode and follow it as a typed session, set config.sandbox.codingAgents. For more information, see Coding-agent sessions.

Install more software

The image doesn’t include every package. To add one, follow the method for your feature:

• Agent’s Linux computer: By default, the sandbox can reach package registries, OS mirrors, and GitHub. The Agent can run npm install, pip install, uv pip install, or apt-get install with bash. To install packages once when the machine starts, add the commands to setupCommands. For more information, see Sandbox.
• Custom Tool: Tool code has no network access by default, so it can’t install packages at run time. Use the preinstalled packages on this page, or run the code in an Agent’s Linux computer.
• Sandbox deployment: For JavaScript and TypeScript, send packageJson. Runtype runs npm install before it starts your code. For more information, see Deploy a sandbox preview.

A package that you install lasts only as long as the sandbox’s files. It isn’t added to the image, so a new sandbox starts without it.

Next steps

• Creating custom tools: run JavaScript, TypeScript, or Python in Runtype Sandbox.
• Agent Sandbox tools: give an Agent a Linux computer.
• Deploy a sandbox preview: run a server in a sandbox and get a preview URL.