Google Cloud Run sandboxes are in public preview

Running untrusted code generated by LLMs or submitted by users creates a fundamental tension: you need to give that code enough resources and system access to do useful work, but you also need to protect your host application, environment variables, cloud credentials, and network from malicious or buggy execution. Until now, the practical answer involved either building your own sandboxing infrastructure with container clusters or paying a premium for third-party microVM runtimes. Neither option felt native to the serverless experience developers already rely on.

Google Cloud Run sandboxes, now in public preview, aim to solve this by letting you spawn lightweight, isolated execution boundaries directly inside your existing Cloud Run service instances. The setup requires only a single flag during deployment, after which a sandbox CLI binary is automatically mounted into your environment. Sandboxes start in milliseconds, and the demo shows handling 1,000 sandboxes with an average 500ms latency. The security model is zero-trust by default: sandboxes have no access to the service’s environment variables or the Google Cloud metadata server, all network egress is blocked unless explicitly enabled, and file writes go to a temporary memory overlay that is discarded when execution ends. These sandboxes support LLM code interpreters for running Python, R, or SQL code, headless browsers for web scraping, and user-submitted code execution.

For a serious builder, the decisive advantage is operational simplicity and cost. Because sandboxes run on your already-allocated CPU and memory, there is no additional cost or premium over the underlying Cloud Run service. This contrasts with dedicated sandbox hosting platforms that charge per-microVM. The integration with Agent Development Kit and ComputeSDK also means you can invoke sandboxes remotely or as a local tool with minimal code. If you already run agent workloads on Cloud Run and need to execute untrusted code with strong isolation guarantees without rebuilding your architecture, this feature is worth evaluating immediately.