Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 0 additions & 5 deletions .changeset/chilly-pugs-cross.md

This file was deleted.

7 changes: 0 additions & 7 deletions .changeset/docker-layer-caching.md

This file was deleted.

7 changes: 0 additions & 7 deletions .changeset/giant-paths-enjoy.md

This file was deleted.

5 changes: 0 additions & 5 deletions .changeset/hot-pans-warn.md

This file was deleted.

4 changes: 2 additions & 2 deletions examples/claude-code/Dockerfile
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
FROM docker.io/cloudflare/sandbox:0.4.13
FROM docker.io/cloudflare/sandbox:0.4.14
RUN npm install -g @anthropic-ai/claude-code
ENV COMMAND_TIMEOUT_MS=300000
EXPOSE 3000

# On a Mac with Apple Silicon, you might need to specify the platform:
# FROM --platform=linux/arm64 docker.io/cloudflare/sandbox:0.4.13
# FROM --platform=linux/arm64 docker.io/cloudflare/sandbox:0.4.14
6 changes: 3 additions & 3 deletions examples/code-interpreter/Dockerfile
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
# This image is unique to this repo, and you'll never need it.
# Whenever you're integrating with sandbox SDK in your own project,
# you should use the official image instead:
# FROM docker.io/cloudflare/sandbox:0.4.13
FROM cloudflare/sandbox-test:0.4.13
# FROM docker.io/cloudflare/sandbox:0.4.14
FROM cloudflare/sandbox-test:0.4.14

# On a mac, you might need to actively pick up the
# arm64 build of the image.
# FROM --platform=linux/arm64 cloudflare/sandbox-test:0.4.13
# FROM --platform=linux/arm64 cloudflare/sandbox-test:0.4.14
4 changes: 2 additions & 2 deletions examples/minimal/Dockerfile
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
FROM docker.io/cloudflare/sandbox:0.4.13
FROM docker.io/cloudflare/sandbox:0.4.14

# On a Mac with Apple Silicon, you might need to specify the platform:
# FROM --platform=linux/arm64 docker.io/cloudflare/sandbox:0.4.13
# FROM --platform=linux/arm64 docker.io/cloudflare/sandbox:0.4.14

# Required during local development to access exposed ports
EXPOSE 8080
27 changes: 21 additions & 6 deletions package-lock.json

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

44 changes: 28 additions & 16 deletions packages/sandbox/CHANGELOG.md
Original file line number Diff line number Diff line change
@@ -1,5 +1,21 @@
# @cloudflare/sandbox

## 0.4.14

### Patch Changes

- [#172](https://github.com/cloudflare/sandbox-sdk/pull/172) [`1bf3576`](https://github.com/cloudflare/sandbox-sdk/commit/1bf35768b02532c77df6f30a2f2eb08cb2b12115) Thanks [@threepointone](https://github.com/threepointone)! - Update dependencies

- [#176](https://github.com/cloudflare/sandbox-sdk/pull/176) [`7edbfa9`](https://github.com/cloudflare/sandbox-sdk/commit/7edbfa906668d75f540527f50b52483dc787192c) Thanks [@ghostwriternr](https://github.com/ghostwriternr)! - Add cache mounts to Dockerfile for faster builds

Adds cache mounts for npm, apt, and pip package managers in the Dockerfile. This speeds up Docker image builds when dependencies change, particularly beneficial for users building from source.

- [#172](https://github.com/cloudflare/sandbox-sdk/pull/172) [`1bf3576`](https://github.com/cloudflare/sandbox-sdk/commit/1bf35768b02532c77df6f30a2f2eb08cb2b12115) Thanks [@threepointone](https://github.com/threepointone)! - Fix type generation

We inline types from `@repo/shared` so that it includes the types we reexport. Fixes #165

- [#175](https://github.com/cloudflare/sandbox-sdk/pull/175) [`77cb937`](https://github.com/cloudflare/sandbox-sdk/commit/77cb93762a619523758f769a10509e665ca819fe) Thanks [@ghostwriternr](https://github.com/ghostwriternr)! - Move .connect to .wsConnect within DO stub

## 0.4.13

### Patch Changes
Expand Down Expand Up @@ -37,7 +53,6 @@
This adds a new `exists()` method to the SDK that checks whether a file or directory exists at a given path. The method returns a boolean indicating existence, similar to Python's `os.path.exists()` and JavaScript's `fs.existsSync()`.

The implementation is end-to-end:

- New `FileExistsResult` and `FileExistsRequest` types in shared package
- Handler endpoint at `/api/exists` in container layer
- Client method in `FileClient` and `Sandbox` classes
Expand Down Expand Up @@ -136,50 +151,47 @@
Implements PID namespace isolation to protect control plane processes (Jupyter, Bun) from sandboxed code. Commands executed via `exec()` now run in isolated namespaces that cannot see or interact with system processes.

**Key security improvements:**

- Control plane processes are hidden from sandboxed commands
- Platform secrets in `/proc/1/environ` are inaccessible
- Ports 8888 (Jupyter) and 3000 (Bun) are protected from hijacking

**Breaking changes:**

1. **Removed `sessionId` parameter**: The `sessionId` parameter has been removed from all methods (`exec()`, `execStream()`, `startProcess()`, etc.). Each sandbox now maintains its own persistent session automatically.

```javascript
// Before: manual session management
await sandbox.exec("cd /app", { sessionId: "my-session" });
await sandbox.exec('cd /app', { sessionId: 'my-session' });

// After: automatic session per sandbox
await sandbox.exec("cd /app");
await sandbox.exec('cd /app');
```

2. **Commands now maintain state**: Commands within the same sandbox now share state (working directory, environment variables, background processes). Previously each command was stateless.

```javascript
// Before: each exec was independent
await sandbox.exec("cd /app");
await sandbox.exec("pwd"); // Output: /workspace
await sandbox.exec('cd /app');
await sandbox.exec('pwd'); // Output: /workspace

// After: state persists in session
await sandbox.exec("cd /app");
await sandbox.exec("pwd"); // Output: /app
await sandbox.exec('cd /app');
await sandbox.exec('pwd'); // Output: /app
```

**Migration guide:**

- Remove `sessionId` from all method calls - each sandbox maintains its own session
- If you need isolated execution contexts within the same sandbox, use `sandbox.createSession()`:
```javascript
// Create independent sessions with different environments
const buildSession = await sandbox.createSession({
name: "build",
env: { NODE_ENV: "production" },
cwd: "/build",
name: 'build',
env: { NODE_ENV: 'production' },
cwd: '/build'
});
const testSession = await sandbox.createSession({
name: "test",
env: { NODE_ENV: "test" },
cwd: "/test",
name: 'test',
env: { NODE_ENV: 'test' },
cwd: '/test'
});
```
- Environment variables set in one command persist to the next
Expand Down
2 changes: 1 addition & 1 deletion packages/sandbox/package.json
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"name": "@cloudflare/sandbox",
"version": "0.4.13",
"version": "0.4.14",
"repository": {
"type": "git",
"url": "https://github.com/cloudflare/sandbox-sdk"
Expand Down
2 changes: 1 addition & 1 deletion packages/sandbox/src/version.ts
Original file line number Diff line number Diff line change
Expand Up @@ -3,4 +3,4 @@
* This file is auto-updated by .github/changeset-version.ts during releases
* DO NOT EDIT MANUALLY - Changes will be overwritten on the next version bump
*/
export const SDK_VERSION = '0.4.13';
export const SDK_VERSION = '0.4.14';
2 changes: 1 addition & 1 deletion tests/e2e/test-worker/Dockerfile
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
# Integration test Dockerfile
FROM docker.io/cloudflare/sandbox-test:0.4.13
FROM docker.io/cloudflare/sandbox-test:0.4.14

# Expose ports used for testing
EXPOSE 8080
6 changes: 3 additions & 3 deletions tests/integration/Dockerfile
Original file line number Diff line number Diff line change
@@ -1,12 +1,12 @@
# This image is unique to this repo, and you'll never need it.
# Whenever you're integrating with sandbox SDK in your own project,
# you should use the official image instead:
# FROM docker.io/cloudflare/sandbox:0.4.13
FROM cloudflare/sandbox-test:0.4.13
# FROM docker.io/cloudflare/sandbox:0.4.14
FROM cloudflare/sandbox-test:0.4.14

# On a mac, you might need to actively pick up the
# arm64 build of the image.
# FROM --platform=linux/arm64 cloudflare/sandbox-test:0.4.13
# FROM --platform=linux/arm64 cloudflare/sandbox-test:0.4.14

# Expose the ports you want to expose
EXPOSE 8080
Expand Down