Secure sandboxes for AI code
Run agent and LLM-generated code in isolated cloud environments that start in about half a second. Fork them from memory snapshots, attach a GPU, run Docker inside, and control what they can reach. Drive them from the Python or TypeScript SDK.
sb = Sandbox(gpu="RTX4090").create()
sb.process.exec("sh", "-c", "npx http-server -p 3000")
url = sb.expose_port(3000)
snap = sb.snapshot_memory()
Sandbox().create_from_memory_snapshot(snap)A cloud environment for agents
Your agent creates sandboxes from code, runs commands in them, moves files in and out, and gets a URL for anything they serve.
Starts in under a second
Launch 100s of sandboxes in less than a second. Images are cached, so big dependencies don't slow down later starts.
See the benchmarkMemory snapshots and forks
Snapshot a running sandbox's memory and processes, then start new sandboxes from it with your server and loaded state already running. A filesystem snapshot becomes an image you can reuse.
Explore docsNetwork allowlists
Each sandbox runs in an isolated container, or in a microVM with its own kernel when you set use_vm=True. Block outbound traffic or allow only specific hostnames, wildcard domains, IPs, or CIDRs, and change the rules at runtime.
Explore docsBrokered secrets
Bind an API key to the hosts allowed to receive it. Code in the sandbox only sees a placeholder, and Beam swaps in the real key on HTTPS requests to those hosts.
Explore docsGPUs and Docker
Attach a GPU in the Sandbox constructor for inference or rendering. Pull images from any registry and run containers inside the sandbox.
Explore docsPreview URLs
Expose a port when you create the sandbox or later with expose_port(). Each port gets a public URL, so add authentication in your app before exposing anything sensitive.
Explore docsControl it from code
Create a sandbox
Set CPU, memory, GPU, and image in the Sandbox() constructor, then call create() to launch it.
Run code and commands
Run Python with run_code() or any shell command with exec(), move files in and out, and stream logs as they arrive.
Expose, snapshot, or fork
Expose ports as public preview URLs, snapshot memory to fork the sandbox, and terminate it when you're done.
from beam import Image, Sandbox
# 1. Create and launch a sandbox in the cloud
sb = Sandbox(
image=Image().from_registry("node:20"),
ports=[3000],
).create()
# 2. Run code and commands with live output
sb.process.exec("sh", "-c", "npx http-server -p 3000")
# 3. Print the public preview URL, then snapshot memory to fork later
print(sb.list_urls())
# => {3000: 'https://...-3000.app.beam.cloud'}
snapshot_id = sb.snapshot_memory()Frequently asked questions
What can I run inside a sandbox?
Any Linux workload, not just Python. Run shell commands, start a Node.js server, launch a headless browser, or execute code your agent wrote. Each sandbox has its own filesystem, networking, storage, and an optional GPU.
How do snapshots work?
A memory snapshot captures a running sandbox's processes and filesystem. Sandboxes created from it start with those processes already running, each with its own ID and URLs, so you can fork one sandbox into many. A filesystem snapshot saves the disk as an image you can start new sandboxes from.
Can I run Docker inside a sandbox?
Yes. Pull images from any registry and run containers inside the sandbox, or start the sandbox itself from an existing Docker image.
How do I expose a service to the internet?
Expose ports when you create the sandbox, or at runtime with expose_port(). Each port gets a public preview URL you can share or call from your app. Preview URLs aren't private, so add authentication in your app before exposing sensitive data.
Can I use GPUs?
Yes. Set a GPU alongside CPU and memory in the Sandbox constructor to run inference, rendering, or other accelerated work. Sandboxes use the same GPUs as serverless apps. See the pricing page for types and rates.
Is it safe to run untrusted or LLM-generated code?
Each sandbox runs in its own isolated container, and use_vm=True runs it in a microVM with its own kernel. You can block all outbound traffic with block_network, or allow only specific hostnames, wildcard domains, IPs, or CIDRs, and change those rules at runtime without a restart.
How do I give a sandbox an API key without exposing it?
Use a brokered secret. Create it with the hosts allowed to receive it, for example beam secret create OPENAI_API_KEY "$KEY" --host api.openai.com, then pass secrets=["OPENAI_API_KEY"] to the sandbox. Code inside only sees a placeholder, and Beam adds the real key to HTTPS request headers sent to the approved hosts.
Give your agents their own machines
Sign up, install the CLI, and launch a sandbox, VM, or GPU from your terminal or your coding agent.