Amazon Bedrock AgentCore Code Interpreter vs Cloudflare Sandbox SDK

Amazon Bedrock AgentCore Code Interpreter

Each session runs in its own microVM with 2 vCPU, 8 GB and a 10 GB disk for up to eight hours, and IAM can scope access to one interpreter. Sessions cannot be paused or resumed, and an AWS account with IAM set-up is needed before a first call.

Cloudflare Sandbox SDK

Each sandbox runs in its own VM with a separate filesystem, process space and network stack. No hosted API. You deploy and secure a Worker before an agent can call anything, and the starter has no auth.

Amazon Bedrock AgentCore Code Interpreter

1. Start a session with StartCodeInterpreterSession, then pass its id in the x-amzn-code-interpreter-session-id header on every InvokeCodeInterpreter call
2. Set sessionTimeoutSeconds when starting. The default is 900 seconds and the maximum is eight hours, and the session ends itself at the timeout
3. Stop sessions when done. Billing runs per second while code is busy, and a session left open counts against the 1,000 concurrent-session quota
4. Use startCommandExecution, getTask and stopTask for work longer than the 15-minute synchronous request limit
5. Retry ThrottlingException (429) and InternalServerException (500) with exponential backoff, and treat ServiceQuotaExceededException, returned as HTTP 402, as a quota to raise

Cloudflare Sandbox SDK

1. Derive the sandbox ID from the authenticated user, as the docs advise. IDs aren't secrets
2. Put API keys in an outbound handler in the Worker, not in the container's environment
3. Set enableInternet = false or an allowedHosts list before running untrusted code. Internet access is on by default
4. Check that a restored backup has every directory you expect. Backups of 10 MB or more have open bugs
5. Start new projects on 1.0. The 0.x library only gets fixes until 31 December 2026