Cloudflare Sandbox SDK vs InstaVM

Cloudflare Sandbox SDK 90

@cloudflare/sandbox 1.0.3 and 0.12.14 tagged on 22 October 2026 (30). 14 releases in the 90 days from 3 August, from 0.12.5 (7 August) to 1.0.3, plus three 1.0.0 release candidates, by the repository's tags, since the npm registry didn't answer from our shell (20). Reply times weren't visible, and GitHub's pages answer 403 in our session. Fixes on both release lines name the issues they close, and the 0.x line gets fixes until 31 December 2026 (15). It's Cloudflare's official SDK and current (15). Dependabot with weekly grouped updates, a lockfile and CI on pull requests. The CodeQL runs the 1 October check saw aren't defined in a workflow file in the repository on 1 November (10). 30 + 20 + 15 + 15 + 10 = 90.

InstaVM 35

Closed service lines. The latest dated change found is Python SDK 0.26.1 on 15 July 2026, 114 days before the check, and the site changelog's only entry is 11 July (10). No SDK release in the 90 days to 6 November (0). A public changelog, support email and Discord, with no reply times seen (8 of 15). Official Python and JavaScript SDKs, last released in July and May 2026 (12 of 15). Package health of the SDK repositories was not read (5 of 10). Total 35.

Cloudflare Sandbox SDK 73

There's no hosted credential to score. Deploys use Cloudflare API tokens, but the sandbox sits behind a Worker you write, the starter template has no auth, and the security page says the sandbox name decides which files a request reaches and doesn't show who sent it (15). Each sandbox is a separate VM with its own filesystem, process space and network stack (10). Outbound traffic can be cut off with enableInternet = false or limited with a deny-by-default allowedHosts list and deniedHosts, all GA, though internet access is on by default (10). Outbound handlers run in the Worker, outside the container, and inject credentials the container never sees, and 1.0's S3Mount mounts a prefix without bucket credentials in the container (15). Sandbox labels for analytics, and since 0.12.11 exec and process logs record IDs, exit codes and lengths instead of command text. Account audit logs weren't read (5). security.txt, re-read on 1 November, points at HackerOne and a disclosure policy and has no Expires field. Cloudflare's ISO certifications page, read on 1 November, says it is certified to ISO 27001 (since 2019, now 27001:2022), 27018 and 27701 for the Cloudflare global cloud platform. 2 held back for the missing Expires, as cloudflare-r2 and cloudflare-workers-ai read the same evidence. OSV lists no advisory for @cloudflare/sandbox (18). 15 + 20 + 15 + 5 + 18 = 73.

InstaVM 41

Plain API keys in a header, with API endpoints to create, list and delete them and no scopes found (20 of 30). Egress policies per session or VM can block all outbound traffic or allow named domains and CIDRs, but llms.txt describes full network access as the default (8 of 20). No guidance on untrusted output from executed code or browser sessions (3 of 15). An Audit Logs endpoint group exists in the API reference (10 of 15). No security.txt, disclosure policy, bug bounty or certification found; the privacy policy names none (0 of 20). Total 41.

Cloudflare Sandbox SDK 86

The SDK and its container image are Apache-2.0. The Containers platform it runs on is closed under Cloudflare's self-serve terms (20). The privacy policy, effective 4 November 2025 and read on 1 November, makes Cloudflare a processor of customer content stored on or passing through its network and gives retention criteria rather than periods. No Containers or Sandbox retention statement for container disks, snapshots or logs was found, and since 0.12.11 the SDK keeps command text and output out of Workers Logs (16). A dated notice that 0.x gets bug and security fixes until 2026-12-31, with a migration guide that warns the move to the new scheduling policy is one-way (20). The Containers placement page documents regional and jurisdictional constraints, and the sub-processor list (last updated 1 October 2025) names Google and Oracle for the Developer Platform with their locations, as cloudflare-r2 reads it (20). 20 + 16 + 20 + 20 = 76.

InstaVM 57

Closed service with clear terms (15). The terms and privacy policy agree on keeping code and execution logs up to one year and US storage, and the policy names Stripe, PostHog and Resend, but allows training on anonymised, aggregated data derived from user content with opt-out by email and mentions no DPA (18 of 30). No deprecation policy or notices found (0 of 20). US data location stated and three subprocessors named, cloud providers unnamed (12 of 20). Total 45.

Cloudflare Sandbox SDK 90

Scored on the SDK checklist, since the listing is a library. Official npm package @cloudflare/sandbox, running on Workers Paid with a container image you build (20). Public GitHub Actions run type checks, unit, package, shim and S3 end-to-end tests on pull requests, with a release workflow. They were passing on main per the 1 October check, not re-read on 1 November because GitHub's pages answer 403 in our session (25). Open issues weren't readable on 1 November. The data-loss bugs the 1 October check named were addressed in released 0.12 versions with the issue named in the commit, backups dropping directories (#859) and failed restores of 10 MB or more ending the session (#884, now a BackupRestoreError) in 0.12.11, and tunnels.get() (#874) in 0.12.12, among 12 issues closed by name on the 0.x branch since August. allowedHosts failing closed (#844) wasn't found among them (15 of 25). Release notes flag breaking changes, and 1.0.0 shipped as a major with a migration guide and an API map from 0.12 (15). 1.0.3 is current, and 0.x gets fixes until 31 December 2026 (15). Cloudflare's own status page isn't scored on these lines. 20 + 25 + 15 + 15 + 15 = 90.

InstaVM 77

Hosted lines. Better Stack status page with four components, including the public API (20). The incident history shows no incidents for September, October or November 2026 (30). No rate limits with numbers found; Pro promises higher limits without figures (0). The Python SDK has a RateLimitError and an example retry loop with exponential backoff, but no 429 or Retry-After is documented, and there is no idempotency guidance (7 of 15). The terms commit to 99.9% monthly uptime with service credits, and Pro lists 99.9% (10). No beta or preview label on the API (10). Total 77.

Cloudflare Sandbox SDK 63

Command output, file reads and process logs come back whole or streamed, with no size controls beyond what your code adds (15). Directory listing options and streaming exec, but little filtering (10). Typed errors with codes such as STALE_PREVIEW_URL (15). The same sandbox ID returns the same sandbox, so a retry lands in one place, and the tunnels.get() recovery failure (#874) was fixed in 0.12.12 (15). TypeScript only, and the first deploy needs Docker locally and a Worker you write (8). 15 + 10 + 15 + 15 + 8 = 63.

InstaVM 51

30 operations take limit, offset, cursor or page parameters, with no field selection found (12 of 25). Listing endpoints page, with little filtering (10 of 20). The SDK maps failures to typed exceptions such as AuthenticationError, QuotaExceededError and RateLimitError, but the HTTP error bodies are undocumented (8 of 20). One operation takes an idempotency parameter, and snapshots and clones make work repeatable, with no safe-retry guidance (6 of 20). client.execute(code=..., language=...) needs two arguments, with Python and JavaScript SDKs (15). Total 51.

Cloudflare Sandbox SDK 77

No OpenAPI for the library. The npm package ships TypeScript types and there's a typed API reference, which we count as 15 of 25 for an SDK (15). llms.txt (122 Sandbox pages on 1 November) and Markdown pages for every doc (10). Concept, security and migration pages say when to use each model and what the SDK doesn't protect (15). Typed option objects, few free-form blobs (12). Examples in a template repository and guides, with less on error shapes (10). Dated changelog, a CHANGELOG.md per release line and a 1.0 migration guide with an API map (15). 15 + 10 + 15 + 12 + 10 + 15 = 77.

InstaVM 66

A public OpenAPI 3.1 spec with 229 operations (25). llms.txt at instavm.io (10). Only 93 of 229 operations have a description, and those read as short summaries without when-not-to-use guidance (8 of 20). FastAPI-generated request schemas with typed fields and required lists (10 of 15). Docs carry code examples for each SDK area, but only 422 validation errors appear in the spec and no error-code reference was found (6 of 15). Paths sit under /v1 and an SDK changelog exists, but the site changelog has one entry, of 11 July 2026 (7 of 15). Total 66.