Cloudflare Sandbox SDK vs Sprites

Cloudflare Sandbox SDK

Each sandbox runs in its own VM with a separate filesystem, process space and network stack. No hosted API. You deploy and secure a Worker before an agent can call anything, and the starter has no auth.

Sprites

A Sprite keeps a 100 GB ext4 disk between runs, bills compute only while active and can be checkpointed and restored through a published OpenAPI contract. The status page records four Sprites incidents in the last 90 days, one lasting over seven hours, and outbound network access is unrestricted until a policy is set.

Cloudflare Sandbox SDK

1. Derive the sandbox ID from the authenticated user, as the docs advise. IDs aren't secrets
2. Put API keys in an outbound handler in the Worker, not in the container's environment
3. Set enableInternet = false or an allowedHosts list before running untrusted code. Internet access is on by default
4. Check that a restored backup has every directory you expect. Backups of 10 MB or more have open bugs
5. Start new projects on 1.0. The 0.x library only gets fixes until 31 December 2026

Sprites

1. Create a token at sprites.dev/account after a browser signup, and send it as Authorization: Bearer <token> to https://api.sprites.dev
2. Follow the OpenAPI document, not the product page example. Create with POST /v1/sprites and a JSON name, and run commands with POST /v1/sprites/{name}/exec using cmd query parameters
3. Set a network policy with POST /v1/sprites/{name}/policy/network before running untrusted code. Egress is open until one is set
4. Processes started by exec stop on a cold wake. Define a Service for anything that must answer the request that wakes the Sprite
5. Create a checkpoint before a restore. Restoring replaces the filesystem, ends active sessions and keeps no copy of the replaced state
6. Sprite creation is limited to 10 a minute on pay-as-you-go. The Go SDK reads Retry-After and the error code sprite_creation_rate_limited on a 429
7. Delete Sprites you no longer need. An idle Sprite still bills cold storage for the bytes it holds