ReleaseBytes
gcp Google Cloud Blog ·

Cloud Run Sandboxes for Secure Untrusted Code Execution

blogaigcppreviewengineergcp-cloud-run
feature announcement

Google Cloud is launching Cloud Run sandboxes in public preview to securely run AI-generated or untrusted code within existing Cloud Run services. This feature provides isolated execution environments that start in milliseconds, mitigating risks associated with host applications and cloud credentials. It's particularly useful for LLM code interpreters, headless browsers, and executing user-submitted scripts, and incurs no additional cost beyond standard Cloud Run usage.

  • →Introduce Cloud Run Sandboxes for secure untrusted code execution
  • →Implement zero-trust security boundaries for sandboxes
  • →Enable sandboxes with a simple flag and native code integration
  • →Integrate sandboxes with Agent Development Kit and ComputeSDK
  • →Cost-effective sandbox execution on existing resources
Features (2) ›
  • Introduce Cloud Run Sandboxes for secure untrusted code execution

    Cloud Run sandboxes are a new, native runtime environment designed for securely executing untrusted code and agent workloads, available in public preview. They offer an isolated boundary within existing Cloud Run services that can start in milliseconds.

  • Implement zero-trust security boundaries for sandboxes

    Cloud Run sandboxes enforce credential and environment isolation, deny-by-default network egress with explicit opt-in for outbound connections, and use a read-only filesystem overlay with isolated temporary writes to protect host applications and cloud resources.

Enhancements (2) ›
  • Enable sandboxes with a simple flag and native code integration

    Enabling sandboxes on Cloud Run services requires adding a single flag to the deployment configuration. Once enabled, a sandbox CLI binary is mounted into the execution environment, allowing agents to spawn sandboxes programmatically using standard subprocess calls.

  • Integrate sandboxes with Agent Development Kit and ComputeSDK

    The Agent Development Kit (ADK) will include support for Cloud Run sandboxes with a new CloudRunSandboxCodeExecutor, simplifying code execution for ADK agents. Additionally, the vendor-agnostic ComputeSDK supports invoking sandboxes remotely or using them locally on the service.

Notes (1) ›
  • Cost-effective sandbox execution on existing resources

    Cloud Run sandboxes run on the allocated CPU and memory of existing Cloud Run instances, meaning there are no additional costs or premiums to use this feature. Documentation for getting started and detailed usage is available.

Read the original announcement →

https://cloud.google.com/blog/topics/developers-practitioners/google-cloud-run-sandboxes-are-in-public-preview/

Related releases