Changelog.What changed, every day.
1 change
1 change
3 changes
- Desktops: capture the screen with POST /v2/desktops/{id}:screenshot and drive it with POST /v2/desktops/{id}:actA screenshot returns the whole screen as base64, as png or jpeg (set quality, 1 to 100), with its width and height.Sandboxes
- Apps, Functions and Containers: volumes are mountedA version whose spec.volumes names a volume now mounts it in each copy before its process starts.Apps
- Sandboxes: mount a volume through v2POST /v2/sandboxes accepts spec.volumes, a list of at most one {volume, path} entry naming a volume of the same project by its ID (vol_...).Sandboxes
15 changes
- Status incidents in the APIGET /v2/status/incidents returns the incident notes shown on withruntime.com/status, status.md and status.json, newest start first, as {"data": [...]}.Platform
- Per-address limit on creating organizationsPOST /v2/orgs, which creates a signed-in person's own organization, is limited to 10 an hour per client IP address (an IPv6 address counts by its /64).Platform
- Closing an account deletes its resourcesPOST /v1/account:close now succeeds for every account; for some accounts it previously returned 500 internal_error.Platform
- Cloud Run: Google's client libraries' $alt parameter is acceptedThe Google Cloud Run Admin API at /compat/google-cloud-run now accepts the $alt query parameter (json, or json;enum-encoding=int), which Google's Node.js client (@google-cloud/run) sends with every REST request.Platform
- Seven more launch checks through competitors' APIs on /status.jsonlaunch_checks on GET https://withruntime.com/status.json now also returns dev_environments_codespaces (Octokit, GitHub's SDK, against the Codespaces API), containers_fly (Fly's Machines API), containers_cloud_run (Google's Cloud Run client for Node.js), firewall_security_groups (the AWS SDK for JavaScript's EC2 client), uptime_checks_betterstack (Better Stack's monitors API), uptime_checks_checkly (Checkly's checks API) and sites_vercel (Vercel's SDK, promoting a release).SDKs and CLI
- GET /v1/me returns the key's reachThe response now includes reach: agent when the key acts only on what its own agent made, compartment when it acts on what every key of its compartment made, or account when it acts on everything in the account.Platform
- A build whose identical image is larger than its maxImageMiB fails with the size to setWhen your account already had an identical image larger than a new build's build.maxImageMiB (8192 by default), the build failed with "The image could not be saved because of a fault on our side".Sandboxes
- Per-address limits on sign-in and API key creationRequests that sign in or create an account are limited per client IP address (an IPv6 address counts by its /64): 30 an hour for POST /v2/sign-in/email, and 30 an hour for POST /v2/sign-in/email/verify and Google or SSO sign-in returns together.Platform
- Clearer error when a sandbox from an image cannot startWhen the server could not prepare a sandbox's image, POST /v1/sandboxes returned 503 busy with "The cell could not confirm this in time; it may or may not have been applied." It now returns 503 busy with "This sandbox could not be started on its server, so nothing was made." Retry the create with the same Idempotency-Key.Sandboxes
- Render environment variable endpoints for Apps/compat/render/v1 now serves Render's environment variable endpoints over an App's spec.env: list (GET /services/{serviceId}/env-vars, paginated by cursor and limit), replace all (PUT /services/{serviceId}/env-vars), get, set and delete one (GET, PUT and DELETE /services/{serviceId}/env-vars/{envVarKey}).Apps
- Sandboxes, Apps and Functions can call App and Function addressesA request from a sandbox, an App or a Function to an App's or a Function's address (https://<name>.runtimehost.com) used to return 403 with "Destination resolves to a forbidden address".Apps
- Render list pagination reads only the requested pageOn /compat/render/v1, GET /services and GET /services/{serviceId}/deploys now start reading from the position the cursor names and stop as soon as the page is full.Platform
- Paused sandboxes started from a custom image survive the loss of their hostA paused sandbox started from your own image is no longer stopped when its host is lost, as long as its saved copy is complete and another host holds the image.Sandboxes
- A wake whose host does not answer fails within about a minuteA paused sandbox whose host did not answer its wake used to stay in resuming for as long as the host stayed silent, and every request on it waited.Sandboxes
- App versions and Render deploysGET /v2/apps/{id}/versions lists an app's versions, newest first and paginated by limit and cursor.Apps
17 changes
- Render API for AppsThe web service endpoints of Render's REST API are served under /compat/render/v1, so Render API clients and the render CLI manage Apps by changing only their host (RENDER_HOST) and API key (Authorization: Bearer <key>).Apps
- Desktops: E2B Desktop APIDesktops now accept E2B's sandbox REST API with its desktop template at /compat/e2b-desktop: set E2B_API_URL to https://<your API host>/compat/e2b-desktop and E2B_API_KEY to a Runtime API key, and E2B Desktop's SDKs (@e2b/desktop, e2b_desktop) can get, list (paginated by nextToken), connect to, extend the timeout of, pause and kill Runtime desktops.Sandboxes
- Launch checks on /status.jsonGET https://withruntime.com/status.json now returns launch_checks, one entry per product that launches with the next platform release (Browsers, Desktops, Notebooks, Dev environments, Actions runners, Cron, Apps, Functions, Containers, Load balancers, Firewall, Uptime checks, KV, Queues and Sites).Apps
- Upstash QStash schedules API for CronQStash's schedules endpoints are served under /compat/qstash, so the @upstash/qstash client manages Cron jobs by changing only its base URL and token.Platform
- Balancer targets receive requests only after their first health check passesWhen a balancer has spec.health, each target starts out of rotation: a new target, or every target on a host whose router has just restarted, receives no requests until its first health check passes, which happens within about 100 ms.Platform
- Start action for Dev environmentsPOST /v2/dev-environments/{id}:start starts an environment immediately: a paused environment is woken, and a stopped one starts again from its disk, even when spec.state is already running.Sandboxes
- Cloud Run: gcloud run revisions list --serviceIn the Google Cloud Run Admin API at /compat/google-cloud-run, v1's namespaces.revisions.list now returns a service's revisions when labelSelector is serving.knative.dev/service=<name>, as gcloud run revisions list --service <name> sends it.Platform
- Containers: versions, and Cloud Run revisionsGET /v2/containers/{id}/versions returns a container's versions, newest first and paginated with limit (1 to 100, default 20) and cursor.Containers
- Sandboxes: a fork waits for room, as a create doesWhen no server has room for a copy, fork now retries with the same idempotency key for up to two minutes, as create, wake and restart do, in every SDK and in withruntime sandboxes fork.Sandboxes
- Containers: Cloud Run revisions are named, and traffic can be pinned to oneIn the Google Cloud Run Admin API at /compat/google-cloud-run, each version of a Container is a revision named <service>-<version>, such as hello-3.Containers
- Better Stack TCP monitors keep their typeIn the Better Stack compatibility API, a PATCH that changes a TCP monitor's monitor_type to status, keyword or expected_status_code now returns 400; previously it changed only the reported type while the check kept probing TCP.Platform
- Better Stack TCP monitorsThe Better Stack compatibility API at /compat/betterstack now accepts monitor_type: "tcp" with url (the host) and port, and creates an Uptime check on tcp://<host>:<port>; the monitor returns its host and port as Better Stack does.Platform
- Better Stack expected-status-code monitorsThe Better Stack compatibility API at /compat/betterstack now accepts monitor_type: "expected_status_code" with expected_status_codes (a list of HTTP status codes); the Uptime check passes only those codes, and the monitor returns them as numbers.Platform
- Browserbase sessions accept keepAlivePOST /compat/browserbase/v1/sessions accepts keepAlive: true (previously 400).Sandboxes
- Containers: a slug addresses a container, and Cloud Run services keep the name requestedContainers accept an optional spec.slug: 1 to 63 lowercase letters, digits and hyphens, starting with a letter and not ending with a hyphen, unique within the project and set at create only.Containers
- Browserbase session list rejects an unknown statusGET /compat/browserbase/v1/sessions returns 400 when status is not one of RUNNING, ERROR, TIMED_OUT, COMPLETED or PENDING (the values are case-sensitive), as Browserbase does.Sandboxes
- Console: the Sandboxes, Browsers and Desktops lists show every sandbox, wherever it runsFor many accounts the lists showed only sandboxes made before the account moved to Runtime's new servers, and none made since.Sandboxes
31 changes
- Better Stack's monitors API over Uptime checksBetter Stack Uptime API calls for monitors (GET and POST /api/v2/monitors; GET, PATCH and DELETE /api/v2/monitors/{id}) run against Runtime Uptime checks at /compat/betterstack with a Runtime API key as the bearer token.Platform
- GitHub Codespaces API for Dev environmentsThe Codespaces endpoints of GitHub's REST API are served under /compat/github, so Octokit and other GitHub clients manage Dev environments by changing only their base URL and token (Authorization: token <key> or Bearer <key>).Platform
- Containers: Google Cloud Run Admin API v2Containers now accept the Cloud Run Admin API v2 services methods at /compat/google-cloud-run: set the client's endpoint to https://<your API host>/compat/google-cloud-run and use a Runtime API key as the bearer token. services.create, services.get, services.list (paginated with pageSize and pageToken), services.patch and services.delete are supported; each service is a Container labeled with its project and location, and a service under another project or location returns 404.Containers
- Containers: flyctl and fly-goflyctl and Fly's Go client (fly-go) now run against Runtime's Fly Machines API unchanged.Containers
- Queues: SQS-compatible status codes for authentication and size errorsThe SQS-compatible endpoint now returns 403 for AccessDenied and for every InvalidClientTokenId, and 413 for RequestEntityTooLarge; these errors previously returned 400 (and InvalidClientTokenId returned 400 or 403 depending on where the request was refused).Platform
- Functions: AWS Lambda InvokeThe AWS Lambda API on Runtime Functions now supports Invoke, so invoke in AWS's SDKs runs a function after you change only the endpoint and the keys.Functions
- Browserbase session list filters on BrowsersGET /compat/browserbase/v1/sessions (sessions.list in Browserbase's SDK) accepts status (PENDING, RUNNING, COMPLETED or ERROR) and q in Browserbase's metadata query form, user_metadata['key']:'value', and returns only the sessions that match both.Sandboxes
- Browserbase's session debug URLs on BrowsersGET /compat/browserbase/v1/sessions/{id}/debug (sessions.debug in Browserbase's SDK) returns the session's wsUrl (its Chrome DevTools Protocol WebSocket URL) and, when the browser draws its screen, its live view as debuggerUrl and debuggerFullscreenUrl; otherwise those are empty. pages is always empty; the browser's pages are listed at its httpUrl (/json/list).Sandboxes
- Queues: SQS-compatible error status codesThe SQS-compatible endpoint now returns the HTTP status Amazon SQS returns for each error.Platform
- Checkly's checks API over Uptime checksCheckly API calls for API and URL checks (POST /v1/checks/api, POST /v1/checks/url, PUT on each, GET /v1/checks, GET and DELETE /v1/checks/{id}) run against Runtime Uptime checks at /compat/checkly with a Runtime API key as the bearer token.Platform
- Balancers and Ports: target weights and failoverEach entry in spec.targets accepts weight (1 to 1,000, default 1) and backup (default false).Platform
- Apps, Functions and Containers: health checks while servinghealthPath is now also checked while a copy serves: every 5 seconds, each copy is sent a GET of the path, and a copy that fails 2 consecutive checks (no status under 500 within 2 seconds) receives no requests until it passes 2 consecutive checks.Apps
- Containers: Fly Machines restartPOST /compat/fly/v1/apps/{app_name}/machines/{machine_id}/restart is now supported.Containers
- Speed page: daily history charts and provider comparisonThe speed page now charts each listed operation's median own time for each of the last 90 days, against its physical floor.Platform
- CI/CD: a job that fails because its machine ran out of disk says so in its reasonWhen a job's machine runs out of disk, the error is often never written to the job's log, because the log is on the same full disk.CI/CD
- Speed: browser create time and rival providers, measured the same waybrowsers.create is now measured every five minutes.Sandboxes
- Sites (beta): static websites served with no machineA site is files and a route table (redirects, rewrites, headers, Markdown for agents, 404 pages) served by every front.Platform
- Speed history by the hour and by the dayEach listed operation's hourly and daily p50, p95 and p99 (Runtime's own time, the network's part and the total), sample count and failure count are now kept indefinitely and returned by https://status.withruntime.com/speed/history.json?op=<id>&step=hour|day&from=&to=. from and to take a date (2026-11-03) or an ISO 8601 time and are rounded down to the step; by default a request returns the last 48 hours, or the last 365 days with step=day.Sandboxes
- Containers: Fly Machines APIContainers now accept Fly's Machines REST API at /compat/fly/v1, so clients written for api.machines.dev run against Runtime after you change only the base URL and the token: use https://<your API host>/compat/fly as the base URL and a Runtime API key as the bearer token.Containers
- Sandboxes: E2B APISandboxes now accept E2B's REST API at /compat/e2b, so code that uses E2B's SDKs (e2b, @e2b/code-interpreter) can create and manage Runtime sandboxes after you change only the API URL and the API key: set E2B_API_URL to https://<your API host>/compat/e2b and E2B_API_KEY to a Runtime API key.Sandboxes
- Browserbase's sessions API on BrowsersBrowserbase's Node.js SDK (@browserbasehq/sdk) works with Runtime Browsers when BROWSERBASE_BASE_URL is set to https://<your API host>/compat/browserbase and BROWSERBASE_API_KEY to a Runtime API key.Sandboxes
- Functions: AWS Lambda APIFunctions now accept the AWS Lambda API, signed with AWS Signature Version 4, so code that uses AWS's SDKs (such as boto3) runs against Runtime Functions after you change only the endpoint and the keys.Functions
- Notebooks: connect JupyterLab, VS Code or any Jupyter clientThe URL that POST /v2/notebooks/{id}:open returns now also accepts its secret as a Jupyter token, sent as Authorization: token <secret> or ?token=<secret>.Sandboxes
- FirewallsPOST /v2/firewalls creates a named rule set that ports and balancers attach to with firewallId.Platform
- KV: Cloudflare Workers KV APIKV stores now accept Cloudflare's Workers KV REST API at /compat/cloudflare/client/v4, so code that uses Cloudflare's SDKs runs against Runtime KV after you change only the base URL and the API token: set baseURL to https://<your API host>/compat/cloudflare/client/v4, apiToken to a Runtime API key, and use a KV store's ID as the namespace ID.Platform
- Browsers: capture a page with POST /v2/browsers/{id}:screenshotOpens url in a new tab, waits for its load event, and returns the image as base64 with the page's final URL, title and HTTP status; without url, it captures the page the browser shows now.Sandboxes
- Balancers: health checksA balancer's spec.health sets how each target is checked, with the fields of an AWS ALB target group: path, intervalSeconds, timeoutSeconds, healthyThreshold and unhealthyThreshold.Platform
- Sandboxes: upload links replace files in root-owned foldersA PUT link from POST /v1/sandboxes/{id}/files:link to a path under /workspace whose folder is owned by root (for example, a tarball extracted with sudo) returned 404 with This upload is not open in the sandbox.Sandboxes
- GitHub Actions runners in every SDK/v2/runners is now in the API reference and the OpenAPI document, and every SDK makes its calls as runners.settings, runners.enable, runners.disable, runners.jobs and runners.job.CI/CD
- Sandboxes: lists and lookups include every sandbox of an organization being moved to Runtime 2.0While an organization has sandboxes on both Runtime 1.0 and Runtime 2.0, GET /v1/sandboxes returns them all in one paginated list, in the same order and with the same fields as before.Sandboxes
- Plans: includedMicros, yearlyOnly and trialUsageMicrosGET /v1/plans returns three new fields on each plan: includedMicros, the usage included each month (null when the fee and bonusMicros are the plan's usage); yearlyOnly, whether the plan is billed yearly only (choosing such a plan monthly returns 409); and trialUsageMicros, the usage a trial includes ("0" for none).Billing
10 changes
- Sandboxes: exec on a newly created sandbox returns as soon as the command exitsIn some regions, POST /v1/sandboxes/{id}/exec on a sandbox created at the default size could hang until the client's timeout.Sandboxes
- API keys limited to a compartment reach only that compartment's sandboxesOn Runtime 2.0, a key limited to one compartment (project) now lists only that compartment's sandboxes, and GET, DELETE, :exec, files, processes and every other sandbox route return 404 for a sandbox in another compartment, the same response as for a sandbox that does not exist.Sandboxes
- CI/CD: a failed job's reason names its first errorThe reason shown for a failed job, in the console and on its GitHub check run, was the last line of its log, which for a build is often a line such as error: build failed, waiting for other jobs to finish....CI/CD
- API v2: filter sandboxes and other machines by phaseThe lists of sandboxes, browsers, desktops, dev environments, databases, Kubernetes clusters and notebooks (GET /v2/{resources}) accept phase (pending, running, paused, stopped or failed) and return only the resources in that phase.Sandboxes
- API v2: lists return the API v1 ID of each moved resource with include=movedFromEvery v2 list (GET /v2/{resources}) accepts include=movedFrom, which adds movedFrom to the page: the ID of each item that moved in from API v1 mapped to the ID it had there.Platform
- API v2: lists return each resource's usage to date with include=usageA list of a metered resource (GET /v2/{resources}, for every resource that has :usage) accepts include=usage, which adds usage to the page: each item's ID mapped to what it has used from the month it was created (since) to now, with the same figures as :usage (windows, heldMs, cpuBilledUsec, memoryMibMs and chargedMicros), summed over those months.Billing
- API v2: lists return resources newest first with order=newestEvery v2 list (GET /v2/{resources}) accepts order=newest, which returns resources by createdAt, newest first, and pages with cursor as before. order=oldest, the default, keeps today's ID order.Platform
- Sandboxes: commands run as the sandbox user, and the HTTP proxy works at every sizeOn some sandboxes, commands, processes, terminals and file writes ran as root even though the sandbox reported user: "sandbox".Sandboxes
- Sandboxes: bucket mounts succeed and stay mountedPOST /v1/sandboxes/{id}/mounts checked whether the mount's client was still running by the size of its cgroup's process list, which the kernel always reports as 0.Sandboxes
- Sandboxes: sessions work for every sandboxPOST /v1/sandboxes/{id}/sessions, GET /v1/sandboxes/{id}/sessions and POST /v1/sandboxes/{id}/sessions/{sessionId}:revoke now work for every sandbox, and the rtsess_ token a session returns can be used with every sandbox.Sandboxes
26 changes
- Sandboxes: browser, desktop and MCP on every new sandbox/v1/sandboxes/{id}/browser (:start, GET, :stop), /desktop:start, /desktop:act, /desktop/screenshot, /desktop:stop and /mcp (POST, GET, DELETE) previously returned 409 served_elsewhere for sandboxes created on the new platform.SDKs and CLI
- Sandboxes: network rules work for every sandboxGET /v1/sandboxes/{id}/network and PUT /v1/sandboxes/{id}/network now work for every sandbox.Sandboxes
- Sandboxes: a verb the API key does not allow returns 403, and older keys can wake, extend, update, set retention and restartA request for a sandbox operation that the API key's grant does not include now returns 403 forbidden; previously some of these requests returned 409 served_elsewhere, and retrying them at the address in the error returned the same error again.Sandboxes
- Sandboxes: a fork returns 409 fork_unsafe when a copy would repeat the source's random numbersA fork (forkOf, or POST /v1/sandboxes/{id}:fork) copies every process's memory, including the state of each language runtime's own random number generator.Sandboxes
- Sandboxes: a fork with count above 1 makes its copies in parallelPOST /v1/sandboxes/{id}:fork with {"count": 4} previously made each copy after the one before it; it now makes them at the same time and records them in one commit, so a fork of 4 copies of a running sandbox returns in 216 ms at the median instead of 340 ms.Sandboxes
- Tailscale: new sandboxes can join a tailnet againPOST /v1/sandboxes/{id}/tailscale, GET /v1/sandboxes/{id}/tailscale, DELETE /v1/sandboxes/{id}/tailscale, and the tailscale field on POST /v1/sandboxes and POST /v1/sandboxes/{id}:update now work for every sandbox.Sandboxes
- API: keep-alive connections stay open across Runtime releasesWhen a server's API process was replaced during a release, a request in progress on a keep-alive connection could be answered with connection: close, and the client had to open a new connection.Platform
- Jobs: a vouch is no longer cleared by secrets scoped to other sandboxes by IDAny change to an egress secret's scope, including a list of other sandboxes' IDs, cleared every vouch in the organization, and the job's runs carried no job_vouched_by claim in their identity tokens.Jobs
- Keys: POST /v1/keys no longer slows down or returns 502 keys_unavailable in accounts with many keysIn an account holding tens of thousands of keys, creating a key could take 15 seconds or more and return 502 keys_unavailable, and other requests in the account waited while it ran.Platform
- Sandboxes use included free usage before credit in every regionA sandbox's running time is charged to the month's included free usage first, then to credit, in every region where the account runs sandboxes.Billing
- API keys: keys Runtime creates for your builds, CI/CD checks, app versions, agent sessions and Actions runners no longer count toward the limit of 1,000 live keys per memberPreviously, a busy CI/CD repository could fill the limit with its checks' short-lived keys, and POST /v1/keys returned 409 limit_reached to the member who connected it.CI/CD
- spreadFrom keeps a new sandbox off its peers' serversPOST /v1/sandboxes accepts spreadFrom again: 1 to 16 IDs of your own sandboxes.Sandboxes
- Sandbox creates in a full region fail immediately and name the sizeWhen no server in the region has room for a new sandbox, POST /v1/sandboxes now returns 503 capacity_unavailable immediately, before any state is written, and the error message states the vCPUs and memory that could not be placed.Sandboxes
- Sandboxes: creates from an existing image no longer return 404 image_not_found for some accountsPOST /v1/sandboxes could return 404 image_not_found (or snapshot_not_found, volume_not_found) for an image, snapshot or volume that exists in the account.Sandboxes
- Sandboxes: creates no longer return 501 or an immediate 503 for some accountsPOST /v1/sandboxes could return 501 (for example env_unavailable or feature_unavailable) or an immediate 503 for request bodies the API supports.Sandboxes
- Correct clock after a restoreA sandbox created from a template, forked, or woken from a pause now reads the correct wall-clock time from its first instruction.Sandboxes
- Creates from an image that cannot boot return 404POST /v1/sandboxes now returns 404 image_not_found, naming the image and the reason, when the image is not the organization's or was deleted.Sandboxes
- Requests that carry a secret's placeholder are never sent unreplacedIf the server running a sandbox has not received secret updates in the last 15 seconds, a request that carries a secret's placeholder, or that a secret's header rules apply to, returns 503 with Retry-After: 1 and X-Runtime-Egress: secret-not-current instead of being sent with the placeholder.Sandboxes
- Files: watches work in sandboxes created from the default imagePOST /v1/sandboxes/{id}/files/watches (and files.watch() in the SDKs) returned 500 watch_failed ("The watch exited while starting") in sandboxes created from the default image.Sandboxes
- Sandbox creates move off a failed host immediatelyWhen the host chosen for a new sandbox has failed and refuses connections, POST /v1/sandboxes now places the sandbox on another host immediately, instead of returning 503 until the failed host's lease expires (about 2 seconds).Sandboxes
- A Function with no running copy starts one for its next requestA request to a Function that has scaled to zero waits at the router while a copy is started from the version's saved copy, then is answered; it no longer returns 503 machine_no_capacity after 10 seconds. sleepAfterMs now applies: a copy that requests no longer need keeps running for sleepAfterMs after its last request before it stops, so requests a moment apart reach a running copy.Functions
- A crashed process restarts immediatelyWhen the process of an App, a Function or a container exits, its first restart now happens immediately instead of after 1 second; an App's process killed with SIGKILL answers requests again about 60 ms later.Apps
- CI/CD: always run a pull request's own testsA split step with own: true (split: { files: "/*.test.{ts,tsx}", own: true }) runs the test files a change adds or changes that no other step's split names.CI/CD
- Parallel forks no longer return 503 busy while a snapshot copy arrivesWhen a snapshot's own server was full, creating many sandboxes from that snapshot at once could return 503 busy ("Cloud is busy; retry").Sandboxes
- CI/CD checks every push of the branches you listAdd pushes: [{ branch: next, steps: [...] }] to the production branch's .runtime/checks.yml to check each push of a branch that has no pull request of its own, such as a staging branch.CI/CD
- Slack triggers in the v2 Agents APIPOST /v2/agents/slack/installs returns a link that adds Runtime's Slack app to a workspace, valid for 15 minutes; POST /v2/agents/slack/installs:finish completes it with Slack's code and the link's state, and accepts only a key of the project that created the link.Agents