# Best sandbox for LlamaIndex agents in 2027 Runtime Cloud (withruntime.com) is that virtual machine, exposed as a `FunctionTool`. It costs 79% less than E2B. ## Which sandbox is best for LlamaIndex? It depends on where your data may go. For analysis over retrieved rows, Runtime has the lowest cost of the services priced below: $56.94 for fifty thousand calls, compared with $115.04 on Cloudflare Sandbox and $276.00 on E2B. A call mostly waits on the model. Runtime bills measured CPU, and pandas is already installed. Pick the Azure tool spec LlamaIndex ships if everything must stay inside Azure. Keep the local code interpreter tool out of production, as its own source advises. ## Where does LlamaIndex run code today? | Tool | Package | Where the code runs | | -------------------------------- | ------------------------------------------ | -------------------------------------------- | | `CodeInterpreterToolSpec` | `llama-index-tools-code-interpreter` 0.6.0 | `python -c` in a subprocess on your own host | | Azure code interpreter tool spec | `llama-index-tools-azure-code-interpreter` | Azure Container Apps dynamic sessions | The first tool's source, read on 25 October 2026, states the risk plainly: "Arbitrary code execution is possible on the machine running this tool", and it "is not recommended to be used in a production setting, and would require heavy sandboxing or virtual machines". It runs the model's code with `subprocess.run` beside your index, your keys and your data. Any other sandbox plugs in by wrapping its SDK's functions as `FunctionTool`s. ## What should a sandbox give a retrieval agent? - **A place to compute, apart from the index.** Retrieval stays in your process. Only the snippet the model wrote crosses into the sandbox, with the rows it needs written in as a file. - **The data libraries already there.** With pandas, NumPy and matplotlib in the image, a chart or a group-by needs no install step. - **Files in, files out.** Write a CSV or a PDF in, and read a chart back to show the user. - **More than Python when it helps.** A shell lets the model call `jq`, `sqlite3` or `gcc` with the same tool. - **A clean machine per conversation.** One sandbox per chat keeps one user's uploads away from the next. It pauses when the chat goes quiet. ## What does a month of LlamaIndex analysis cost? Fifty thousand calls, each two minutes on a 2 vCPU, 4 GiB sandbox and busy for 20 CPU-seconds, at each provider's published rates: | Provider | Isolation | CPU billed on | A month of calls | | ------------------ | ------------------------- | ----------------- | ------------------------------------ | | Runtime Cloud | Firecracker microVM | Measured use | $56.94 | | Cloudflare Sandbox | A container in its own VM | Measured use | $115.04 | | Vercel Sandbox | Firecracker microVM | Measured use | $176.89 | | E2B | Firecracker microVM | Every vCPU held | $276.00 | | Modal | gVisor, a shared kernel | The CPU requested | $396.60 | ## When might another sandbox fit better? - **Azure-only deployments.** A team that must keep everything inside Azure can use the Azure dynamic sessions tool spec LlamaIndex ships. ## Runtime Cloud Runtime runs a LlamaIndex agent's code in a Firecracker microVM with its own kernel. Four ordinary `FunctionTool`s from `sandbox_tools`, in the `withruntime` package, wrap the sandbox, so a `FunctionAgent` or a workflow calls it like any other tool. The agent can read the documents your index retrieved, compute over them with pandas, and return a number it actually ran. - pandas, NumPy and matplotlib are in the default image. - `sbx.files.write` puts a CSV or a PDF in. `sbx.files.read` brings a chart back. - The same `runtime_exec` tool runs `jq`, `sqlite3` or `gcc`. The fifty thousand calls above cost $56.94 on Runtime, 79% less than E2B, at rates checked 25 October 2026. A call that spends most of its two minutes waiting for the model is billed for the CPU it uses, not the two vCPUs it holds. ### A run on Runtime, recorded 1 October 2026 ```bash no-run pip install withruntime llama-index-core llama-index-llms-anthropic "anthropic<1" ``` ```python check from llama_index.core.agent.workflow import FunctionAgent from llama_index.core.tools import FunctionTool from llama_index.llms.anthropic import Anthropic from withruntime import Sandbox from withruntime.tools import sandbox_tools async def ask(question: str) -> str: with Sandbox.create() as sbx: tools = [FunctionTool.from_defaults(fn=f) for f in sandbox_tools(sbx)] agent = FunctionAgent(tools=tools, llm=Anthropic(model="claude-sonnet-4-6")) return str(await agent.run(user_msg=question)) ``` LlamaIndex has no scripted function-calling model to drive the agent without a paid call. So on 1 October 2026, we called the same `FunctionTool`s directly, as the agent does, against a live sandbox with llama-index-core 0.14.25: ```text runtime_write_file words.py Wrote 139 bytes to /workspace/words.py runtime_exec python3 words.py exit_code 0 [('ubuntu', 9), ('url', 4), ('https', 4)] ``` The script counted words in the sandbox's own `/etc/os-release`, which is Ubuntu's, not your server's. Swapping the tool in an existing agent and mixing it with retrieval are in [LlamaIndex in a sandbox](/integrations/llamaindex). Free usage covers a first agent. Run `npx withruntime login` and ask it a question. An agent whose tools call another sandbox provider moves with the [migration guide](/docs/migrate). ## Sources Checked 25 October 2026. - [llama-index-tools-code-interpreter on PyPI](https://pypi.org/project/llama-index-tools-code-interpreter/): version 0.6.0, whose source holds the warnings quoted and the `subprocess.run` call - [llama-index-tools-azure-code-interpreter on PyPI](https://pypi.org/project/llama-index-tools-azure-code-interpreter/) - Each provider's published rates, checked 25 October 2026, as the [pricing guide](/docs/pricing) lists them - The recorded run: Runtime's Python SDK with llama-index-core 0.14.25 on Python 3.12, against production on 1 October 2026