A Runtime sandbox mounts your bucket from Amazon S3, Cloudflare R2 or Google Cloud Storage as a folder. The sandbox never holds the bucket's key. You store the key once as a secret. The host signs the sandbox's requests on the way out. Code in the sandbox reads and writes the files, and it cannot copy the credential (mount your own bucket).
How it is organised
Amazon's S3 guide describes the model with three terms. An object "is a
file and any metadata that describes the file". A bucket "is a container
for objects". A key "is the unique identifier for an object within a
bucket". Object storage has no real directories. photos/puppy.jpg is one key
that happens to contain a slash.
Object, block and file storage
| Kind | Addressed by | Changed by | Typical use |
|---|---|---|---|
| Object | Bucket and key, HTTP | Replacing the whole object | Datasets, backups, media, build outputs |
| Block | A disk's block numbers | Writing any block | A machine's root disk, databases |
| File | A path in a tree | Writing part of a file | Shared folders, home directories |
Object stores trade in-place edits for scale and price. S3 promises strong read-after-write consistency. Cloudflare R2 stores data for $0.015 per GB-month and does not charge for egress.
Object storage and sandboxes
An agent's input data usually already lives in a bucket. Mounting the bucket saves a download on every run. The host keeps the key, so a prompt injection in that data cannot send the credential anywhere. Runtime stores its own state on disks instead. That state includes a sandbox's files, a volume that outlives sandboxes, and snapshots copied off their server (snapshots survive their server). Runtime does not sell an object store of its own today. It mounts yours.
Related
- How to mount an S3 bucket in a sandbox
- What are egress fees?
- What is a sandbox snapshot?
- What is workload identity?
Sources
Checked 25 October 2026.