e2b
A Sandbox on an E2B cloud VM.
Pass it as agent({sandbox: e2b()}). Each sandbox starts from a template with no environment and no internet; the API key authenticates the host's requests only. TypeScript runs it on Bun and Node alike: it speaks E2B's API and each sandbox's envd directly, every request through the fenced fetch.
Import from @threads/e2b (TypeScript) or threads.e2b (Python).
function e2b(options?: {
apiKey?: string | Secret;
template?: string;
lifetimeMs?: number;
allowInternet?: boolean;
domain?: string;
fetch?: (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
}): SandboxParameters
apiKey / api_keystring | SecretThe E2B API key: a secret() or a string. Omitted: secret("E2B_API_KEY"). Resolved on the host at setup (check() or the first run); unset is missing_secret naming the option and the variable. It never enters a sandbox.
templatestringdefault baseThe E2B template a new sandbox starts from. It needs /bin/sh, env and tar (E2B's base has them).
lifetimeMs / lifetime_msnumberdefault 3600000How long a sandbox lives, in milliseconds, before E2B kills it (the declared expiry). A positive integer; anything else is invalid_config.
allowInternet / allow_internetbooleandefault falseLets the sandbox reach the internet. Its egress is then unenforced, so the agent must also set egress: "unenforced".
domainstringThe E2B domain, for a self-hosted or regional deployment. Omitted: E2B's default.
fetch(input: string | URL | Request, init?: RequestInit) => Promise<Response>TypeScript only. Seam: the fetch every E2B request goes through (a proxy, a test server); the run's fence wraps it either way, and redirects are never followed. Omitted: the runtime's fetch.
namestrdefault e2bPython only. The provider name in SandboxInfo and the sandbox ledger; rows under another name are never touched.
Returns
Throws ConfigError with one of these codes: invalid_config, missing_secret.