e2b

Pass it as agent({sandbox: e2b()}). Each sandbox starts from a template with no environment and no internet; the API key authenticates the host's requests only. TypeScript: runs on Bun (on Node the E2B SDK sends through undici, which threads can't fence).

Import from @threads/e2b (TypeScript) or threads.e2b (Python).

function e2b(options?: {
  apiKey?: string | Secret;
  template?: string;
  lifetimeMs?: number;
  allowInternet?: boolean;
  domain?: string;
  fetch?: (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
}): Sandbox

Parameters

apiKey / api_keystring | Secret

The E2B API key: a secret() or a string. Omitted: secret("E2B_API_KEY"). Resolved on the host at setup (check() or the first run); unset is missing_secret naming the option and the variable. It never enters a sandbox.

templatestringdefault base

The E2B template a new sandbox starts from. It needs /bin/sh, sed, find, stat and sha256sum (E2B's base has them).

lifetimeMs / lifetime_msnumberdefault 3600000

How long a sandbox lives, in milliseconds, before E2B kills it (the declared expiry). A positive integer; anything else is invalid_config.

allowInternet / allow_internetbooleandefault false

Lets the sandbox reach the internet. Its egress is then unenforced, so the agent must also set egress: "unenforced".

domainstring

The E2B domain, for a self-hosted or regional deployment. Omitted: E2B's default.

fetch(input: string | URL | Request, init?: RequestInit) => Promise<Response>

TypeScript only. Seam: the fetch the SDK sends through (a proxy, a test server); the run's fence wraps it either way. Omitted: the process's fetch.

namestrdefault e2b

Python only. The provider name in SandboxInfo and the sandbox ledger; rows under another name are never touched.

Returns

Sandbox

Throws ConfigError with one of these codes: invalid_config, missing_secret, transport_fence_unsupported (TypeScript only).

Parameters

Returns

On this page