Create a sandbox, run code, serve a URL, and fork it from a snapshot
A sandbox is a disposable environment your code creates, uses, and throws away. In about five minutes you’ll create one, run code in it, serve a URL, fork it from a memory snapshot, and attach a GPU. For a persistent machine that keeps its disk between sessions, start with the VM quickstart.
Using Cursor, Claude Code, or Codex? Run beam setup agent to connect your coding agent to your workspace. See agent setup.
Save this as sandbox.py and run python sandbox.py:
sandbox.py
from beam import Sandbox# Create a sandbox and run codesb = Sandbox(cpu=1, memory="1Gi", keep_warm_seconds=600).create()print(sb.process.run_code("print(sum(range(10)))").stdout) # 45# Start a web server and get a URLsb.fs.write_text("/workspace/index.html", "Hello from a Beam sandbox")sb.process.exec( "python3", "-m", "http.server", "8000", "--bind", "0.0.0.0", cwd="/workspace",)print(sb.expose_port(8000))# Snapshot memory, including the running server, then fork itsnapshot_id = sb.snapshot_memory()sb.terminate()forks = [Sandbox().create_from_memory_snapshot(snapshot_id) for _ in range(3)]for fork in forks: print(fork.list_urls()) # each fork serves its own copy fork.terminate()
Preview URLs are public. Add authentication in your app before serving anything sensitive.
Each sandbox is isolated from your app and other workloads. Block outbound traffic or allow only specific hostnames, wildcard domains, IPs or CIDRs:
from beam import Sandboxsb = Sandbox(block_network=True).create() # no outbound trafficsb.update_network_permissions(block_network=False, allow_list=[]) # reopen it at runtimesb.terminate()sb = Sandbox(allow_list=["api.openai.com"]).create() # or allow only this APIsb.terminate()
To give the agent credentials, use brokered secrets. The guest receives placeholders; the worker supplies the real values only in HTTPS headers to approved hosts. With block_network=True and secrets, only their approved hosts are reachable. The guest has no automatic Beam workspace token.
