Best sandbox for LlamaIndex agents in 2027

Q: What should a sandbox give a retrieval agent?

A place to compute, apart from the index. Retrieval stays in your process. Only the snippet the model wrote crosses into the sandbox, with the rows it needs written in as a file. The data libraries already there. With pandas, NumPy and matplotlib in the image, a chart or a group-by needs no install step. Files in, files out. Write a CSV or a PDF in, and read a chart back to show the user. More than Python when it helps. A shell lets the model call jq, sqlite3 or gcc with the same tool. A clean machine per conversation. One sandbox per chat keeps one user's uploads away from the next. It pauses when the chat goes quiet.

Q: When might another sandbox fit better?

Azure-only deployments. A team that must keep everything inside Azure can use the Azure dynamic sessions tool spec LlamaIndex ships.

Which sandbox is best for LlamaIndex?

It depends on where your data may go. For analysis over retrieved rows, Runtime has the lowest cost of the services priced below: $56.94 for fifty thousand calls, compared with $115.04 on Cloudflare Sandbox and $276.00 on E2B. A call mostly waits on the model. Runtime bills measured CPU, and pandas is already installed. Pick the Azure tool spec LlamaIndex ships if everything must stay inside Azure. Keep the local code interpreter tool out of production, as its own source advises.

Where does LlamaIndex run code today?

Tool	Package	Where the code runs
`CodeInterpreterToolSpec`	`llama-index-tools-code-interpreter` 0.6.0	`python -c` in a subprocess on your own host
Azure code interpreter tool spec	`llama-index-tools-azure-code-interpreter`	Azure Container Apps dynamic sessions

The first tool's source, read on 25 October 2026, states the risk plainly: "Arbitrary code execution is possible on the machine running this tool", and it "is not recommended to be used in a production setting, and would require heavy sandboxing or virtual machines". It runs the model's code with subprocess.run beside your index, your keys and your data.

Any other sandbox plugs in by wrapping its SDK's functions as FunctionTools.

What should a sandbox give a retrieval agent?

A place to compute, apart from the index. Retrieval stays in your process. Only the snippet the model wrote crosses into the sandbox, with the rows it needs written in as a file.
The data libraries already there. With pandas, NumPy and matplotlib in the image, a chart or a group-by needs no install step.
Files in, files out. Write a CSV or a PDF in, and read a chart back to show the user.
More than Python when it helps. A shell lets the model call jq, sqlite3 or gcc with the same tool.
A clean machine per conversation. One sandbox per chat keeps one user's uploads away from the next. It pauses when the chat goes quiet.

What does a month of LlamaIndex analysis cost?

Fifty thousand calls, each two minutes on a 2 vCPU, 4 GiB sandbox and busy for 20 CPU-seconds, at each provider's published rates:

Provider	Isolation	CPU billed on	A month of calls
Runtime Cloud	Firecracker microVM	Measured use	$56.94
Cloudflare Sandbox	A container in its own VM	Measured use	$115.04
Vercel Sandbox	Firecracker microVM	Measured use	$176.89
E2B	Firecracker microVM	Every vCPU held	$276.00
Modal	gVisor, a shared kernel	The CPU requested	$396.60

When might another sandbox fit better?

Azure-only deployments. A team that must keep everything inside Azure can use the Azure dynamic sessions tool spec LlamaIndex ships.

Runtime Cloud

Runtime runs a LlamaIndex agent's code in a Firecracker microVM with its own kernel. Four ordinary FunctionTools from sandbox_tools, in the withruntime package, wrap the sandbox, so a FunctionAgent or a workflow calls it like any other tool. The agent can read the documents your index retrieved, compute over them with pandas, and return a number it actually ran.

pandas, NumPy and matplotlib are in the default image.
sbx.files.write puts a CSV or a PDF in. sbx.files.read brings a chart back.
The same runtime_exec tool runs jq, sqlite3 or gcc.

The fifty thousand calls above cost $56.94 on Runtime, 79% less than E2B, at rates checked 25 October 2026. A call that spends most of its two minutes waiting for the model is billed for the CPU it uses, not the two vCPUs it holds.

A run on Runtime, recorded 1 October 2026

Terminalpip install withruntime llama-index-core llama-index-llms-anthropic "anthropic<1"

Pythonfrom llama_index.core.agent.workflow import FunctionAgentfrom llama_index.core.tools import FunctionToolfrom llama_index.llms.anthropic import Anthropicfrom withruntime import Sandboxfrom withruntime.tools import sandbox_toolsasync def ask(question: str) -> str:    with Sandbox.create() as sbx:        tools = [FunctionTool.from_defaults(fn=f) for f in sandbox_tools(sbx)]        agent = FunctionAgent(tools=tools, llm=Anthropic(model="claude-sonnet-4-6"))        return str(await agent.run(user_msg=question))

LlamaIndex has no scripted function-calling model to drive the agent without a paid call. So on 1 October 2026, we called the same FunctionTools directly, as the agent does, against a live sandbox with llama-index-core 0.14.25:

textruntime_write_file words.py   Wrote 139 bytes to /workspace/words.pyruntime_exec python3 words.py  exit_code 0  [('ubuntu', 9), ('url', 4), ('https', 4)]

The script counted words in the sandbox's own /etc/os-release, which is Ubuntu's, not your server's. Swapping the tool in an existing agent and mixing it with retrieval are in LlamaIndex in a sandbox.

Free usage covers a first agent. Run npx withruntime login and ask it a question. An agent whose tools call another sandbox provider moves with the migration guide.

Sources

Checked 25 October 2026.

llama-index-tools-code-interpreter on PyPI: version 0.6.0, whose source holds the warnings quoted and the subprocess.run call
llama-index-tools-azure-code-interpreter on PyPI
Each provider's published rates, checked 25 October 2026, as the pricing guide lists them
The recorded run: Runtime's Python SDK with llama-index-core 0.14.25 on Python 3.12, against production on 1 October 2026