Docs

Volcano Engine Function as a Service

AI Application

Quickly deploying SandboxFusion code sandbox

This article introduces the use of Volcano Engine Function as a Service (veFaaS) to quickly deploy code sandbox service based on the open-source SandboxFusion project, to meet the needs of running code in the sandbox.

Background information

SandboxFusion is an HTTP‑based code sandbox service that supports 23 programming languages. It leverages namespace resource isolation and cgroup resource control technologies to achieve lightweight security isolation. With flexible deployment adaptability for diverse devices, it meets multi‑scenario requirements ranging from edge nodes to cloud servers.

Prerequisites

Relevant products with Volcano Engine activated

veFaaS

API Gateway (APIG)

Procedure

In the top navigation bar, select the target region.

In the left navigation bar, click Cloud sandbox > Sandbox app. Then, click Create sandbox app.

On the Create sandbox application page, configure the parameters. The following parameters need special attention when deploying SandboxFusion. Other parameters can remain at their default values. For detailed parameter descriptions, see Sandbox application.

Parameter	Description
Basic information
Name	Specify a custom name for the sandbox application. The sandbox application name must be unique within the same account. The name cannot be modified after being created.
For sandbox images
Container image	Select Public image. In the Image address search box on the right, search for the target image by entering sandbox-fusion. Select an image version as needed. Python language image: the image tag is vefaas-latest. Multi-language image: the image tag is vefaas-python.
Startup command	Keep the default settings as bash /root/sandbox/scripts/run.sh.
Listening port	Keep the default setting as 8000.
Gateway routing configuration
Domain type	The domain type of the sandbox application. Valid values: Unified domain: All the instances in a sandbox application share the same domain name. You can target a specific instance by including the x-faas-instance-name header or the faasInstanceName query parameter in requests. Wildcard domain: [Beta - apply for trial] Each sandbox instance can have a separate access address. For description of sandbox instances, see Sandbox instances.
APIG instance	Select an APIG instance. The sandbox application will use an APIG instance as the traffic entrance.
Gateway service	Select the service that corresponds to the APIG instance.
Route name	Specify a custom route name. The route name cannot be modified after being created.
Path	Set a request path through which the sandbox application can be accessed. It can be matched only by a prefix and must start with a forward slash (/).

After successful creation, click Release in the upper-right corner of the Sandbox Application page to complete the deployment of the SandboxFusion sandbox service.

Result validation

After the release is completed, you can use the public endpoint of SandboxFusion to verify the application deployment result.

tip

Log in to the created application. The public address of the application can be found at Basic information > Gateway route settings > Configurations > the Internet.

Call the SandboxFusion service via API

The following code demonstrates how to call the API using the curl command to experience the SandboxFusion service.

tip

Replace https://****.apigateway-cn-beijing.volceapi.com with the public address of the SandboxFusion service.

Replace the values in the datafield based on your business requirements. For related parameter prescriptions and examples, refer to the open-source document Sandbox Fusion.

Access the SandboxFusion service via browser

Enter the public address in the browser and press Enter.

Click the Playground tab and select Sandbox.

In the Code text box, enter the code segment to be run, and select the corresponding programming language, and click Submit to submit code run request.

After the execution is completed, view the result output.

Request SandboxFusion service via veFaaS function.

In the top navigation bar of the veFaaS console, select China (Beijing) region and create an event function with a Python runtime. For detailed description, refer to Event function.

After the function is successfully created, on the Code tab of the function detail page, add the public address to the code.

Save code updates and release functions. For details, refer to Releasing functions.

Conduct an online test. For detailed operations, refer to Test function.

The sample request parameters are as follows:

"data": {
"code": "print(\"Hello, SandboxFusion!\")",
"language": "python"
},

The sample codes are shown below. For calling parameters of run_code interfaces in different languages, refer to Run Code.

import json
import http.client
import re

def handler(event, context):
print("received new request\n")

conn = http.client.HTTPSConnection("******.apigateway-cn-beijing.volceapi.com")
headers = {
'Content-Type': 'application/json',
'Accept': 'application/json'
}

# Obtain request data
reqBody = event["body"]
reqData = json.loads(reqBody)
code_str = reqData.get("code")
language = reqData.get("language")

# Default code
if not code_str:
code_str = "def reverse_string(s):\n return s[::-1]\ninput_string = \"Hello, World!\"\nreversed_string = reverse_string(input_string)\nprint(\"Reversed string:\", reversed_string)"
# Default language
if not language:
language = "python"

# Call the run_code API of the sandbox to run the code
payload = json.dumps({
"compile_timeout": 30,
"run_timeout": 30,
"code": code_str,
"language": language,
"files": {}
})
conn.request("POST", "/run_code", payload, headers)
res = conn.getresponse()
data = res.read()
response = data.decode("utf-8")

# Extract result
run_result = json.loads(response).get("run_result")

# Return result
result = {
'statusCode': 200,
'headers': {
'Content-Type': 'application/json'
},
'body': json.dumps({
'message': {
"result": run_result,
"language": language,
"code": code_str
}
})
}
return result

Last updated: 2026.08.19 14:06:06