# Sandbox reference

URL: https://briq.cloud/docs/sandbox

> Every tool in a sandbox briq, with its version, and the sandbox's limits.

A sandbox is a briq that runs our image, `ghcr.io/briq-cloud/sandbox`, and nothing else: the
agent runs commands in it with `briq_exec` ([recipe](https://briq.cloud/cookbook/sandbox),
[guide](https://briq.cloud/docs/guides/run-code-in-a-sandbox)). This page lists what the image has, from the build
of 2026-10-19. It is rebuilt every Monday from
[briq-cloud/sandbox](https://github.com/briq-cloud/sandbox); the current build's versions are in
its [REFERENCE.md](https://github.com/briq-cloud/sandbox/blob/main/REFERENCE.md), and
`sandbox-versions` prints them inside a sandbox.

```text
briq_run({ recipe: "sandbox" })
briq_run({ recipe: "sandbox", image: "ghcr.io/briq-cloud/sandbox:full" })
briq_run({ recipe: "sandbox", image: "ghcr.io/briq-cloud/sandbox:2026-10-19" })
```

| Tag                                       | What                                                                        | Size    |
| ----------------------------------------- | --------------------------------------------------------------------------- | ------- |
| `latest` (the recipe's default), `<date>` | Languages, tools, database clients                                          | 480 MB  |
| `full`, `full-<date>`                     | The default, plus documents, media, the Python data libraries and a browser | 1.15 GB |

`latest` and `full` follow the newest build. A date tag never moves: pin one when the sandbox
must not change between runs.

## Languages

| Language | Version                                               | Package managers                          |
| -------- | ----------------------------------------------------- | ----------------------------------------- |
| Python   | 3.13.16 (`python`, `python3`), 3.12.15 (`python3.12`) | pip 26.2, uv 0.13, poetry 2.5             |
| Node.js  | 24.22.0                                               | npm 11.19, pnpm 12.14, yarn 1.22, bun 1.4 |
| C/C++    | gcc 13.3                                              | make 4.3, cmake 3.28, ninja 1.11          |

Another language is another `image`: `golang:1.25-bookworm`, `rust:1-slim`, `ruby:3.4`, anything
with `sh`. The recipe's command, volume and port stay.

## Database clients

The sandbox has the clients. The servers are briqs in the same stack, the
[postgres](https://briq.cloud/cookbook/postgres) and [redis](https://briq.cloud/cookbook/redis) recipes, each with its connection string.

| Client                          | Version | For            |
| ------------------------------- | ------- | -------------- |
| `psql`, `pg_dump`, `pg_restore` | 16.15   | PostgreSQL     |
| `redis-cli`                     | 7.0.15  | Redis          |
| `sqlite3`                       | 3.45    | SQLite, a file |

## Tools

* **Version control**: `git` 2.43, `git-lfs`, `ssh`.
* **HTTP**: `curl`, `wget`, `nc`, `dig`.
* **JSON and YAML**: `jq` 1.7, `yq` 4.54.
* **Files**: `rg` (ripgrep), `fd`, `tree`, `file`, `less`, `diff`, `patch`.
* **Archives**: `tar`, `zip`, `unzip`, `xz`, `bzip2`, `gzip`.
* **Editors and terminals**: `vim`, `nano`, `tmux`.
* **Build**: `gcc`, `g++`, `make`, `cmake`, `ninja`, `pkg-config`, the OpenSSL, libffi and zlib
  headers.
* **Processes and network**: `ps`, `lsof`, `ss`, `ip`.

## The `full` tag

Everything above, and:

* **Documents**: `pandoc` 3.1, `pdftotext` and `pdftoppm` (poppler), `qpdf`.
* **Media**: `ffmpeg` 6.1, ImageMagick (`convert`, `identify`), `tesseract` (OCR, English),
  Graphviz (`dot`).
* **Python libraries** for `python`: NumPy, pandas, Matplotlib, openpyxl, python-docx, python-pptx,
  pypdf, requests, Playwright.
* **Browser**: Playwright 1.64 for Node.js (`playwright`, global) and Python, with Chromium at
  `/opt/pw-browsers`. `PLAYWRIGHT_BROWSERS_PATH` is set, so neither needs `playwright install`.
  Firefox and WebKit are not installed. For a browser other code connects to, the
  [chrome](https://briq.cloud/cookbook/chrome) recipe is a briq of its own.

Not in either tag: LibreOffice, TeX Live, Java, Go, Rust, Ruby, PHP. Install one with `apt-get`,
or run another `image`.

## Specifications

|                   |                                                                                                                                                                               |
| ----------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Operating system  | Ubuntu 24.04 LTS, `linux/amd64`                                                                                                                                               |
| Memory and CPU    | By `size`: `nano` to `large`, 512 MB to 8 GB ([sizes](https://briq.cloud/docs/cost)); `small` by default                                                                                        |
| Disk              | A volume at `/work`, 2 GB by default (`volume: { gb }` at run), plus the image's own disk. Files anywhere survive sleep; `briq_fork` copies them                              |
| Working directory | `/work`; relative paths in `files` are boot files, written at each start                                                                                                      |
| User              | `root`                                                                                                                                                                        |
| Process           | `sleep infinity`; the briq stays up for the commands, and sleeps after its `sleep` window unused                                                                              |
| Commands          | `briq_exec`: a minute, 32 KB of output; `async: true`: up to 24 hours, the whole output kept in the briq; ten at once ([Run a long command](https://briq.cloud/docs/guides/run-a-long-command)) |
| Files             | `briq_files_put` and `briq_files_get`, 1 MB a file; more from inside (`git clone`, `curl`)                                                                                    |
| Network           | Outbound open, except mail (SMTP ports). The team's other briqs by host name. Inbound only through `expose`: whatever listens on `$PORT` (8080) serves at the URL             |
| Environment       | `PORT=8080`, `LANG=C.UTF-8`, `TZ=UTC`, and what you pass in `env` (a credential as `{ secret, value }`)                                                                       |

Isolation, what briq stores and the abuse policy: [Security](https://briq.cloud/docs/security).