Sandbox
run_code runs Python in a subprocess with memory, CPU, file and process limits and a cleaned environment. It is not a container or a virtual machine.
Builtin mode (default)
- Own virtual environment under data/sandbox_venv.
- Memory 512 MB, wall time 60 s, 256 open files, 200 MB files, no core dumps.
- Process budget: current count plus 24.
- No new privileges. Own process group, killed on timeout.
- Fresh temporary working folder. Python only.
External mode
Code is sent by HTTP to a sandbox service you run. The limits are then that service's.
What it does not stop
Network use, reading files the bot's user can read, and slow abuse within limits.
See sandbox-limits.json.
Limits
| Limit | Value | Enforced by | Applies to | Owner can change | Setting |
|---|---|---|---|---|---|
| Memory | 512 MB | RLIMIT_AS | builtin | Yes | SANDBOX_MAX_MEMORY_MB |
| Wall-clock timeout | 60 seconds | timer, process group killed | both | Yes | SANDBOX_TIMEOUT |
| CPU time | timeout + 5 seconds | RLIMIT_CPU | builtin | No | |
| Open files | 256 files | RLIMIT_NOFILE | builtin | No | |
| Largest file | 200 MB | RLIMIT_FSIZE | builtin | No | |
| Core dumps | 0 bytes | RLIMIT_CORE | builtin | No | |
| New processes | 24 above current count processes | RLIMIT_NPROC | builtin | No | |
| No new privileges | on flag | PR_SET_NO_NEW_PRIVS | builtin | No | |
| Working directory | fresh temporary folder path rule | subprocess setup | builtin | No | |
| Environment | secret-like names removed kinds: provider keys, bot tokens, names with TOKEN, SECRET, PASSWORD, API_KEY | environment scrub | builtin | No | |
| Language | Python only - | sandbox design | builtin | No | |
| External request timeout | timeout + 10 seconds | HTTP client | external | Yes | SANDBOX_TIMEOUT |
See also:Threat model
Checked against the source at commit f4fd89f on 29 Oct 2026. Everything here is merged on the main branch; no release has been tagged yet. The source is private, so these pages are the public description.