Runtime changelog, 18 October 2026

What shipped in Runtime Cloud on 18 October 2026: apps console with traffic and live releases; move from Cloudflare Sandbox to Runtime; a sandbox can name the secrets it gets; one deletion email a day, not one per pause; a secret that could not be added is no longer silent; a pause succeeds when its server's snapshot space is full; snapshots and forks in bursts no longer wait running; secret scopes in the Python, Go, Ruby and Java SDKs; a sandbox out of memory still answers; fetch a web page in under a second with a paused browser; connection limit per site: 429 Too Many Requests from the egress proxy; identity tokens from any running sandbox; no 429 for a busy key right after an update of Runtime; and daytona's GPU and sort enums import from the drop-ins.

Apps console with traffic and live releases

Console → Apps shows each App as a card with its last day of requests, error rate, copies running, last release and this month's cost. An App's page draws its copies by version, a release step by step as requests move to the new version, its requests, errors and latency over an hour, a day or a week, its busiest routes, and log search by request id or any words. A failed release keeps its output, and the previous version rolls back in one click. See custom domains on an App.

Move from Cloudflare Sandbox to Runtime

A Worker written for Cloudflare's Sandbox SDK (0.x) now runs on Runtime sandboxes once you change its import to withruntime/cloudflare, delete the containers block from wrangler.jsonc and add a RUNTIME_API_KEY secret. Commands, streaming, files, background processes, the code interpreter, preview URLs, sessions and gitCheckout work as before. See change the import.

A sandbox can name the secrets it gets

Create a sandbox with secrets: ["ANTHROPIC_API_KEY"] (runtime sandboxes create --secret ANTHROPIC_API_KEY) and it gets only that egress secret: no placeholder for any other, and our proxy puts no other value into its requests. An agent given untrusted input can no longer send a key meant for other work. [] is none; the list narrows each secret's own only, is fixed for the sandbox's life, and a fork or copy of a snapshot may only narrow it. In the API, the MCP tool and every SDK. See secrets sandboxes never see.

One deletion email a day, not one per pause

A sandbox with :retention days of its own is a day or so from deletion after each idle pause, and its owners were emailed a warning on every pause, though using it again cancels the deletion. Warnings for dates you set this way are now emailed at most once a day for the account, listing every sandbox due, and never once a sandbox has woken or paused again since; the email says its own retention chose the date, and null keeps it while you have credit. See pricing.

A secret that could not be added is no longer silent

When a request to a secret's host leaves your sandbox without the secret because our server could not add it at that moment, the sandbox now gets a sandbox.secret_not_applied event with reason withheld, saying the fault is ours and what to do. See events.

A pause succeeds when its server's snapshot space is full

Saving a snapshot now leaves the room each server keeps for pausing the sandboxes it runs. When that room is short, the server makes room while the pause waits, up to about a minute: it compresses saved memory images, moves kept snapshots to other servers, and copies paused sandboxes to storage and shrinks them. If there is still no room, the sandbox is paused all the same: the server holds its memory and saves it once there is room, and a wake meanwhile resumes it at once. Such a pause used to fail. Only a sandbox too near the end of its time to save its memory later is not paused: the pause fails with no_capacity (409, retryable) and the sandbox keeps running, its memory intact. A snapshot the server has no room for is refused with host_capacity (409); retry it later. See pause, wake, extend.

Snapshots and forks in bursts no longer wait running

A snapshot or a fork of a running sandbox now stops it at once, so the snapshot, or the fork's copies, hold the memory of the moment you asked, and then waits for its turn at the server's disk with the sandbox stopped. Before, it waited for that turn with the sandbox still running, and a burst on one server could take tens of seconds each, the sandbox changing all the while. A sandbox whose time limit or funded time ends soon, on a busy server, still waits running and stops at its turn, as before. See products.

Secret scopes in the Python, Go, Ruby and Java SDKs

The SDKs can now give a secret to some sandboxes instead of all of them, as the JavaScript SDK can: only on secrets.set (only= in Python and Ruby, Only in Go, a sixth argument in Java) and secrets.scope(name, only) (Scope in Go), which changes who gets an existing secret without its value. Python is 0.17.0, Go 0.6.0, Ruby 0.5.0 and Java 0.5.0. See secrets sandboxes never see.

A sandbox out of memory still answers

When a sandbox's programs fill its memory, Linux now ends one of them for memory, as the guide says, instead of the whole sandbox slowing until commands, reads and kills time out. Your programs share its memory less a small reserve for the sandbox's own services. See when a program runs out of memory.

Fetch a web page in under a second with a paused browser

The guides show how to keep spare browsers paused, charged only for storage, and wake one per page: wake to page done measured 0.56 to 0.81 seconds. Python's guide gains its browser section. See A page in under a second.

Connection limit per site: 429 Too Many Requests from the egress proxy

A sandbox opens up to 20 new connections a second to one site, and an account's sandboxes on one server up to 100 together, after a burst. Past it the connection is refused with 429 and a sentence naming the site. Downloads over open connections, installs, clones, storage, CDNs and AI APIs are never counted. See connections to one site.

Identity tokens from any running sandbox

A program with no RUNTIME_ID_TOKEN_REQUEST_* variables, such as one started before they were set or a sandbox kept from older guest software, now gets a token too: Sandbox.identityToken() (TypeScript 0.17.3), Python's Sandbox.identity_token() (0.16.2) and runtime sandboxes identity-token ask the sandbox's host for them, and the docs show the same with curl alone. See identity tokens.

No 429 for a busy key right after an update of Runtime

A key whose account runs many sandboxes may send up to 8 times the ordinary rate. Just after Runtime updated its servers, its first requests met the ordinary rate instead, for the moment it took to recognise the key, so a burst sent then was answered 429 rate_limited. Those requests now wait that moment, at most two seconds, and are served at the key's own rate.

Daytona's GPU and sort enums import from the drop-ins

The Daytona drop-ins follow Daytona 0.225.0 and the Prime Sandboxes one follows 0.4.6. GpuType, SandboxClass and the list sort enums now import from withruntime/daytona and withruntime.daytona, and the sort enums sort list. A Python create that asks for a GPU type now gets a plain error, as TypeScript already did, instead of a CPU sandbox. Prime's new lan_network_id on create is refused before a sandbox is made, naming Runtime's private network. See Migrate.