On Runtime, you are root in a Linux machine of your own, so apt works as it does on any Ubuntu 24.04 server. Every sandbox is a Firecracker microVM with its own kernel. Root inside a sandbox still cannot change its network rules, CPU, memory or cost. The host enforces those limits from outside.
To install a package once, install it into one sandbox. To have every sandbox start with it, build it into a custom image. Building is free. A stored image costs $0.08 per decimal GB per 30-day month (pricing).
Install into a running sandbox
TypeScriptimport { Sandbox } from "withruntime";await using sbx = await Sandbox.create({ diskMiB: 8192 });const apt = { check: true, timeoutMs: 600_000, env: { DEBIAN_FRONTEND: "noninteractive" } };await sbx.exec("sudo -E apt-get update -q", apt);await sbx.exec("sudo -E apt-get install -y -q ffmpeg imagemagick", apt);console.log((await sbx.exec("ffmpeg -version | head -1")).stdout);Pythonfrom withruntime import Sandboxwith Sandbox.create(disk_mib=8192) as sbx: env = {"DEBIAN_FRONTEND": "noninteractive"} sbx.exec("sudo -E apt-get update -q", env=env, check=True, timeout_ms=600_000) sbx.exec("sudo -E apt-get install -y -q ffmpeg imagemagick", env=env, check=True, timeout_ms=600_000) print(sbx.exec("ffmpeg -version | head -1").stdout)Terminalruntime sandboxes exec "${id}" -- sudo apt-get update -qruntime sandboxes exec "${id}" --timeout 600 -- sudo apt-get install -y ffmpeg-yanswers apt's "Do you want to continue?" prompt. A command in a sandbox has no one to answer it.DEBIAN_FRONTEND=noninteractive, kept bysudo -E, stops packages such astzdatafrom asking questions during setup.- An install takes longer than a command's 60-second default, so set
timeoutMs. A timeout returns a result with the output so far. It does not throw an exception.
Install once, in an image
A recipe's apt list installs packages at build time. Every sandbox made from
the image has them as soon as it starts:
TypeScriptimport { Runtime } from "withruntime";const runtime = new Runtime();await runtime.images.build( { name: "media", recipe: { apt: ["ffmpeg", "imagemagick", "poppler-utils"] } }, { onLog: (line) => console.log(line.text) },);await using sbx = await runtime.sandboxes.create({ image: "media" });await sbx.exec("pdftotext -v", { check: true });Pythonfrom withruntime import Runtimeruntime = Runtime()runtime.images.build(name="media", recipe={"apt": ["ffmpeg", "imagemagick", "poppler-utils"]}, on_log=lambda line: print(line["text"]))with runtime.sandboxes.create(image="media") as sbx: sbx.exec("pdftotext -v", check=True)Terminalruntime images build --apt ffmpeg --apt imagemagick --name mediaruntime sandboxes create --image mediaA recipe also takes pip, npm, commands, files, env and workdir.
It also takes base to start from any image instead of Runtime's. Each build
of a name becomes its next version and is tagged latest. So image: "media"
always selects the newest version
(custom images).
Which way to choose
| Way | When it fits | Cost |
|---|---|---|
sudo apt-get install in a sandbox |
One job, or packages that differ per run | The sandbox's own time while it installs |
Recipe apt in a custom image |
The same packages in every sandbox | Free to build. $0.08 per GB-month to store |
A Dockerfile with RUN apt-get ... |
You already have one | The same as any image |
| A paused sandbox | One machine you come back to, packages and all | Paused storage while it waits |
An account without credit stores its first three images free, even after it adds credit.
What is already there
The default image is Ubuntu 24.04.5 LTS for amd64. Before you install with apt,
check this list. Python 3.12 with pip and uv, Node.js 24 and Bun, gcc, g++
and make, git, curl, wget, ssh, zip, unzip, xz, rg, fd,
jq and sqlite3 are all installed
(what is installed). Java, Go and
Rust install from Ubuntu's packages with sudo apt-get install. You can also
use the language's own installer, such as rustup. Docker has its own command,
sudo enable-docker (how to).
Mistakes and how Runtime handles them
- Running out of disk.
diskMiBincludes the system image. The default 4 GiB sandbox had about 2.5 GiB free on 24 September 2026. Before a large install, ask for more, such asdiskMiB: 8192. - Leaving out
sudo. apt needs root.sudoworks without a password and keeps the proxy settings the sandbox needs to reach the internet. - Installing, then locking the network first. An allow list that leaves
out the package archive makes
apt-get updatefail. Install first, then narrow or turn off the internet (turn off sandbox internet). - Expecting packages in the next sandbox. A new sandbox starts from its image. Put the packages in the image. Or pause this sandbox and wake it later, with its files and memory kept (pause and resume).
Start
Terminalnpx withruntime sandboxes run --timeout 600 -- bash -c 'sudo apt-get update -q && sudo apt-get install -y cowsay && /usr/games/cowsay hi'A new account gets 100 free hours of a 1 GB machine in its first 30 days, with no card needed. The first run prints a link to approve in your browser. For Python packages, see install Python packages with uv.
Facts on this page were checked on 26 October 2026.