How to give a LangChain agent a code execution sandbox

On Runtime the whole integration is one list comprehension, and the machine behind it is a full Linux microVM for $0.03125 an hour while the agent waits. sandbox_tools(sbx) returns four typed Python functions with docstrings, which LangChain turns into tools as it does any function. Each command runs in a Firecracker microVM with its own kernel. Python 3.12, Node.js 24, git and gcc are installed, and pip install is allowed. langchain 1.4.7 was the current PyPI release on 25 October 2026; the tools ran in LangChain's own agent loop with LangChain 1.4 on 23 September 2026.

Install

Terminalpip install -U langchain langchain-anthropic withruntimenpx withruntime login

The login approves this machine in your browser. On a server, set RUNTIME_API_KEY instead. Any LangChain chat model works; this page uses the model string LangChain's own quickstart shows.

An agent that runs code

Pythonfrom langchain.agents import create_agentfrom langchain_core.tools import toolfrom withruntime import Sandboxfrom withruntime.tools import sandbox_toolsdef solve(model, task: str) -> str:    with Sandbox.create() as sbx:        agent = create_agent(model, tools=[tool(f) for f in sandbox_tools(sbx)])        result = agent.invoke({"messages": [{"role": "user", "content": task}]})        return result["messages"][-1].contentprint(solve("claude-sonnet-4-6", "Fetch nothing. Fit a line to (1,2), (2,4.1), (3,6.2) with numpy and give the slope."))

The with block deletes the sandbox when solve returns, even after an exception. These are the four tools the model sees:

Relative paths resolve under /workspace. Commands run under bash -c and stop after 300 seconds unless the model asks for another limit. Output beyond 20,000 characters is cut from the front, so the end of a long log, where the error is, reaches the model.

Tune the tools

sandbox_tools takes three keyword arguments, and AsyncSandbox gives coroutine tools for agent.ainvoke:

Pythonimport asynciofrom langchain.agents import create_agentfrom langchain_core.tools import toolfrom withruntime import AsyncRuntimefrom withruntime.tools import sandbox_toolsasync def analyse(model, question: str) -> str:    async with AsyncRuntime() as runtime:        async with await runtime.sandboxes.create(timeout_seconds=900) as sbx:            tools = sandbox_tools(sbx, root="/workspace/job", timeout_seconds=60, max_output_chars=5_000)            agent = create_agent(model, tools=[tool(f) for f in tools])            result = await agent.ainvoke({"messages": [{"role": "user", "content": question}]})            return result["messages"][-1].contentprint(asyncio.run(analyse("claude-sonnet-4-6", "How many primes are below one million?")))

LangChain's own code interpreter integrations

LangChain has no code runner in its core package. Its tools directory lists code interpreter integrations, read on 25 October 2026:

Those three are interpreters. The model sends code and gets output back. The Runtime tools give the model a shell and a filesystem. So it can install a package, write a module, run the tests and read the failure. A coding or data agent spends most of its turns on that work. Runtime also has the interpreter style: sbx.interpreter.run(code) keeps variables between calls in Python, JavaScript, TypeScript, R, Java, Bash and Go.

What the agent can reach beyond the four tools

Your code holds sbx, so between turns it can use the rest of the SDK:

• Share a web app the agent started: sbx.previews.create(8000) returns a private HTTPS address (previews).
• Park a session with sbx.pause(): files, memory and processes are kept and compute billing stops; any later call wakes it.
• Branch with sbx.fork(count=2), two running copies with the memory included, to let two agents try different fixes (images, volumes and snapshots).
• Start ready from a custom image with your packages installed: Sandbox.create(image="data").

Keep keys and spending safe

The model key stays in the Python process that runs the agent; the sandbox only receives commands. The sandbox's reach is set when you create it:

Pythonfrom withruntime import Sandboxwith Sandbox.create(    timeout_seconds=600,    on_lease_end="stop",    max_total_cost_micros=25_000,  # stop it once it has cost $0.025    network={"internet": True, "allow": ["pypi.org", "*.pythonhosted.org"]},) as sbx:    sbx.exec("pip install --quiet pandas", check=True, timeout_ms=180_000)    sbx.network.set(internet=False)  # the agent's own code runs offline

• Daily spending limit. Set one on the key the agent uses. A create, wake or extension past the limit fails with spending_limit_reached and costs nothing. The agent cannot raise it (limits).
• Read-only key for dashboards or cron checks that list sandboxes and their costs without starting anything.
• Secrets. A database URL or API token the code needs is stored once; the sandbox holds a placeholder, and the host adds the real value only to HTTPS requests to the hosts you name (secrets).

What it costs

Runtime bills CPU as it is used, $0.025 per vCPU-hour with a floor of a twentieth of a vCPU, and reserved memory at $0.0075 per GiB-hour. With both CPUs busy, 2 vCPU and 4 GiB is $0.08 an hour. A new account gets 100 free hours of a 1 GB machine in its first 30 days, without a card (pricing).

For graphs with a tool node, see LangGraph; for LangChain's planning agents with a sandbox backend, see Deep Agents. A full analysis agent is in data analysis agent. The langchain-withruntime package, with the Deep Agents backend and these tools in one install, has its own guide: LangChain, LangGraph and Deep Agents.

Sources

Checked 25 October 2026.

• LangChain quickstart: pip install -U langchain and create_agent(model="claude-sonnet-4-6", ...)
• LangChain tools: a function's docstring becomes the tool's description
• LangChain tool integrations: the code interpreter table
• langchain on PyPI: version 1.4.7

Facts on this page were checked on 25 October 2026.