How to run Qwen Code in a cloud sandbox

Runtime gives Qwen Code's yolo mode the isolated machine its authors ask for, and keeps the DashScope key off that machine. Qwen Code's headless guide warns that --yolo "does not enable a sandbox" and recommends it for an isolated runner or container. A Runtime sandbox is a Firecracker microVM with its own kernel, Ubuntu 24.04 and Node.js 24. That meets the CLI's Node.js 22 requirement. The key lives as a Runtime secret, so the machine holds only a placeholder. While it waits on the model, a 2 vCPU, 4 GiB sandbox costs $0.03125 an hour. The npm release on 25 October 2026 was 0.26.1.

One secret, one settings file

Qwen Code talks to any OpenAI-compatible endpoint. Its auth guide suggests a single ~/.qwen/settings.json. That file names the provider, the model and the environment variable that holds the key. Store the key under that variable's name, bound to the endpoint's host. This example uses Alibaba Cloud Model Studio's international endpoint:

Terminalprintf %s "$DASHSCOPE_API_KEY" | npx withruntime secrets set DASHSCOPE_API_KEY --host dashscope-intl.aliyuncs.com

Every sandbox then has DASHSCOPE_API_KEY holding a placeholder. The proxy fills in the true value only on HTTPS requests to that host. The settings file below holds no key, only the name of the variable. Qwen Code's envKey field takes that name (secrets sandboxes never see).

A key from a Coding Plan or Token Plan works the same way. Bind the secret to that plan's host, and set baseUrl to the matching address from Qwen Code's provider guide.

Drive it from TypeScript or Python

TypeScriptimport { writeFile } from "node:fs/promises";import { Sandbox } from "withruntime";const repo = "https://github.com/your-org/your-repo";const task =  "Replace the deprecated date library with the standard Intl API and keep the tests green.";const settings = {  modelProviders: {    openai: [      {        id: "qwen3-coder-plus",        name: "qwen3-coder-plus",        baseUrl: "https://dashscope-intl.aliyuncs.com/compatible-mode/v1",        envKey: "DASHSCOPE_API_KEY",      },    ],  },  security: { auth: { selectedType: "openai" } },  model: { name: "qwen3-coder-plus" },};await using sbx = await Sandbox.create({ diskMiB: 8192, timeoutSeconds: 3600 });await sbx.files.write("/workspace/.qwen/settings.json", JSON.stringify(settings, null, 2));const install = { check: true, timeoutMs: 600_000 } as const;await sbx.exec("npm install -g --prefix /workspace/.local @qwen-code/qwen-code", install);await sbx.exec(["git", "clone", "--depth", "1", repo, "/workspace/app"], install);await sbx.network.set({  internet: true,  allow: ["dashscope-intl.aliyuncs.com", "registry.npmjs.org"],});const run = await sbx.exec(  [    "qwen",    "-p",    task,    "--yolo",    "--max-session-turns",    "80",    "--max-wall-time",    "25m",    "--output-format",    "json",  ],  {    cwd: "/workspace/app",    env: { QWEN_CODE_SUPPRESS_YOLO_WARNING: "1" },    timeoutMs: 1_800_000,    onStderr: (text) => process.stderr.write(text),  },);const messages = JSON.parse(run.stdout);const last = messages[messages.length - 1];console.log(run.exitCode, last.subtype, last.result);await sbx.exec("git add -A && git diff --cached > /workspace/qwen.patch", {  cwd: "/workspace/app",  check: true,});await writeFile("qwen.patch", await sbx.files.readText("/workspace/qwen.patch"));

Pythonimport sys, jsonfrom withruntime import Sandboxrepo = "https://github.com/your-org/your-repo"task = "Replace the deprecated date library with the standard Intl API and keep the tests green."settings = {    "modelProviders": {"openai": [{        "id": "qwen3-coder-plus",        "name": "qwen3-coder-plus",        "baseUrl": "https://dashscope-intl.aliyuncs.com/compatible-mode/v1",        "envKey": "DASHSCOPE_API_KEY",    }]},    "security": {"auth": {"selectedType": "openai"}},    "model": {"name": "qwen3-coder-plus"},}with Sandbox.create(disk_mib=8192, timeout_seconds=3600) as sbx:    sbx.files.write("/workspace/.qwen/settings.json", json.dumps(settings, indent=2))    sbx.exec("npm install -g --prefix /workspace/.local @qwen-code/qwen-code",             check=True, timeout_ms=600_000)    sbx.exec(["git", "clone", "--depth", "1", repo, "/workspace/app"],             check=True, timeout_ms=600_000)    sbx.network.set(internet=True,                    allow=["dashscope-intl.aliyuncs.com", "registry.npmjs.org"])    run = sbx.exec(        ["qwen", "-p", task, "--yolo", "--max-session-turns", "80",         "--max-wall-time", "25m", "--output-format", "json"],        cwd="/workspace/app",        env={"QWEN_CODE_SUPPRESS_YOLO_WARNING": "1"},        timeout_ms=1_800_000,        on_stderr=sys.stderr.write,    )    last = json.loads(run.stdout)[-1]    print(run.exit_code, last["subtype"], last["result"])    sbx.exec("git add -A && git diff --cached > /workspace/qwen.patch",             cwd="/workspace/app", check=True)    with open("qwen.patch", "w") as file:        file.write(sbx.files.read_text("/workspace/qwen.patch"))

How the pieces fit:

• The settings file goes in first. security.auth.selectedType tells Qwen Code which protocol to use on start. It then never opens the /auth dialog, which a headless run cannot answer. HOME in a sandbox is /workspace, so ~/.qwen is /workspace/.qwen.
• --yolo approves shell, write and edit calls. The suppression variable only silences the one-line stderr warning that Qwen Code prints when yolo runs without its own sandbox. The microVM is the boundary instead.
• Budgets stop a stuck agent. --max-session-turns ends the run with exit code 53. --max-wall-time or --max-tool-calls ends it with exit code 55.
• JSON output is an array of messages. The last one has type: "result", a subtype such as success, and the final answer in result.
• The diff travels back as a file. Its size never hits the 64 KiB cap on returned output.

Flags for unattended runs

As documented in Qwen Code's headless guide on 25 October 2026:

Because sessions are stored in the sandbox's home, --continue works across tasks when the same sandbox is kept. Pausing it between tasks keeps the checkout, the session files and any running processes while compute billing stops.

Give Qwen Code Runtime's tools

With Qwen Code on your own machine, add Runtime's MCP server at user scope:

Terminalqwen mcp add --scope user runtime npx -y withruntime mcp

or put the same entry in ~/.qwen/settings.json:

JSON{  "mcpServers": {    "runtime": { "command": "npx", "args": ["-y", "withruntime", "mcp"] }  }}

On the first call, the server shows a link and a code. Approve Connect agent in the browser. That loads every Runtime tool, with no key written into the settings (MCP). In CI, RUNTIME_API_KEY from a secret manager replaces the browser step.

Cost

Runtime charges $0.025 per vCPU-hour of CPU actually used, with a floor of a twentieth of a vCPU, plus $0.0075 per reserved GiB-hour. For 2 vCPUs and 4 GiB, that is $0.03125 an hour idle and $0.08 an hour with both cores busy (pricing). Model Studio bills the tokens on your key. Try it on the usage included every month, 100 free hours of a 1 GB machine, with no card:

Terminalnpx withruntime sandboxes run -- node --version

Qwen Code shares its lineage with Gemini CLI, whose page uses Google's API instead. For many agents at the same time, see a sandbox for coding agents. For scoring runs, see agent evals.

Sources

Checked 25 October 2026.

• Qwen Code on GitHub: npm install -g @qwen-code/qwen-code@latest, Node.js 22 or later
• Headless mode: -p, --yolo, output formats, budgets, exit codes 53 and 55, the yolo warning
• Authentication: modelProviders, envKey, security.auth.selectedType
• Model providers: the international DashScope endpoint and the Coding Plan addresses
• MCP: qwen mcp add and mcpServers
• @qwen-code/qwen-code on npm: version 0.26.1

Facts on this page were checked on 25 October 2026.