How to compile and run C++ code in a sandbox

Write the source into a Linux microVM, build it with g++ or CMake there, and run the binary with a time limit and no network.

On Runtime g++ is already in every sandbox, and you pay only for the CPU the build uses. Each sandbox is a Firecracker microVM running Ubuntu 24.04.5 with build-essential, and Runtime bills measured CPU at $0.025 per vCPU-hour, so a sandbox that waits between builds costs the floor of a twentieth of a vCPU. A 2 vCPU, 4 GiB sandbox costs $0.03125 an hour waiting and $0.08 an hour with both cores compiling, at the rates checked on 25 September 2026 (pricing).

What the image has for C++

Pass -std=c++20 for C++20: GCC makes it the default mode only from GCC 16 (C++ status in GCC), and Ubuntu 24.04 ships GCC 13. Install anything else with sudo apt-get install -y, which works without a password (the sandbox environment).

Compile one file and run it

Keep the compile and the run as two commands. The build's stderr is the compiler's diagnostics; the run's stderr is the program's own.

TypeScriptimport { Sandbox } from "withruntime";const source = `#include <algorithm>#include <iostream>#include <vector>int main() {  std::vector<int> v{5, 3, 9, 1};  std::ranges::sort(v);  for (int x : v) std::cout << x << ' ';  std::cout << '\\n';}`;await using sbx = await Sandbox.create({  network: { internet: false },  timeoutSeconds: 300,  onLeaseEnd: "stop",});await sbx.files.write("/workspace/main.cpp", source);const build = await sbx.exec(["g++", "-std=c++20", "-O2", "-Wall", "-o", "main", "main.cpp"], {  timeoutMs: 120_000,});if (build.exitCode !== 0) throw new Error(build.stderr);const run = await sbx.exec(["./main"], { timeoutMs: 10_000 });console.log(run.stdout); // 1 3 5 9

Pythonfrom withruntime import Sandboxsource = """#include <algorithm>#include <iostream>#include <vector>int main() {  std::vector<int> v{5, 3, 9, 1};  std::ranges::sort(v);  for (int x : v) std::cout << x << ' ';  std::cout << '\\n';}"""with Sandbox.create(network={"internet": False}, timeout_seconds=300, on_lease_end="stop") as sbx:    sbx.files.write("/workspace/main.cpp", source)    build = sbx.exec(["g++", "-std=c++20", "-O2", "-Wall", "-o", "main", "main.cpp"], timeout_ms=120_000)    if build.exit_code != 0:        raise SystemExit(build.stderr)    run = sbx.exec(["./main"], timeout_ms=10_000)    print(run.stdout)

Template-heavy C++ can take longer to compile than the 60-second default for a command, so give the build its own timeoutMs. A timeout comes back as timedOut: true with the output so far, not as an exception (run commands).

Build a CMake project and run its tests

Upload the source tree, install CMake, configure, build and run ctest. Output streams back while the build runs.

TypeScriptimport { Sandbox } from "withruntime";await using sbx = await Sandbox.create({ timeoutSeconds: 1800, onLeaseEnd: "stop" });await sbx.exec("sudo apt-get update -q && sudo apt-get install -y -q cmake", {  check: true,  timeoutMs: 300_000,});await sbx.network.set({ internet: false }); // nothing the tests run can call outawait sbx.files.upload("./engine", "/workspace/engine");const stream = {  cwd: "/workspace/engine",  timeoutMs: 900_000,  onStdout: (t: string) => process.stdout.write(t),};await sbx.exec(["cmake", "-S", ".", "-B", "build", "-DCMAKE_BUILD_TYPE=Release"], {  ...stream,  check: true,});await sbx.exec(["cmake", "--build", "build", "-j", "2"], { ...stream, check: true });const tests = await sbx.exec(["ctest", "--test-dir", "build", "--output-on-failure"], stream);process.exitCode = tests.exitCode ?? 1;

Pythonimport sysfrom withruntime import Sandboxwith Sandbox.create(timeout_seconds=1800, on_lease_end="stop") as sbx:    sbx.exec("sudo apt-get update -q && sudo apt-get install -y -q cmake", check=True, timeout_ms=300_000)    sbx.network.set(internet=False)    sbx.files.upload("./engine", "/workspace/engine")    opts = {"cwd": "/workspace/engine", "timeout_ms": 900_000, "on_stdout": sys.stdout.write}    sbx.exec(["cmake", "-S", ".", "-B", "build", "-DCMAKE_BUILD_TYPE=Release"], check=True, **opts)    sbx.exec(["cmake", "--build", "build", "-j", "2"], check=True, **opts)    tests = sbx.exec(["ctest", "--test-dir", "build", "--output-on-failure"], **opts)    sys.exit(tests.exit_code or 0)

The network rule applies at once, to connections already open too. Root inside the sandbox cannot turn it back on (security).

Give a big build more cores

-j should match the cores you ask for. A sandbox bursts up to vcpu cores and bills only what the build uses, so a larger vcpu shortens a parallel build without charging for cores while they sit idle.

TypeScriptimport { Sandbox } from "withruntime";await using sbx = await Sandbox.create({ vcpu: 4, memoryMiB: 8192, diskMiB: 8192 });const cores = await sbx.exec(["nproc"]);console.log(cores.stdout);

The free trial allows up to 2 vCPU and 4 GiB per sandbox (free trial); a paid account can ask for more.

Keep the toolchain in an image

A recipe installs CMake, clang and the debuggers once, and every sandbox from the image starts with them. Building is free; the stored image is charged on its size (custom images).

Pythonfrom withruntime import Runtimeruntime = Runtime()runtime.images.build(name="cpp", recipe={"apt": ["cmake", "clang", "gdb", "valgrind"]})with runtime.sandboxes.create(image="cpp", network={"internet": False}) as sbx:    print(sbx.exec(["cmake", "--version"]).stdout)

For libraries from vcpkg or Conan, run their install in the recipe's commands while the build machine has the web.

New accounts get 50 free sandbox hours, no card:

Terminalnpx withruntime sandbox run --trial -- g++ --version

See also how to run C code in a sandbox, grading student code and agent evals and SWE-bench.

Sources

Checked 25 September 2026.

• Ubuntu 24.04 (noble) packages: gcc-13, g++, clang-18, cmake, gdb, valgrind
• C++ standards support in GCC

Facts on this page were checked on 25 September 2026.