Runtime

How to run Go code in a sandbox

Install Go in an isolated Linux microVM with apt or the official tarball, write main.go, and run it with go run under a timeout.

On Runtime, Go is one apt command away in every sandbox, or already there in an image you build once. Each sandbox is a Firecracker microVM with its own kernel, with sudo and gcc ready. The code interpreter runs Go cells too: on 23 September 2026 its first Go cell in a sandbox installed Go from Ubuntu's archive in about 35 seconds, once (code interpreter). A 2 vCPU, 4 GiB sandbox costs $0.08 an hour while it compiles and $0.03125 while it waits (pricing).

Which Go to install

Source Command Go version on 25 September 2026
Ubuntu 24.04 archive sudo apt-get install -y golang-go 1.22.2 (golang-1.22-go)
Official tarball from go.dev tar -C /usr/local -xzf go1.27.1.linux-amd64.tar.gz 1.27.1

The code interpreter installs Go from Ubuntu's archive as well. Take the tarball when your module's go line asks for a newer release.

Install Go and run a program

TypeScriptimport { Sandbox } from "withruntime";const program = `package mainimport (	"fmt"	"sort")func main() {	xs := []int{42, 7, 19, 3}	sort.Ints(xs)	fmt.Println(xs)}`;await using sbx = await Sandbox.create({ timeoutSeconds: 600, onLeaseEnd: "stop" });await sbx.exec("sudo apt-get update -q && sudo apt-get install -y -q golang-go", {  check: true,  timeoutMs: 300_000,});await sbx.network.set({ internet: false }); // the program itself gets no networkawait sbx.files.write("/workspace/job/main.go", program);const run = await sbx.exec(["go", "run", "main.go"], { cwd: "/workspace/job", timeoutMs: 120_000 });console.log(run.exitCode, run.stdout); // 0 [3 7 19 42]
Pythonfrom withruntime import Sandboxprogram = """package mainimport (\t"fmt"\t"sort")func main() {\txs := []int{42, 7, 19, 3}\tsort.Ints(xs)\tfmt.Println(xs)}"""with Sandbox.create(timeout_seconds=600, on_lease_end="stop") as sbx:    sbx.exec("sudo apt-get update -q && sudo apt-get install -y -q golang-go",             check=True, timeout_ms=300_000)    sbx.network.set(internet=False)  # the program itself gets no network    sbx.files.write("/workspace/job/main.go", program)    run = sbx.exec(["go", "run", "main.go"], cwd="/workspace/job", timeout_ms=120_000)    print(run.exit_code, run.stdout)  # 0 [3 7 19 42]
  • files.write makes the parent directories.
  • go run compiles before it runs, so give it more time than a script. A command that runs out of time comes back with timedOut: true and its output so far, rather than throwing.
  • The apt install needs the internet; the program does not, so the network goes off in between.

The newest Go from go.dev

The official Linux steps extract the tarball into /usr/local and add /usr/local/go/bin to PATH (Go install). Link the binaries into /usr/local/bin, which is already on the sandbox user's PATH:

Terminalcurl -fsSL https://go.dev/dl/go1.27.1.linux-amd64.tar.gz | sudo tar -C /usr/local -xzsudo ln -sf /usr/local/go/bin/go /usr/local/go/bin/gofmt /usr/local/bin/go version

Modules with dependencies

Upload the module, download its dependencies with the internet on, then cut it off and run the tests. Nothing the tests do can reach the network.

TypeScriptimport { Sandbox } from "withruntime";await using sbx = await Sandbox.create({ image: "go", timeoutSeconds: 1800, onLeaseEnd: "stop" });await sbx.files.upload("./service", "/workspace/service");await sbx.exec("go mod download", { cwd: "/workspace/service", check: true, timeoutMs: 300_000 });await sbx.network.set({ internet: false });const test = await sbx.exec(["go", "test", "./..."], {  cwd: "/workspace/service",  timeoutMs: 900_000,  onStdout: (text) => process.stdout.write(text),});console.log("exit", test.exitCode);

This uses the go image built below.

A Go notebook: the code interpreter

Runtime's code interpreter keeps a Go context's functions, types and imports between cells and runs each cell as a program, so values do not carry over but declarations do:

TypeScriptimport { Sandbox } from "withruntime";await using sbx = await Sandbox.create();await sbx.interpreter.run(  "func fib(n int) int {\n\tif n < 2 {\n\t\treturn n\n\t}\n\treturn fib(n-1) + fib(n-2)\n}",  {    language: "go",  },);const cell = await sbx.interpreter.run('import "fmt"\nfmt.Println(fib(20))', { language: "go" });console.log(cell.stdout); // 6765
Pythonfrom withruntime import Sandboxwith Sandbox.create() as sbx:    sbx.interpreter.run("func fib(n int) int {\n\tif n < 2 {\n\t\treturn n\n\t}\n\treturn fib(n-1) + fib(n-2)\n}",                        language="go")    cell = sbx.interpreter.run('import "fmt"\nfmt.Println(fib(20))', language="go")    print(cell["stdout"])  # 6765

The first Go cell installs Go from Ubuntu's archive, so that sandbox needs the internet for it. An image with Go skips both the wait and the network.

Go in every sandbox

TypeScriptimport { Runtime } from "withruntime";const runtime = new Runtime();await runtime.images.build({ name: "go", recipe: { apt: ["golang-go"] } });// Or the newest release, from the official tarball:await runtime.images.build({  name: "go-latest",  recipe: {    commands: [      "curl -fsSL https://go.dev/dl/go1.27.1.linux-amd64.tar.gz | tar -C /usr/local -xz",      "ln -sf /usr/local/go/bin/go /usr/local/go/bin/gofmt /usr/local/bin/",    ],  },});
Pythonfrom withruntime import Runtimeruntime = Runtime()runtime.images.build(name="go", recipe={"apt": ["golang-go"]})runtime.images.build(name="go-latest", recipe={"commands": [    "curl -fsSL https://go.dev/dl/go1.27.1.linux-amd64.tar.gz | tar -C /usr/local -xz",    "ln -sf /usr/local/go/bin/go /usr/local/go/bin/gofmt /usr/local/bin/",]})

Recipe commands run as root. Building is free; a stored image is charged on its size (custom images).

New accounts get 50 free sandbox hours, no card:

Terminalnpx withruntime sandbox run --trial -- bash -c 'sudo apt-get update -q && sudo apt-get install -y -q golang-go && go version'

Sources

Facts on this page were checked on 25 September 2026.

Claim 50 hours free