A sandbox instance is an isolated runtime environment created from a template. This topic describes how to create sandbox instances from the console or SDK, and how to use terminal access, VNC desktop, file management, service invocation, pause and resume, save as template, and expiration reclamation on the sandbox details page.
Overview
A sandbox instance is the lowest layer in the PAI-Sandbox three-tier resource hierarchy (space > template > instance). Each instance:
Runs in isolation: has its own guest OS kernel, file system, and access credentials.
Has an independent lifecycle: can be created, paused, resumed, and deleted independently.
Has unique properties: includes a sandbox ID, Access Token, file system, access URL, and service ports.
For the full three-tier resource model, see PAI-Sandbox overview — Resource hierarchy.
Usage notes
For persistent connections longer than 24 hours, connection stability isn't guaranteed.
Create a sandbox instance
Create from the console
PAI-Sandbox provides three console entry points for creating instances:
Entry point 1: On the sandbox workspace, click the Create Sandbox button.
Entry point 2: In the Private Templates/Public Templates list, select the Create Sandbox action for the target template.
Entry point 3: On the template details page, click Create Sandbox in the Sandbox List.
In the Create Sandbox dialog box, configure the following parameters:
|
Parameter |
Required |
Description |
|
Template |
Yes |
The template to base the sandbox on. |
|
Expiration time |
Yes |
The maximum time-to-live for the sandbox, such as 1 hour. Turn on the Never Expires toggle to disable expiration (not recommended for production). |
|
Environment variables |
No |
Environment variables visible inside the sandbox instance, in key-value format. |
|
Custom tags |
No |
Key-value tags for the sandbox, useful for searching and categorizing. |
Click Create Sandbox to create the instance.
Create with the SDK
PAI-Sandbox is natively compatible with the E2B SDK. The usage is identical to E2B:
import os
from e2b import Sandbox
# Set authentication credentials
os.environ["E2B_API_KEY"] = "<YOUR-TOKEN>"
os.environ["E2B_DOMAIN"] = "sandbox01.cn-shanghai.pai-eas.aliyuncs.com"
# Create a sandbox instance
sandbox = Sandbox.create(
template="<YOUR-TEMPLATE-ID>",
timeout=300000,
)
print(f"Sandbox ID: {sandbox.sandbox_id}")
On the Template Details page, click SDK Access in the upper-right corner to view the SDK connection configuration and Python sample code. For more API details, see E2B SDK integration.
Use a sandbox instance
View sandbox details
Go to the sandbox workspace, find the target sandbox in the Sandbox List, and click Details in the Actions column to open the sandbox details page.
The sandbox details page displays:
Resource specifications: CPU, memory, and disk.
Status information: status (Running/Paused) and uptime.
Basic information: sandbox ID, template, creation time, expiration time, RAM user ID, Alibaba Cloud account ID, and Access Token.
Metadata: key-value pairs such as
sandbox.alicloud.com/service-nameanduserId.
Open a terminal
Click Open Terminal to open a Web Terminal window. The terminal displays the sandbox ID, template ID, and session timeout (10-minute idle timeout / 30-minute maximum by default).
Run any shell command directly in the terminal. This is equivalent to calling sandbox.commands.run() through the SDK, and is useful for debugging and environment verification.
Open VNC
For Desktop-type templates, click Open VNC to start a remote desktop session.
The noVNC service must listen on port 6080. The frontend redirects to this port for remote desktop access.
VNC is useful for:
Debugging applications that require a graphical interface.
Visual verification of browser automation (such as Playwright and Selenium).
GUI testing and screenshot capture.
Manage files
The sandbox details page provides a File Management panel with a visual directory tree:
Browse the directory structure inside the sandbox, such as
bin,boot,code,dev,etc, andhome.Create folders, upload files, refresh the view, navigate up one level, and return to the root directory.
View file sizes and modification times.
File management is equivalent to calling sandbox.files.read() / sandbox.files.write() through the SDK, and provides quick access to runtime results without leaving the console.
Invoke services
The Service Invocation panel provides a visual HTTP interaction interface to call services running inside the sandbox.
Configuration options:
Request method: GET, POST, PUT, DELETE, and more.
Port: the listening port of the service inside the sandbox.
Path: the URL path for the request, such as
/health.Request headers: custom HTTP headers, such as
Content-Type: application/json.Preview URL: the full request URL assembled by the system, which you can copy and use directly.
Click Send Request. The HTTP Interaction History panel on the right displays the request and response content for real-time debugging.
External access to sandbox services: Services running inside the sandbox automatically get a publicly accessible URL in the format https://<port>-<sandbox-id>.<domain>/<path>. Call this URL directly from any HTTP client without additional port mapping.
View request logs
Switch to the Request Logs tab to view all HTTP requests forwarded to the sandbox through the data plane. Use these logs for auditing and troubleshooting.
Pause and resume
PAI-Sandbox supports pausing and resuming sandbox instances. Use this to preserve the sandbox state for later recovery or to save the instance as a template.
Pause: Click Pause in the sandbox list or call
sandbox.pause(). The sandbox state is persisted to the sandbox space storage.Resume: Click Resume in the sandbox list or call
Sandbox.connect("<sandbox-id>"). The sandbox quickly recovers to the running state.
A paused sandbox continues to be billed at the same rate as a running sandbox (including CPU, memory, and system disk). To reduce costs, delete sandbox instances that are no longer in use. For details, see Billing.
Save as a template
PAI-Sandbox can save the current state of a sandbox instance -- including files, installed dependencies, and running processes -- as a new template for environment reuse.
Typical scenarios:
After completing code changes and environment configuration during development, save the sandbox as a template to avoid rebuilding the image for every change.
Capture a fully configured agent runtime environment as a standard template for team reuse.
Prerequisites: The sandbox space must have a configured Enterprise Edition Image Instance (Standard or Enterprise Edition).
Procedure:
Pause the sandbox instance that you want to save as a template.
Click Save as Template.
Enter a name and description for the new template.
Click OK. The system creates a new template based on the current instance state.
The new template appears in the Private Templates list of the sandbox space.
Sandbox expiration and reclamation
Sandboxes are reclaimed through the following mechanisms:
Automatic destruction when the expiration time specified at creation is reached.
Manual deletion through the console or SDK.
Extend sandbox timeout
PAI-Sandbox provides two methods to extend the timeout:
|
Method |
Behavior |
|
|
Extends the timeout when reconnecting. If the sandbox is paused, it resumes automatically with the new timeout. If running, the timeout extends only when the requested |
|
|
Explicitly sets a new timeout. Resets the expiration to the current time plus the specified timeout value. |
What's next
Manage sandbox instances through the SDK: E2B SDK integration
View sandbox monitoring metrics and performance data: Monitoring and performance metrics