Codapi
Lightweight Apache-2.0 sandbox server (a 3 MB Go binary) that runs each snippet in a locked-down Docker container, built for interactive documentation, with a hosted cloud at $5/month and free self-hosting. The simplest well-hardened run-code server to self-host; fine for doc snippets and stateless tool calls, not for agent workspaces.
Overview
Codapi is an open-source sandbox server by Anton Zhiyanov for interactive code examples in documentation, courses and blog posts. The server is a 3 MB Go binary that manages sandboxes, each one or more Docker images registered via box.json and commands.json; the companion 5 KB codapi-js widget turns static code blocks into runnable ones. The API is a single POST /v1/exec with sandbox, command and a files map, returning ok, duration, stdout and stderr. About 40 playgrounds ship out of the box, covering mainstream and emerging languages, databases such as PostgreSQL, DuckDB and ClickHouse, and tools like Git and LaTeX; custom sandboxes are any Dockerfile.
The shipped codapi.json is the most explicit default hardening in this category: 1 CPU, 64 MB RAM, network none, read-only filesystem, all capabilities dropped, 64 processes, 96 open files, non-root user, 5 s timeout and 4 KB of output per step. The FAQ says server-side runs take 1-3 seconds and that the sandbox server should not have access to sensitive data. Runs are stateless. The cloud service is free to try (1,000 runs per month) and $5/month for 5,000 runs; self-hosting is free and unlimited, with docs for Debian, Nginx, XFS quotas and running locally with Docker, Podman, OrbStack or Lima on a Mac. Latest release v0.14.2 (22 August 2026); about 2.1k GitHub stars.
Notable
- Latest release v0.14.2 on 22 August 2026; about 2.1k GitHub stars
- Default per-run limits in the shipped config: 1 CPU, 64 MB, no network, 5 s timeout, 4,096-byte output
- Cloud plan $5/month for 5,000 runs; the pricing page warns prices will probably change
Codapi specifications
| Attribute | Details |
|---|---|
| Isolation | Docker (or Podman/OrbStack) container per run with the shipped defaults: runc runtime, 1 CPU, 64 MB memory, network none, read-only root with the sandbox volume mounted read-only, all capabilities dropped, nofile 96, nproc 64, non-root "sandbox" user, 5 s timeout, 4,096-byte output cap |
| Deployment | Hosted platform · Self-hostable |
| Open source | Yes (Apache-2.0) |
| SDKs and interfaces | REST API, JavaScript/TypeScript |
| Cold start (vendor claim) | FAQ: server-side sandboxes take 1-3 seconds per run depending on hardware; in-browser playgrounds run almost instantly |
| Max session length | Per step: default timeout 5 s in the shipped codapi.json, configurable per sandbox |
| Persistence | None; each /v1/exec call runs the submitted files once in a fresh container and returns id, ok, duration, stdout and stderr |
| GPU | No GPU option is documented |
| Networking | Network "none" in the default box configuration; sandboxes such as curl, Fetch and HTTP are provided for network-related examples |
| Pricing | Cloud $5/month for 5,000 runs/month and 30+ sandboxes; self-hosted free and unlimited; Codapi+ commercial support $250/month. The pricing page notes pricing "may (and probably will) change" |
| Free tier | Cloud: free to try without sign-up, 1,000 code runs per month; free to self-host |
| Compliance | Not documented |
| Regions | Not documented |
Facts from Codapi’s public documentation, verified November 9, 2026. Performance numbers are vendor claims.
Strengths and trade-offs
Strengths
- You want a tiny, auditable self-hosted execution endpoint with hardened container defaults
- You need runnable examples embedded in documentation or a course
- You are running databases and CLI tools (PostgreSQL, DuckDB, Git) as sandboxes, not only languages
Trade-offs
- Stateless by design: no sessions, and the defaults allow 64 MB and 5 s per run
- Isolation is a hardened Docker container, not a VM or user-space kernel
- The hosted cloud is small (5,000 runs/month on the paid plan) and described as early-stage
- No Python or other backend SDK; only the HTTP API and the JavaScript widget
Good fit for: Embedding runnable snippets in docs and courses, or a tiny self-hosted run-code endpoint with strict defaults.
How Codapi compares
| Sandbox | Isolation | Open source | Self-host / BYOC | Cold start (vendor) | Max session | Snapshots / pause | GPU | SDKs |
|---|---|---|---|---|---|---|---|---|
| Codapi | Locked-down Docker container | Yes | Yes / No | 1-3 s per run (claim) | 5 s default | No / No | No | REST API, JavaScript/TypeScript |
| Piston | isolate in Docker | Yes | Yes / No | Not documented | 3 s run / 10 s compile | No / No | No | REST API |
| Judge0 | isolate (namespaces/cgroups) | Yes | Yes / No | Not documented | 5 s wall (max 20 s) | No / No | No | REST API, Python, JavaScript/TypeScript |
| glot.io | Single-use Docker container | Yes | Yes / No | Not documented | Operator-set per run | No / No | No | REST API |
| OneCompiler Code Execution API | Not documented | No | No / No | Not documented | 7-20 s (enterprise) | No / No | No | REST API |
| Docker Sandboxes | MicroVM | No | Yes / No | Not documented | Until removed (local) | Yes / Yes | Yes | sbx CLI, TypeScript (cloud), REST API (cloud) |
Frequently asked questions
What is Codapi?
How does Codapi isolate code?
Is Codapi open source?
How much does Codapi cost?
What are the alternatives to Codapi?
Sources
- codapi.org
- codapi.org/pricing/
- codapi.org/faq/
- codapi.org/docs/
- github.com/nalgeon/codapi
- raw.githubusercontent.com/nalgeon/codapi/main/codapi.json
- raw.githubusercontent.com/nalgeon/codapi/main/docs/api.md
- raw.githubusercontent.com/nalgeon/codapi/main/docs/add-sandbox.md
- raw.githubusercontent.com/nalgeon/codapi/main/docs/production.md
Cite this page
Agent Sandboxes. (2026). Codapi. agentsandboxes.org. Last reviewed November 9, 2026. https://agentsandboxes.org/sandboxes/codapi/
Found an error or a missing sandbox? Submit a correction — every entry links to the sources it relies on.