Railway Sandboxes
On-demand Linux VMs inside a Railway environment with forks, checkpoints, Docker, private networking to your services and per-second billing; generally available since September 2026. The natural sandbox for teams already deploying on Railway, strongest when agents need private-network access to existing services.
Overview
Railway Sandboxes are isolated Linux VMs that Railway, the application-hosting platform, creates on demand inside one of your project environments. The Ubuntu base image ships git, Node and the Claude Code, Codex, OpenCode and Pi agents, and every sandbox includes a Docker daemon. You drive them from the open-source railway TypeScript SDK, the Railway CLI, the dashboard or the GraphQL API, with a files API, durable sessions that keep 8 MiB of output for reattachment, SSH and port forwarding. The feature graduated from Priority Boarding to general availability on 17 September 2026 and is available on every plan.
The differentiator is environment scoping: a sandbox can join the environment's private network and talk to your Postgres or other services by hostname, or stay isolated with outbound-only internet. State is handled with forks (disk copies of running sandboxes), named checkpoints and cached templates, but there is no pause/resume and idle sandboxes are destroyed after a configurable timeout. Billing is per second at Railway's standard memory and active-CPU rates, drawn from the plan's included usage; plan caps run from 10 sandboxes at 2 vCPU on Free to 100 at up to 32 vCPU on Pro. The hypervisor is not named.
Notable
- Generally available since 17 September 2026 after a June 2026 Priority Boarding launch
- Four regions: US West, US East, EU West and Southeast Asia
- Every sandbox includes the Docker daemon and CLI
Railway Sandboxes specifications
| Attribute | Details |
|---|---|
| Isolation | Isolated Linux virtual machine per sandbox; hypervisor not named |
| Deployment | Hosted platform |
| Open source | No |
| SDKs and interfaces | JavaScript/TypeScript, CLI, GraphQL API |
| Cold start (vendor claim) | Product page: "ready in seconds"; no figure |
| Max session length | No maximum lifetime stated; idle timeout destroys the sandbox after 30 minutes by default on Hobby and Pro (1-120 minutes, or disabled) and after 5 minutes on Free and Trial (1-5 minutes, cannot be disabled) |
| Persistence | Sandboxes are ephemeral; checkpoints are named server-side disk snapshots that outlive the sandbox and boot where captured; forks copy a running sandbox's disk (not memory or processes); templates cache build steps; no pause/resume |
| GPU | Not mentioned in the sandbox docs |
| Networking | Outbound internet via NAT on all sandboxes; ISOLATED (default) has no access to environment services, PRIVATE joins the environment's private network to reach databases by hostname; up to 10 public HTTPS domains per sandbox set at creation; SSH and port forwarding with an account SSH key; no egress allow-list documented |
| Pricing | Per second at Railway VM rates: $0.00001929 per GB-second of memory in use (about $50/GB-month), $0.00001929 per vCPU-second of active CPU (about $50/vCPU-month), egress $0.05/GB; idle sandboxes still bill memory; usage draws from the plan's included credit. Example from the page: 20 minutes at 1 GB and 30% of a vCPU about $0.03 |
| Free tier | Available on Free and Trial plans within included usage: 10 sandboxes per environment at 2 vCPU/2 GB with a 5-minute idle timeout |
| Compliance | Not documented |
| Regions | US West (default), US East, EU West and Southeast Asia; forks stay in the source region |
Facts from Railway Sandboxes’s public documentation, verified November 9, 2026. Performance numbers are vendor claims.
Strengths and trade-offs
Strengths
- You run services on Railway and want agents to test against them over the private network
- You need forks and checkpoints to try approaches in parallel
- You want Docker inside the sandbox without configuration
- You want EU and Asian regions as well as US
Trade-offs
- No pause/resume; idle sandboxes are destroyed, and memory continues to bill while idle
- Hypervisor and compliance are not documented on the sandbox pages
- No egress allow-list; outbound internet is always on
- Free and Trial sandboxes are limited to 2 vCPU/2 GB and a 5-minute idle timeout
Good fit for: Coding agents and test runs that need to reach your Railway databases and services over the private network.
How Railway Sandboxes compares
| Sandbox | Isolation | Open source | Self-host / BYOC | Cold start (vendor) | Max session | Snapshots / pause | GPU | SDKs |
|---|---|---|---|---|---|---|---|---|
| Railway Sandboxes | Linux VM | No | No / No | Not documented | No cap (idle 30 min default) | Yes / No | Not documented | JavaScript/TypeScript, CLI, GraphQL API |
| Vercel Sandbox | Firecracker microVM | No | No / No | Milliseconds (claim) | 24 h (Pro) | Yes / Yes | Not documented | JavaScript/TypeScript, Python |
| Fly.io Sprites | MicroVM | No | No / No | 0.1–2 s wake | Unlimited | Yes / Yes | No | JavaScript/TypeScript, Go, Python, Elixir |
| Koyeb Sandboxes | MicroVM | No | No / Not documented | Not documented | Up to 24 h | Not documented / Not documented | Yes | Python, JavaScript/TypeScript |
| Northflank Sandboxes | Cloud Hypervisor microVM | No | No / Yes | <1 s | Unlimited | Not documented / Yes | Yes | JavaScript/TypeScript, Python |
| Modal Sandboxes | gVisor or VM | No | No / Not documented | <1 s | Up to 24 h | Yes / Yes | Yes | Python, JavaScript/TypeScript, Go |
| Depot Sandboxes | MicroVM on bare metal | No | No / Yes | Not documented | 2 h default timeout | Yes / No | Not documented | JavaScript/TypeScript, CLI |
Frequently asked questions
What is Railway Sandboxes?
How does Railway Sandboxes isolate code?
Is Railway Sandboxes open source?
How much does Railway Sandboxes cost?
What are the alternatives to Railway Sandboxes?
Sources
Cite this page
Agent Sandboxes. (2026). Railway Sandboxes. agentsandboxes.org. Last reviewed November 9, 2026. https://agentsandboxes.org/sandboxes/railway-sandboxes/
Found an error or a missing sandbox? Submit a correction — every entry links to the sources it relies on.