Python SDK

Python SDK reference

The orkestr Python package is the official client for the sandbox API. Sync only in v1 (an async AsyncSandbox is planned). Requires Python 3.10 or newer.

Get started
Sandboxes are free to start. Install with pip install orkestr, then enable them in one click from the Sandboxes console and mint a scoped token.

Install

terminal
pip install orkestr

Authentication

Every request is authenticated with a Bearer API token. The SDK looks for it in three places, in order:

  • The api_key= kwarg on Sandbox.create() / Sandbox.get() / etc.
  • The client= kwarg (a pre-built OrkestrClient)
  • The ORKESTR_API_KEY environment variable
auth.py
import os
from orkestr import Sandbox

# 1) Implicit: SDK reads ORKESTR_API_KEY from env
sbx = Sandbox.create(template="python-3.12")

# 2) Explicit: per-call api_key
sbx = Sandbox.create(template="python-3.12", api_key="ork_...")

# 3) Reusable client (good for long-running agents)
from orkestr import OrkestrClient
client = OrkestrClient(api_key="ork_...", base_url="https://api.orkestr.eu")
sbx = Sandbox.create(template="python-3.12", client=client)
Scoped tokens
Mint tokens scoped only to sandboxes:read and sandboxes:write for agent runtimes. A scoped token cannot reach the rest of the orkestr platform if it leaks.

Sandbox class

Sandbox is the main public class. Static constructors create / fetch / list / resume sandboxes; instance methods drive exec, files, and lifecycle.

Sandbox.create

python
from orkestr import Sandbox

sbx = Sandbox.create(
    template="python-3.12",
    size="small",
    network="off",
    timeout_seconds=600,
    env={"OPENAI_API_KEY": "sk-..."},
    metadata={"agent_run": "r_42"},
    region="fsn1",
)
print(sbx.id, sbx.status)
ParameterTypeDescription
templaterequiredTemplateA built-in - python-3.12, python-3.12-bare, node-22, debian-12 - or a custom template id (tmpl_...) with your dependencies preinstalled.
sizeSandboxSizeFixed size: small (1 vCPU / 1 GB), medium (2 vCPU / 4 GB) or large (4 vCPU / 8 GB). Default small. Tier-capped (free: small; payg and enterprise: small, medium, large).
networkNetworkModeoff (default, no egress), restricted (curated allowlist), open (full egress, requires verified payment).
timeout_secondsintSandbox auto-terminates after this many seconds. Default 600. Ceiling depends on your sandbox tier (30 min free, up to 24 h with a card on file); see get_sandbox_limits.
envdict[str, str]Environment variables exposed to processes in the sandbox. In-memory only, never persisted past terminate.
metadatadict[str, str]Caller-defined tags echoed back on every response. Max 16 keys, 256 chars per value.
regionstr | NoneRegion preference, e.g. fsn1. The current list is regions from Sandbox.limits(). Omit to let the control plane pick.
allow_domainslist[str] | NoneFor network="restricted" only (paid plans): a custom egress allowlist that replaces the default set for this sandbox - still HTTPS-only and proxy-mediated. Pass bare hostnames (subdomains matched automatically) and keep any package registries you still need. Sandbox.limits() returns the default set to start from. Ignored for off/open.
volumestr | NoneAttach a persistent volume by name (or vol_ id), mounted at /persist. Data written there survives terminate and returns when a later sandbox attaches the same volume - unlike /workspace (RAM, lost on terminate). Created on first use (default 10 GB). See Persistent volumes.
Custom templates
Pass a template id (tmpl_...) to boot from an image with your dependencies baked in - same call, no install at boot. The SDK consumes templates; you build them from the console, REST API, or MCP. See the Custom templates guide.

Sandbox.get and Sandbox.list

python
# Reattach from another process
sbx = Sandbox.get("sbx_01HXYZ...")

# List your sandboxes
for sbx in Sandbox.list(status="running"):
    print(sbx.id, sbx.template, sbx.created_at)

Sandbox.get reattaches to an existing sandbox by id - useful across worker processes. Sandbox.list returns the caller's sandboxes; filter by status server-side, bounded by limit (default 50, max 200).

Sandbox.limits

python
limits = Sandbox.limits()
limits.plan                        # "free"
limits.allowed_sizes               # ["small"]
"medium" in limits.allowed_sizes   # False
limits.max_concurrent_memory_mb    # 1536 (concurrent RAM budget, MB)
limits.max_concurrent              # 3    (budget as a count of small boxes)
limits.usage_gb_hours_used         # 2.5  (memory used of the trial)
limits.usage_gb_hours_included     # 10.0 (one-time trial allowance)
limits.usage_cpu_hours_used        # 0.42 (CPU used of the trial)
limits.usage_cpu_hours_included    # 2.0  (one-time trial allowance)
limits.usage_resets_at             # None - the trial does not reset
for s in limits.sizes:             # full menu, each with .allowed
    print(s.size, s.cpu, s.memory_mb, s.allowed)

Sandbox.limits reports the sizes and caps available to your API key's plan - pick a size up front instead of learning the limit from a rejected create. Useful when the same code runs under keys on different plans.

sbx.exec

Run a shell command and return the buffered result. Raises ExecTimeout if the command exceeds timeout_seconds; the sandbox itself stays alive so you can run another command.

python
result = sbx.exec("python /workspace/main.py", timeout_seconds=60)
result.stdout       # str
result.stderr       # str
result.exit_code    # int
result.duration_ms  # int
ParameterTypeDescription
commandrequiredstrShell command to run inside the sandbox.
cwdstrWorking directory. Default /workspace.
envdict[str, str]Per-call env overrides on top of the sandbox env.
timeout_secondsintPer-command timeout, default 60. Capped at 3600. Process gets SIGTERM, then SIGKILL after 2s.

sbx.exec_stream

Stream output as it arrives. Returns an iterator of ExecChunk objects; iteration ends with a final chunk where is_final is true. Iterate to completion - breaking early leaves the in-VM process running until its own timeout fires.

python
for chunk in sbx.exec_stream("python long_task.py"):
    if chunk.stream == "stdout":
        print(chunk.data, end="", flush=True)
    elif chunk.stream == "stderr":
        print(chunk.data, end="", flush=True, file=sys.stderr)
    if chunk.is_final:
        print(f"exit={chunk.exit_code} duration={chunk.duration_ms}ms")

Files namespace

sbx.files is the file operations namespace. Writes go to writable roots (/workspace and /tmp); reads and directory listings work anywhere readable inside the sandbox.

python
# Text I/O
sbx.files.write("/workspace/script.py", "print('hello')")
content = sbx.files.read("/workspace/output.txt")

# Binary I/O
sbx.files.write_bytes("/workspace/blob.bin", b"\x00\x01\x02")
raw = sbx.files.read_bytes("/workspace/blob.bin")

# Directory listing
for entry in sbx.files.list("/workspace"):
    print(entry.name, entry.is_dir, entry.size, entry.mode)

# Remove
sbx.files.delete("/workspace/output.txt")

Persistent volumes

/workspace is fast scratch, but it is RAM-backed and gone when the sandbox terminates. To keep data across sandboxes, attach a persistent volume - a named disk mounted at /persist. Anything written there survives terminate and comes back when a later sandbox attaches the same volume. Name a volume in Sandbox.create(volume=...) and it is created on first use (default 10 GB).

python
from orkestr import Sandbox, Volume

# Attach a volume by name - created on first use (default 10 GB).
# Anything under /persist survives terminate.
sbx = Sandbox.create(template="python-3.12", volume="my-cache")
sbx.run("echo trained-weights-v1 > /persist/model.txt")
sbx.terminate()

# A brand-new sandbox re-attaches the same volume and sees the data:
sbx = Sandbox.create(template="python-3.12", volume="my-cache")
print(sbx.run("cat /persist/model.txt").stdout)   # trained-weights-v1

# Manage volumes explicitly (custom size, a region pin, listing, cleanup):
vol = Volume.create("datasets", size_gb=50, region="rbx")
for v in Volume.list():
    print(v.name, v.size_mb, v.status, v.region)
Volume.move(vol.id, "hel1")   # re-home a detached volume to another region
Volume.delete(vol.id)   # rejected while attached to a running sandbox

A volume backs one running sandbox at a time (attaching a busy one raises volume_in_use), and attaching one pins the sandbox to the volume's host - pass the same (or no) region.

sbx.metrics

Live CPU and memory for the sandbox - the latest reading, a rolling ~60s sample window for sparklines, and the sandbox's lifetime totals. Use it to watch a workload for saturation or memory pressure without instrumenting the workload itself. cpu.usage_percent is the share of allocated cores; memory.usage_bytes is the working set (reclaimable cache excluded).

python
m = sbx.metrics()
m.sandbox_status        # "running" (usage is null when paused / terminated)
m.cpu.cores             # 1.0
m.cpu.usage_percent     # 94.0  (% of allocated cores; 1-core pegged = 100)
m.cpu.usage_cores       # 0.94  (cores in use)
m.memory.usage_bytes    # 188743680  (working set, excludes reclaimable cache)
m.memory.usage_percent  # 35.2  (% of m.memory.limit_bytes)
m.lifetime.cpu_seconds  # 12.84 (on-CPU seconds since the sandbox started)
for s in m.samples:     # rolling ~60s window, oldest first
    print(s.t, s.cpu_percent, s.mem_bytes)

It is telemetry, not a state change: a paused or terminated sandbox returns a result with null live usage (check sandbox_status), not an error. Pass since=datetime to fetch only samples newer than your last poll, and poll no faster than sample_interval_seconds.

sbx.get_host

Return a public hostname for an HTTP port a process in the sandbox is serving. Build the URL as f"https://{sbx.get_host(3000)}" and open it in a browser or embed it in your app for a live preview of a dev server running inside the sandbox. The URL is public - its only capability is the unguessable sandbox id in the hostname - stable for the sandbox's lifetime, but serves traffic only while the sandbox is running. WebSockets ride through, so dev-server HMR works.

python
sbx = Sandbox.create(template="node-22", network="open")

# Start a server on a port inside the sandbox (in the background):
sbx.exec("nohup python3 -m http.server 3000 >/tmp/srv.log 2>&1 &")

host = sbx.get_host(3000)     # "3000-01hxyz....sbx.orkestr.run"
url = f"https://{host}"       # open in a browser or embed it in your app

Requires a card on file and a networked sandbox (network="restricted" or "open"); it raises on an off sandbox or the free tier. See Networking & egress for the URL format and the public-link caveat.

sbx.pause and Sandbox.resume

pause() snapshots the sandbox and stops the compute meter. Returns the sandbox id (same as sbx.id) - persist it wherever your agent keeps state and pass to Sandbox.resume() when you want to come back.

python
# Pause: returns the sandbox id, stops compute meter
sandbox_id = sbx.pause()

# ... later ...
sbx = Sandbox.resume(sandbox_id)

sbx.terminate (and context manager)

terminate() stops the sandbox and frees the resources. Idempotent. The recommended pattern is the context manager, which always terminates on exit:

python
with Sandbox.create(template="python-3.12") as sbx:
    result = sbx.exec("python -c 'print(2+2)'")
    print(result.stdout)
# sbx.terminate() is called automatically on exit (including on exceptions)

Result types

All result types are frozen dataclasses. No magic accessors - attributes are exactly what's documented here and what the API sends. ExecResult has stdout, stderr, exit_code, duration_ms. ExecChunk has stream, data, exit_code (only on final), duration_ms (only on final), plus is_final for convenience. FileEntry has name, is_dir, size, mode, modified_at.

Errors

Every exception the SDK raises inherits from OrkestrError. Catch the base for anything the SDK throws; catch a specific subclass to handle one failure mode.

python
from orkestr import (
    OrkestrError,
    AuthError,
    SandboxNotFound,
    ExecTimeout,
    SnapshotCapReached,
)

try:
    sbx = Sandbox.create(template="python-3.12")
    result = sbx.exec("sleep 9999", timeout_seconds=5)
except ExecTimeout:
    print("Command exceeded timeout - the sandbox is still running.")
except AuthError as e:
    print(f"Auth failed ({e.status_code}): {e.detail}")
except OrkestrError as e:
    print(f"Something else broke: {e}, request_id={e.request_id}")
ParameterTypeDescription
AuthErrorOrkestrErrorAPI key missing, invalid, expired, or scope insufficient. 401 / 403.
RateLimitErrorOrkestrErrorPlan rate limit hit. retry_after attribute carries the recommended wait.
PlanLimitErrorOrkestrErrorSandbox tier limit hit (concurrent sandboxes, trial credit exhausted).
SnapshotCapReachedPlanLimitErrorpause() blocked because the snapshot retention cap is full.
SandboxNotFoundOrkestrErrorSandbox id doesn't exist or doesn't belong to the caller. 404.
SandboxNotReadyOrkestrErrorOperation called on a sandbox in the wrong state (e.g. exec on paused). 409.
ExecTimeoutOrkestrErrorexec exceeded timeout_seconds. Sandbox stays alive.
ExecKilledOrkestrErrorExec process exited via a signal. signal attribute carries the signal number.
NetworkPolicyErrorOrkestrErrorIn-sandbox code tried to reach a host blocked by the network policy.

Advanced: OrkestrClient

The default client is built lazily from the env var on first use. For long-running agents you may want to construct one explicitly and pass it to every Sandbox.* call - this lets you change the base URL (e.g. for testing against a staging deployment), configure timeouts, or swap the underlying HTTP client. See REST API reference for raw wire format if you want to bypass the SDK entirely.