Render sandbox images

Docker images and prepared workspaces for Render Sandboxes. Images include the tools; snapshot recipes add a repository, dataset or database that you can capture and restore in your own sandbox group.

There are 30 images and 60 recipes. All image packages are published to GHCR and are currently private. Pulling or importing them requires package access. Recipes live in this repository and create snapshots in your group.

Run an image

To build an image and run its bundled examples locally, install Python 3 and Docker with a running Linux engine, then run this from the repository root:

python3 scripts/check-image.py typescript-tools

This builds for linux/amd64 and runs the image and recipe checks with guest networking disabled. On an ARM machine, Docker uses amd64 emulation. To open a shell in the image you just built:

docker run --rm -it --platform linux/amd64 --network none \
  render-sandbox-typescript-tools:0.1.1 bash

Run a recipe on Render

The following example prepares a TypeScript repository, captures its filesystem, restores it in a second sandbox and checks the results. Use Node 24 or newer and an existing Render workspace and sandbox group.

Set RENDER_API_KEY, GHCR_USERNAME and GHCR_TOKEN in your host environment. The GHCR token needs read:packages and access to the image. The runner passes registry credentials to Render's import API and keeps them out of the sandbox and snapshot.

From the repository root, install the runner and read the published image digest:

npm ci --prefix tools
IMAGE_REF=$(node -e '
  const { image } = require("./images/coding-workspace/manifest.json");
  if (!image.digest) throw new Error("This image has no recorded digest");
  console.log(image.repository + "@" + image.digest);
')

npm run --prefix tools validate-recipe -- \
  --recipe repo-ready-typescript \
  --workspace tea-YOUR_WORKSPACE \
  --group sbg-YOUR_GROUP \
  --plan 1c-2g \
  --image "$IMAGE_REF"

Replace the workspace and group placeholders with your IDs. The runner removes both temporary sandboxes and the snapshot after checking them; the imported image stays in the group. Add --keep-snapshot to retain a passing snapshot for 24 hours. Outputs and resource IDs go into a new local evidence/ directory. If a run stops early, inspect its run.json before retrying.

Choose another recipe from the catalog and use its parent image's digest. Each recipe README lists its inputs, outputs and commands. The analytics workbench uses its own runner.

Catalog and live Render results

November 4, 2026: 30/30 image workloads passed; 60/60 snapshot capture-and-restore tests passed.

Image tests run the bundled examples on Render. Recipe tests also capture and restore a workspace, then check the outputs. Tests use synthetic inputs without model API calls. The test report records versions, digests, results and cleanup.

TypeScript and AI applications

Image	Use for	Image workload on Render	Snapshot recipes (capture and restore)
TypeScript tools	Run TypeScript scripts and tool functions	Passed	Typed event reducer (Passed) TypeScript tool workbench (Passed)
Coding workspace	Explore and edit TypeScript repositories	Passed	TypeScript agent regression tasks (Passed) Codebase research corpus (Passed) Repository-ready TypeScript (Passed)
TypeScript API and Postgres	Exercise Node APIs and Postgres transactions	Passed	Prepared TypeScript API and Postgres (Passed) Postgres outbox (Passed)
TypeScript agents	Test structured outputs and tool loops	Passed	Agent structured output (Passed) Agent tool loop (Passed)
TypeScript agent workflows	Resume checkpoints and approval gates	Passed	Agent checkpoint workflow (Passed) Human approval workflow (Passed)
TypeScript AI gateway	Test provider routing, retries and request budgets	Passed	AI retry budget lab (Passed) AI routing workbench (Passed)
TypeScript AI interfaces	Inspect chat streams and tool cards	Passed	Chat stream workbench (Passed) Tool card workbench (Passed)
TypeScript OpenAPI tools	Validate API contracts and tool clients	Passed	OpenAPI tool client (Passed) OpenAPI tool contracts (Passed)
TypeScript RAG pipelines	Chunk documents and assemble cited context	Passed	RAG chunking workbench (Passed) RAG context assembly (Passed)
TypeScript AI evaluations	Score tool traces and retrieval results	Passed	Retrieval evaluation (Passed) Tool trace evaluation (Passed)
TypeScript data analysis	Clean CSV data and query Parquet	Passed	CSV reconciliation (Passed) Parquet analytics (Passed)
TypeScript SQLite	Run database migrations and job queues	Passed	SQLite job queue (Passed) SQLite migration workbench (Passed)
TypeScript local retrieval	Build keyword search with source citations	Passed	Local retrieval corpus (Passed) Search ranking workbench (Passed)
TypeScript image processing	Resize and composite images	Passed	Image compositing (Passed) Image derivatives (Passed)
TypeScript Office artifacts	Create spreadsheets, documents and slides	Passed	Presentation workspace (Passed) Reporting workspace (Passed)
TypeScript media processing	Transcode video and process audio	Passed	Audio processing (Passed) Media project (Passed)

Python and data science

Image	Use for	Image workload on Render	Snapshot recipes (capture and restore)
Python coding workspace	Fix and test Python code	Passed	Python agent regression workspace (Passed) Repository-ready Python (Passed)
Python API and Postgres	Exercise FastAPI and Postgres transactions	Passed	FastAPI and Postgres workspace (Passed)
Python analysis	Clean and join data; produce tables and charts	Passed	Analytics workbench (Passed) Data quality audit (Passed)
Scientific Python	Run statistical tests and forecasts	Passed	Demand forecast (Passed) Statistical experiment (Passed)
Python optimization	Solve scheduling and allocation problems	Passed	Constraint scheduling (Passed) Resource allocation (Passed)
Geospatial	Transform GeoJSON and join spatial data	Passed	GeoJSON transform (Passed) Spatial join (Passed)

Coding agents

These images include the named CLI and prepared TypeScript and Python repositories. Checks cover CLI startup, reference repairs and independent graders. Model-backed coding runs: Not tested. After restore, authenticate with the CLI and enable access to its provider. From /workspace/<recipe-slug>, run node run-agent.mjs, then bash grade-project.sh. The CLI profiles list versions and authentication options.

Image	Image workload on Render	Snapshot recipes (capture and restore)
Codex	Passed	TypeScript repository (Passed) Python repository (Passed)
Claude Code	Passed	TypeScript repository (Passed) Python repository (Passed)
OpenCode	Passed	TypeScript repository (Passed) Python repository (Passed)
Cursor CLI	Passed	TypeScript repository (Passed) Python repository (Passed)
Devin CLI	Passed	TypeScript repository (Passed) Python repository (Passed)

Documents, databases and integration tests

Image	Use for	Image workload on Render	Snapshot recipes (capture and restore)
Document extraction	Extract document data and reconcile invoices	Passed	Document processing lab (Passed) Invoice reconciliation (Passed)
Postgres lab	Test SQL, migrations and vector queries	Passed	Database migration lab (Passed) SQL and vector playground (Passed)
Python and TypeScript integration tests	Test MCP, HTTP APIs and webhook signatures	Passed	MCP and API test world (Passed) Webhook signature replay (Passed)

Build, publication and registry update instructions are in Contributing.

Repository code is MIT licensed. Bundled CLIs, runtimes and libraries retain their own terms and licenses.