Changelog.What changed, every day.

1. 14 November 20269 changes

   • Catalog MCP servers in a sandbox are withdrawnGET /v1/mcp/catalog and /v1/sandboxes/{id}/mcp return 404 route_not_found, with a message that says what to use instead.SDKs and CLI
   • A paused sandbox wakes for its own timersA sandbox paused after its idle seconds wakes by itself shortly before the soonest timer of one of its processes is due: a sleep, a poll or wait with a timeout, a timerfd, alarm() or timer_create() that was pending the whole time it sat idle.Sandboxes
   • Environment variables on createPOST /v2/sandboxes and POST /v1/sandboxes take env: up to 32 variables and 32,768 bytes of names and values, set for every command and process in the sandbox and for its start command.Sandboxes
   • Resize a running sandboxPOST /v2/sandboxes/{id}:update takes vcpu, memoryGB and diskGB (and POST /v1/sandboxes/{id}:resize takes vcpu, memoryMiB and diskMiB).Sandboxes
   • Run a sandbox as root with one settingPOST /v2/sandboxes and POST /v2/sandboxes/{id}:update take user: runtime (the default: uid 1000, with passwordless sudo) or root.Sandboxes
   • Job secrets can be deleted, and their names reusedPOST /v1/secrets/{id}:delete deletes a job secret (with an optional expectedVersion), and GET /v1/secrets/{id} returns one.Sandboxes
   • A fork makes all its copies or nonePOST /v2/sandboxes/{id}:fork with count is admitted as one start: when the copies together would pass one of your limits (running vCPU or memory) or find no room, the request returns the error and makes no copy.Sandboxes
   • Network rules on createPOST /v2/sandboxes takes network (the same {default, rules} that PUT /v2/sandboxes/{id}/network takes), and POST /v1/sandboxes and the runtime_sandboxes_create MCP tool take network in their own shape (internet, allow, deny, connect).Sandboxes
   • A command runs to its endPOST /v2/sandboxes/{id}:exec (and /v1/sandboxes/{id}:exec, and the runtime_sandboxes_exec MCP tool) with no timeoutMs no longer stops the command after 60 seconds: it runs until it exits and returns its exit code and output. timeoutMs still sets a limit when you name one.Sandboxes

2. 9 November 20261 change

   • A sandbox says what you can do with it nowEvery sandbox read from /v1/sandboxes and /v2/sandboxes returns actions: the actions that change it from its current state (pause, wake, stop, restart and delete).Sandboxes

3. 8 November 20261 change

   • A 503 busy says whether the cell could not confirm the request or could not complete itBefore, every 503 busy from /v1/sandboxes read "The cell could not confirm this in time; it may or may not have been applied.", whatever the cause.Sandboxes

4. 7 November 20263 changes

   • Desktops: capture the screen with POST /v2/desktops/{id}:screenshot and drive it with POST /v2/desktops/{id}:actA screenshot returns the whole screen as base64, as png or jpeg (set quality, 1 to 100), with its width and height.Sandboxes
   • Apps, Functions and Containers: volumes are mountedA version whose spec.volumes names a volume now mounts it in each copy before its process starts.Apps
   • Sandboxes: mount a volume through v2POST /v2/sandboxes accepts spec.volumes, a list of at most one {volume, path} entry naming a volume of the same project by its ID (vol_...).Sandboxes

5. 5 November 202615 changes

   • Status incidents in the APIGET /v2/status/incidents returns the incident notes shown on withruntime.com/status, status.md and status.json, newest start first, as {"data": [...]}.Platform
   • Per-address limit on creating organizationsPOST /v2/orgs, which creates a signed-in person's own organization, is limited to 10 an hour per client IP address (an IPv6 address counts by its /64).Platform
   • Closing an account deletes its resourcesPOST /v1/account:close now succeeds for every account; for some accounts it previously returned 500 internal_error.Platform
   • Cloud Run: Google's client libraries' $alt parameter is acceptedThe Google Cloud Run Admin API at /compat/google-cloud-run now accepts the $alt query parameter (json, or json;enum-encoding=int), which Google's Node.js client (@google-cloud/run) sends with every REST request.Platform
   • Seven more launch checks through competitors' APIs on /status.jsonlaunch_checks on GET https://withruntime.com/status.json now also returns dev_environments_codespaces (Octokit, GitHub's SDK, against the Codespaces API), containers_fly (Fly's Machines API), containers_cloud_run (Google's Cloud Run client for Node.js), firewall_security_groups (the AWS SDK for JavaScript's EC2 client), uptime_checks_betterstack (Better Stack's monitors API), uptime_checks_checkly (Checkly's checks API) and sites_vercel (Vercel's SDK, promoting a release).SDKs and CLI
   • GET /v1/me returns the key's reachThe response now includes reach: agent when the key acts only on what its own agent made, compartment when it acts on what every key of its compartment made, or account when it acts on everything in the account.Platform
   • A build whose identical image is larger than its maxImageMiB fails with the size to setWhen your account already had an identical image larger than a new build's build.maxImageMiB (8192 by default), the build failed with "The image could not be saved because of a fault on our side".Sandboxes
   • Per-address limits on sign-in and API key creationRequests that sign in or create an account are limited per client IP address (an IPv6 address counts by its /64): 30 an hour for POST /v2/sign-in/email, and 30 an hour for POST /v2/sign-in/email/verify and Google or SSO sign-in returns together.Platform
   • Clearer error when a sandbox from an image cannot startWhen the server could not prepare a sandbox's image, POST /v1/sandboxes returned 503 busy with "The cell could not confirm this in time; it may or may not have been applied." It now returns 503 busy with "This sandbox could not be started on its server, so nothing was made." Retry the create with the same Idempotency-Key.Sandboxes
   • Render environment variable endpoints for Apps/compat/render/v1 now serves Render's environment variable endpoints over an App's spec.env: list (GET /services/{serviceId}/env-vars, paginated by cursor and limit), replace all (PUT /services/{serviceId}/env-vars), get, set and delete one (GET, PUT and DELETE /services/{serviceId}/env-vars/{envVarKey}).Apps
   • Sandboxes, Apps and Functions can call App and Function addressesA request from a sandbox, an App or a Function to an App's or a Function's address (https://<name>.runtimehost.com) used to return 403 with "Destination resolves to a forbidden address".Apps
   • Render list pagination reads only the requested pageOn /compat/render/v1, GET /services and GET /services/{serviceId}/deploys now start reading from the position the cursor names and stop as soon as the page is full.Platform
   • Paused sandboxes started from a custom image survive the loss of their hostA paused sandbox started from your own image is no longer stopped when its host is lost, as long as its saved copy is complete and another host holds the image.Sandboxes
   • A wake whose host does not answer fails within about a minuteA paused sandbox whose host did not answer its wake used to stay in resuming for as long as the host stayed silent, and every request on it waited.Sandboxes
   • App versions and Render deploysGET /v2/apps/{id}/versions lists an app's versions, newest first and paginated by limit and cursor.Apps

6. 4 November 202617 changes

   • Render API for AppsThe web service endpoints of Render's REST API are served under /compat/render/v1, so Render API clients and the render CLI manage Apps by changing only their host (RENDER_HOST) and API key (Authorization: Bearer <key>).Apps
   • Desktops: E2B Desktop APIDesktops now accept E2B's sandbox REST API with its desktop template at /compat/e2b-desktop: set E2B_API_URL to https://<your API host>/compat/e2b-desktop and E2B_API_KEY to a Runtime API key, and E2B Desktop's SDKs (@e2b/desktop, e2b_desktop) can get, list (paginated by nextToken), connect to, extend the timeout of, pause and kill Runtime desktops.Sandboxes
   • Launch checks on /status.jsonGET https://withruntime.com/status.json now returns launch_checks, one entry per product that launches with the next platform release (Browsers, Desktops, Notebooks, Dev environments, Actions runners, Cron, Apps, Functions, Containers, Load balancers, Firewall, Uptime checks, KV, Queues and Sites).Apps
   • Upstash QStash schedules API for CronQStash's schedules endpoints are served under /compat/qstash, so the @upstash/qstash client manages Cron jobs by changing only its base URL and token.Platform
   • Balancer targets receive requests only after their first health check passesWhen a balancer has spec.health, each target starts out of rotation: a new target, or every target on a host whose router has just restarted, receives no requests until its first health check passes, which happens within about 100 ms.Platform
   • Start action for Dev environmentsPOST /v2/dev-environments/{id}:start starts an environment immediately: a paused environment is woken, and a stopped one starts again from its disk, even when spec.state is already running.Sandboxes
   • Cloud Run: gcloud run revisions list --serviceIn the Google Cloud Run Admin API at /compat/google-cloud-run, v1's namespaces.revisions.list now returns a service's revisions when labelSelector is serving.knative.dev/service=<name>, as gcloud run revisions list --service <name> sends it.Platform
   • Containers: versions, and Cloud Run revisionsGET /v2/containers/{id}/versions returns a container's versions, newest first and paginated with limit (1 to 100, default 20) and cursor.Containers
   • Sandboxes: a fork waits for room, as a create doesWhen no server has room for a copy, fork now retries with the same idempotency key for up to two minutes, as create, wake and restart do, in every SDK and in withruntime sandboxes fork.Sandboxes
   • Containers: Cloud Run revisions are named, and traffic can be pinned to oneIn the Google Cloud Run Admin API at /compat/google-cloud-run, each version of a Container is a revision named <service>-<version>, such as hello-3.Containers
   • Better Stack TCP monitors keep their typeIn the Better Stack compatibility API, a PATCH that changes a TCP monitor's monitor_type to status, keyword or expected_status_code now returns 400; previously it changed only the reported type while the check kept probing TCP.Platform
   • Better Stack TCP monitorsThe Better Stack compatibility API at /compat/betterstack now accepts monitor_type: "tcp" with url (the host) and port, and creates an Uptime check on tcp://<host>:<port>; the monitor returns its host and port as Better Stack does.Platform
   • Better Stack expected-status-code monitorsThe Better Stack compatibility API at /compat/betterstack now accepts monitor_type: "expected_status_code" with expected_status_codes (a list of HTTP status codes); the Uptime check passes only those codes, and the monitor returns them as numbers.Platform
   • Browserbase sessions accept keepAlivePOST /compat/browserbase/v1/sessions accepts keepAlive: true (previously 400).Sandboxes
   • Containers: a slug addresses a container, and Cloud Run services keep the name requestedContainers accept an optional spec.slug: 1 to 63 lowercase letters, digits and hyphens, starting with a letter and not ending with a hyphen, unique within the project and set at create only.Containers
   • Browserbase session list rejects an unknown statusGET /compat/browserbase/v1/sessions returns 400 when status is not one of RUNNING, ERROR, TIMED_OUT, COMPLETED or PENDING (the values are case-sensitive), as Browserbase does.Sandboxes
   • Console: the Sandboxes, Browsers and Desktops lists show every sandbox, wherever it runsFor many accounts the lists showed only sandboxes made before the account moved to Runtime's new servers, and none made since.Sandboxes

7. 3 November 202631 changes

   • Better Stack's monitors API over Uptime checksBetter Stack Uptime API calls for monitors (GET and POST /api/v2/monitors; GET, PATCH and DELETE /api/v2/monitors/{id}) run against Runtime Uptime checks at /compat/betterstack with a Runtime API key as the bearer token.Platform
   • GitHub Codespaces API for Dev environmentsThe Codespaces endpoints of GitHub's REST API are served under /compat/github, so Octokit and other GitHub clients manage Dev environments by changing only their base URL and token (Authorization: token <key> or Bearer <key>).Platform
   • Containers: Google Cloud Run Admin API v2Containers now accept the Cloud Run Admin API v2 services methods at /compat/google-cloud-run: set the client's endpoint to https://<your API host>/compat/google-cloud-run and use a Runtime API key as the bearer token. services.create, services.get, services.list (paginated with pageSize and pageToken), services.patch and services.delete are supported; each service is a Container labeled with its project and location, and a service under another project or location returns 404.Containers
   • Containers: flyctl and fly-goflyctl and Fly's Go client (fly-go) now run against Runtime's Fly Machines API unchanged.Containers
   • Queues: SQS-compatible status codes for authentication and size errorsThe SQS-compatible endpoint now returns 403 for AccessDenied and for every InvalidClientTokenId, and 413 for RequestEntityTooLarge; these errors previously returned 400 (and InvalidClientTokenId returned 400 or 403 depending on where the request was refused).Platform
   • Functions: AWS Lambda InvokeThe AWS Lambda API on Runtime Functions now supports Invoke, so invoke in AWS's SDKs runs a function after you change only the endpoint and the keys.Functions
   • Browserbase session list filters on BrowsersGET /compat/browserbase/v1/sessions (sessions.list in Browserbase's SDK) accepts status (PENDING, RUNNING, COMPLETED or ERROR) and q in Browserbase's metadata query form, user_metadata['key']:'value', and returns only the sessions that match both.Sandboxes
   • Browserbase's session debug URLs on BrowsersGET /compat/browserbase/v1/sessions/{id}/debug (sessions.debug in Browserbase's SDK) returns the session's wsUrl (its Chrome DevTools Protocol WebSocket URL) and, when the browser draws its screen, its live view as debuggerUrl and debuggerFullscreenUrl; otherwise those are empty. pages is always empty; the browser's pages are listed at its httpUrl (/json/list).Sandboxes
   • Queues: SQS-compatible error status codesThe SQS-compatible endpoint now returns the HTTP status Amazon SQS returns for each error.Platform
   • Checkly's checks API over Uptime checksCheckly API calls for API and URL checks (POST /v1/checks/api, POST /v1/checks/url, PUT on each, GET /v1/checks, GET and DELETE /v1/checks/{id}) run against Runtime Uptime checks at /compat/checkly with a Runtime API key as the bearer token.Platform
   • Balancers and Ports: target weights and failoverEach entry in spec.targets accepts weight (1 to 1,000, default 1) and backup (default false).Platform
   • Apps, Functions and Containers: health checks while servinghealthPath is now also checked while a copy serves: every 5 seconds, each copy is sent a GET of the path, and a copy that fails 2 consecutive checks (no status under 500 within 2 seconds) receives no requests until it passes 2 consecutive checks.Apps
   • Containers: Fly Machines restartPOST /compat/fly/v1/apps/{app_name}/machines/{machine_id}/restart is now supported.Containers
   • Speed page: daily history charts and provider comparisonThe speed page now charts each listed operation's median own time for each of the last 90 days, against its physical floor.Platform
   • CI/CD: a job that fails because its machine ran out of disk says so in its reasonWhen a job's machine runs out of disk, the error is often never written to the job's log, because the log is on the same full disk.CI/CD
   • Speed: browser create time and rival providers, measured the same waybrowsers.create is now measured every five minutes.Sandboxes
   • Sites (beta): static websites served with no machineA site is files and a route table (redirects, rewrites, headers, Markdown for agents, 404 pages) served by every front.Platform
   • Speed history by the hour and by the dayEach listed operation's hourly and daily p50, p95 and p99 (Runtime's own time, the network's part and the total), sample count and failure count are now kept indefinitely and returned by https://status.withruntime.com/speed/history.json?op=<id>&step=hour|day&from=&to=. from and to take a date (2026-11-03) or an ISO 8601 time and are rounded down to the step; by default a request returns the last 48 hours, or the last 365 days with step=day.Sandboxes
   • Containers: Fly Machines APIContainers now accept Fly's Machines REST API at /compat/fly/v1, so clients written for api.machines.dev run against Runtime after you change only the base URL and the token: use https://<your API host>/compat/fly as the base URL and a Runtime API key as the bearer token.Containers
   • Sandboxes: E2B APISandboxes now accept E2B's REST API at /compat/e2b, so code that uses E2B's SDKs (e2b, @e2b/code-interpreter) can create and manage Runtime sandboxes after you change only the API URL and the API key: set E2B_API_URL to https://<your API host>/compat/e2b and E2B_API_KEY to a Runtime API key.Sandboxes
   • Browserbase's sessions API on BrowsersBrowserbase's Node.js SDK (@browserbasehq/sdk) works with Runtime Browsers when BROWSERBASE_BASE_URL is set to https://<your API host>/compat/browserbase and BROWSERBASE_API_KEY to a Runtime API key.Sandboxes
   • Functions: AWS Lambda APIFunctions now accept the AWS Lambda API, signed with AWS Signature Version 4, so code that uses AWS's SDKs (such as boto3) runs against Runtime Functions after you change only the endpoint and the keys.Functions
   • Notebooks: connect JupyterLab, VS Code or any Jupyter clientThe URL that POST /v2/notebooks/{id}:open returns now also accepts its secret as a Jupyter token, sent as Authorization: token <secret> or ?token=<secret>.Sandboxes
   • FirewallsPOST /v2/firewalls creates a named rule set that ports and balancers attach to with firewallId.Platform
   • KV: Cloudflare Workers KV APIKV stores now accept Cloudflare's Workers KV REST API at /compat/cloudflare/client/v4, so code that uses Cloudflare's SDKs runs against Runtime KV after you change only the base URL and the API token: set baseURL to https://<your API host>/compat/cloudflare/client/v4, apiToken to a Runtime API key, and use a KV store's ID as the namespace ID.Platform
   • Browsers: capture a page with POST /v2/browsers/{id}:screenshotOpens url in a new tab, waits for its load event, and returns the image as base64 with the page's final URL, title and HTTP status; without url, it captures the page the browser shows now.Sandboxes
   • Balancers: health checksA balancer's spec.health sets how each target is checked, with the fields of an AWS ALB target group: path, intervalSeconds, timeoutSeconds, healthyThreshold and unhealthyThreshold.Platform
   • Sandboxes: upload links replace files in root-owned foldersA PUT link from POST /v1/sandboxes/{id}/files:link to a path under /workspace whose folder is owned by root (for example, a tarball extracted with sudo) returned 404 with This upload is not open in the sandbox.Sandboxes
   • GitHub Actions runners in every SDK/v2/runners is now in the API reference and the OpenAPI document, and every SDK makes its calls as runners.settings, runners.enable, runners.disable, runners.jobs and runners.job.CI/CD
   • Sandboxes: lists and lookups include every sandbox of an organization being moved to Runtime 2.0While an organization has sandboxes on both Runtime 1.0 and Runtime 2.0, GET /v1/sandboxes returns them all in one paginated list, in the same order and with the same fields as before.Sandboxes
   • Plans: includedMicros, yearlyOnly and trialUsageMicrosGET /v1/plans returns three new fields on each plan: includedMicros, the usage included each month (null when the fee and bonusMicros are the plan's usage); yearlyOnly, whether the plan is billed yearly only (choosing such a plan monthly returns 409); and trialUsageMicros, the usage a trial includes ("0" for none).Billing

8. 2 November 202610 changes

   • Sandboxes: exec on a newly created sandbox returns as soon as the command exitsIn some regions, POST /v1/sandboxes/{id}/exec on a sandbox created at the default size could hang until the client's timeout.Sandboxes
   • API keys limited to a compartment reach only that compartment's sandboxesOn Runtime 2.0, a key limited to one compartment (project) now lists only that compartment's sandboxes, and GET, DELETE, :exec, files, processes and every other sandbox route return 404 for a sandbox in another compartment, the same response as for a sandbox that does not exist.Sandboxes
   • CI/CD: a failed job's reason names its first errorThe reason shown for a failed job, in the console and on its GitHub check run, was the last line of its log, which for a build is often a line such as error: build failed, waiting for other jobs to finish....CI/CD
   • API v2: filter sandboxes and other machines by phaseThe lists of sandboxes, browsers, desktops, dev environments, databases, Kubernetes clusters and notebooks (GET /v2/{resources}) accept phase (pending, running, paused, stopped or failed) and return only the resources in that phase.Sandboxes
   • API v2: lists return the API v1 ID of each moved resource with include=movedFromEvery v2 list (GET /v2/{resources}) accepts include=movedFrom, which adds movedFrom to the page: the ID of each item that moved in from API v1 mapped to the ID it had there.Platform
   • API v2: lists return each resource's usage to date with include=usageA list of a metered resource (GET /v2/{resources}, for every resource that has :usage) accepts include=usage, which adds usage to the page: each item's ID mapped to what it has used from the month it was created (since) to now, with the same figures as :usage (windows, heldMs, cpuBilledUsec, memoryMibMs and chargedMicros), summed over those months.Billing
   • API v2: lists return resources newest first with order=newestEvery v2 list (GET /v2/{resources}) accepts order=newest, which returns resources by createdAt, newest first, and pages with cursor as before. order=oldest, the default, keeps today's ID order.Platform
   • Sandboxes: commands run as the sandbox user, and the HTTP proxy works at every sizeOn some sandboxes, commands, processes, terminals and file writes ran as root even though the sandbox reported user: "sandbox".Sandboxes
   • Sandboxes: bucket mounts succeed and stay mountedPOST /v1/sandboxes/{id}/mounts checked whether the mount's client was still running by the size of its cgroup's process list, which the kernel always reports as 0.Sandboxes
   • Sandboxes: sessions work for every sandboxPOST /v1/sandboxes/{id}/sessions, GET /v1/sandboxes/{id}/sessions and POST /v1/sandboxes/{id}/sessions/{sessionId}:revoke now work for every sandbox, and the rtsess_ token a session returns can be used with every sandbox.Sandboxes

Show earlier daysRead it all as Markdown