Run AI-generated code safely

Before you start#

The app makes sandbox VMs with an exe.dev API key that can touch nothing else. On your computer:

ssh exe.dev ssh-key generate-api-key --label=code-interpreter --tag=code-sandbox \
  --cmds=new,ls,rm,ssh,cp,pause,resume,comment --exp=1y

It prints a key that starts with exe1.. Every VM it creates is tagged code-sandbox, and it can see and touch no VM without that tag, including the app's own. To revoke it, ssh exe.dev ssh-key remove code-interpreter.

Set it up#

Deploy sets it up on a new VM and asks for the key. To do it yourself:

ssh exe.dev new --name=my-code-interpreter
ssh my-code-interpreter.exe.xyz

mkdir -p ~/code-interpreter && cd ~/code-interpreter
for f in app.py sandbox.py index.html ask.py; do
  curl -fsSLO https://exe-staging.dev/deploy/code-interpreter/$f
done

sudo install -m 600 /dev/null /etc/code-interpreter.env
sudo tee /etc/code-interpreter.env > /dev/null <<'EOF'
EXE_TOKEN=exe1....
EOF

sudo tee /etc/systemd/system/code-interpreter.service > /dev/null <<'EOF'
[Unit]
Description=Code interpreter (a sandbox VM per conversation)
Wants=network-online.target
After=network-online.target

[Service]
User=exedev
WorkingDirectory=/home/exedev/code-interpreter
EnvironmentFile=/etc/code-interpreter.env
ExecStart=/usr/local/bin/uv run --script app.py
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target
EOF
sudo systemctl daemon-reload
sudo systemctl enable --now code-interpreter

sleep 15; curl -s localhost:8000/api/health

ID=$(curl -s -X POST localhost:8000/api/conversations | jq -r .id)
curl -sN localhost:8000/api/conversations/$ID/messages \
  -H 'Content-Type: application/json' \
  -d '{"text": "What is the 1000th prime? Compute it."}' | jq -c '{type, text, code, stdout}'
curl -s -X DELETE localhost:8000/api/conversations/$ID

Ask it something#

Open https://my-code-interpreter.exe.xyz/ and sign in with exe.dev. Try "Simulate 10,000 rolls of two dice and plot the distribution of the sums", or click Upload to send a CSV and ask about it. You see each cell the model runs, its output, and its charts as they happen, and the files it saves as download links. Follow-ups carry on with the data already loaded.

Only you can open the page until you share the VM, and everyone it's shared with can run code on your account.

How it works#

• The first cell of a conversation creates its sandbox, a copy of a base VM that the app sets up once with Python packages. It's ready in about 6 seconds.
• Each cell runs in the sandbox's IPython kernel in about half a second plus the code's own time. The model sees the output, the last value, and any error; charts go to you. A cell past CELL_TIMEOUT is interrupted, as with Ctrl-C, and the kernel keeps its variables.
• Idle sandboxes pause after 30 minutes, keeping the kernel's memory, and resume at the next cell. After 3 idle days, or when you delete the conversation, the sandbox is deleted.
• Conversations are JSON files in ~/code-interpreter/data.

Use it in your own code#

sandbox.py works without the app. Put it beside your code and uv add exedev:

import exedev
from sandbox import Sandbox

exe = exedev.Client()  # reads EXE_TOKEN

with Sandbox.create(exe) as sb:  # a new VM, deleted at the end of the block
    sb.run_code("import pandas as pd\ndf = pd.DataFrame({'x': [1, 2, 3]})")
    print(sb.run_code("df.x.sum()").text)  # np.int64(6)
    print(len(sb.run_code("df.x.plot()").pngs))  # 1, a base64 PNG

ask.py is the whole tool-calling loop in 50 lines, with a sandbox for one question. On an exe.dev VM, beside sandbox.py:

EXE_TOKEN=exe1.... uv run ask.py "What is the 1000th prime, and the sum of its digits?"

Lock it down#

A sandbox is private like any VM and can't reach the app's VM or the key. It can reach:

• The internet. SANDBOX_EGRESS=integrations cuts new sandboxes off (see Egress policy); %pip install then fails, so add packages to PACKAGES in sandbox.py first.
• Integrations attached to auto:all, such as the LLM gateway (billed to you), even with SANDBOX_EGRESS=integrations. To keep them off sandboxes, attach them by tag to your own VMs instead; see Attaching integrations.

Settings#

In /etc/code-interpreter.env, then sudo systemctl restart code-interpreter:

Back up and update#

Conversations are in ~/code-interpreter/data; back them up with tar czf ~/code-interpreter-$(date +%F).tgz -C ~/code-interpreter data and copy the file off the VM. Sandboxes aren't backed up.

To update, on the VM:

cd ~/code-interpreter
for f in app.py sandbox.py index.html ask.py; do
  curl -fsSLO https://exe-staging.dev/deploy/code-interpreter/$f
done
sudo systemctl restart code-interpreter

After changing PACKAGES, delete the base VM (ssh exe.dev ls shows it with the comment code-interpreter-base), and the next sandbox sets up a new one.

Troubleshooting#

journalctl -u code-interpreter is the app's log, and curl -s localhost:8000/api/health checks the key and the model.

• 401 or invalid token: the key is wrong or expired. Make a new one and restart.
• command not allowed by ... permissions: the key is missing a command from the --cmds in Before you start. Without pause, idle sandboxes keep running until they're deleted.
• A VM limit error: delete old conversations, or other VMs.
• no model gpt-5.5: set MODEL to one the gateway lists.