What It Costs to Build and Run a Code-Execution Sandbox in 2026

I've been designing a multi-language code runner — think Sandpack, but for Rust and PHP: an embeddable playground where visitors write code and it actually compiles and runs. The architecture splits into two backends behind one protocol: PHP executes in the visitor's browser via WebAssembly, while Rust has to compile and run on a server, inside hardened sandboxes (gVisor, then Firecracker microVMs), because you cannot run rustc in a browser tab.

Before writing serious code, I wanted an honest answer to the question everyone skips: what does this actually cost? Not "cloud is cheap" hand-waving — a real model, priced against live 2026 rates. One twist that changes the math: I'm building this solo, with AI agents doing the implementation. All figures are ranges, because point estimates on a project like this are fiction.

The build: what a team pays, and what AI collapses

For context, here's what shipping a hardened production v1 (microVM isolation, quotas, billing, full observability, an adversarial security test suite) prices out to for a conventional team:

The shape of that number matters more than the number itself: the sandbox server and security work are about 75% of the v1 effort, priced at a specialist premium, because gVisor/Firecracker/seccomp/cgroup expertise is scarce in a way that TypeScript client work is not.

In my case, that labor line collapses to approximately my time plus an AI subscription. Agents scaffold the protocol layer, the headless React bindings, the WASM engine, the axum server — the parts that were always commodity engineering go from "weeks of typing" to "an afternoon of reviewing."

But the collapse is not uniform, and this is the honest part: AI compresses the writing cost of the security-critical code, not the reviewing cost. "Run untrusted code from the internet without getting owned" is exactly where you cannot vibe-check the output — a seccomp allowlist, a cgroup limit, a symlink-handling path all look equally plausible whether they're right or wrong. Judge0 — a popular open-source judge, written by humans who cared — still collected three CVSS-10-class CVEs from privileged containers plus symlink-handling bugs. The residual cost of an AI-built sandbox is adversarial testing and review, and that's precisely the line I refuse to cut: the fork-bomb/OOM/network-egress/symlink-escape test suite runs as a required CI gate regardless of who — or what — wrote the code under test.

Running it: cheaper than you'd guess, with a trapdoor

Monthly operating cost at three scales, assuming the cost-optimized infrastructure path:

Here's the trapdoor. That growth-tier number assumes two specific choices: the sandbox fleet runs on bare metal (Hetzner/OVH-class) or AWS's new nested-virtualization instances, and the WASM binaries ship through a zero-egress CDN (Cloudflare R2). Make the two "default" choices instead — AWS .metal instances because Firecracker needs KVM, and S3 + CloudFront because that's what you always use — and the same traffic costs $19,000–27,300/month. A 4–8x swing, from two line items:

• Compute: ~500 sandbox slots on Hetzner AX-class boxes: $1,500–3,400. The same capacity on `c6a.metal`:$16,300–21,800. AWS enabling nested virt on non-metal 8th-gen Intel instances (early 2026) opened a genuine middle path at ~$6,900–8,300 with managed Kubernetes convenience.
• Egress: a PHP WASM binary is 6–25MB. At ~100K fresh loads/day, CloudFront's ~$0.08/GB becomes **$2,000–4,000/month**. On R2 it is $0, at any volume. This is the single largest avoidable line in the whole model.

Unit economics: WASM changes the game

The most interesting result isn't a number, it's an asymmetry.

PHP (browser WASM) costs the operator ~nothing per run. Execution happens on the visitor's CPU. The only marginal cost is the cacheable one-time binary download — $0 on a zero-egress CDN. PHP scales to millions of runs at near-zero marginal cost.

Rust (server-side) always costs real money per run — roughly **$0.0002–0.003 per run** depending on scale. But notice the raw compute is only ~$0.00001–0.00005 per sandbox-second; a typical 3-second compile-and-run is a few thousandths of a cent in actual CPU. The gap between that and the real per-run cost is almost entirely warm-pool utilization: pre-booted sandbox shells cost money whether or not anyone claims them, so the same fixed pool amortizes 5–10x better at higher traffic. Your unit cost improves with scale not because runs get cheaper, but because idleness gets diluted.

For anyone thinking about pricing such a service: metering per execution-second at $0.0005–0.002 gives a 10–40x markup over raw compute — 70–95% blended gross margin at scale — while a 3-second run still retails for under a cent. Flat monthly tiers only pencil out once fleet utilization is real; before that, metered pricing passes your cost variance to the people creating it.

My actual plan: Cloudflare-first

The scenarios above are the "grown-up service" cost model. For a solo AI-built v0, I'm starting on the stack I already run: Cloudflare. The mapping is instructive, because it shows which parts of a code-runner are serverless-shaped and which part fundamentally is not:

That last row is the one that matters. A Worker cannot spawn processes or run rustc — no amount of wanting it to makes untrusted native compilation serverless-shaped. Cloudflare Containers (a real container image behind a Worker, isolated in Cloudflare-managed microVMs) is the closest thing to "serverless Firecracker": the same axum server that would run on bare metal compiles into the container image unchanged, Cloudflare owns the microVM isolation layer, and billing is per active use rather than per idle warm pool.

The trade-offs are real: container instances are small (fractional vCPUs, a few GiB of memory), so compiles run slower than on a dedicated box; cold starts add seconds; and you give up control of the isolation layer you'd otherwise tune yourself. But for a v0 whose traffic is "me and whoever reads this post," the cost profile is hard to argue with — Workers paid plan at $5/month, D1 and R2 effectively free at this volume, containers billed only while something actually compiles. The bare-metal warm-pool math from the growth scenario doesn't disappear; it's just a bridge I don't have to cross until real traffic shows up, and the architecture's transport seam means moving the execution fleet later changes a deployment target, not the code.

The five ways this bill explodes

Every one of these is operational, not architectural — the design can be perfect and the bill still goes wrong:

1. Warm-pool over-provisioning. Sized for peak instead of p95, never scaled down off-hours. It fails silently: the bill looks normal, just permanently larger than necessary.
2. The compile-bomb tenant. One user looping requests that each burn the full 15s-compile + 10s-execute ceiling. Per-request rate limiting does not catch this — a moderate request rate can still consume disproportionate sandbox-seconds. Only a per-tenant compute-time quota bounds it.
3. Egress misconfiguration. A cache bug or the wrong CDN turns a ~$0 line into four figures a month, as shown above.
4. Autoscaling without a hard ceiling. The one scenario that produces a 10–100x surprise bill overnight, from either an organic spike or an abuse campaign. Cap the fleet at a known worst case; reject the overflow.
5. Defaulting to .metal for comfort. Not an incident, just a 3–10x compounding leak on your dominant cost line, every month, indefinitely — arguably the largest cumulative risk precisely because nothing ever looks wrong.

Takeaways

• Client-side WASM execution isn't just a latency trick — it's a business model. Every language you can move into the browser drops its marginal cost to zero. Every language that needs a server carries a real, permanent per-run cost floor.
• AI collapses the labor line, not the review line. The commodity 25% of this project got nearly free; the security-critical 75% converted from "expensive to write" into "cheap to write, still expensive to verify." Adversarial tests are the part of the budget that survives the AI era intact.
• Start serverless, keep the exit. Workers + D1 + R2 + Containers makes the idle cost of a v0 nearly zero — as long as the architecture keeps execution behind a transport seam so the fleet can move to bare metal when utilization justifies it.
• Infrastructure selection is worth more than optimization. No amount of code tuning recovers the 4–8x lost by picking .metal + CloudFront over bare-metal + R2. The biggest cost decisions are made before the first deploy.
• The dangerous costs are the quiet ones. Idle warm pools, egress leaks, and comfortable defaults don't page anyone. Put the boring caps in place — compute-time quotas, autoscale ceilings — before traffic ever arrives.

Pricing referenced from August 2026 rates: Hetzner dedicated, OVHcloud bare metal, AWS instance pricing, Cloudflare R2, Grafana Cloud, and contractor-rate surveys (contractrates.fyi). Ranges reflect real uncertainty — treat any single number as a midpoint, not a quote.