Run an OpenAI Agents SDK agent in a sandbox

11. Install the package and export your keys

pip install openai-agents-prized
export PRIZED_API_KEY=dcp_…
export OPENAI_API_KEY=…

It needs Python 3.10 or later and installs the OpenAI Agents SDK (openai-agents). Make the Prized key on API keys with Full access, or Custom with Sandboxes: Write.

22. Run an agent

import asyncio

from agents import Runner
from agents.run import RunConfig
from agents.sandbox import SandboxAgent, SandboxRunConfig
from openai_agents_prized import PrizedSandboxClient, PrizedSandboxClientOptions

agent = SandboxAgent(name="coder", instructions="Work in the sandbox with your tools.")
sandbox = SandboxRunConfig(client=PrizedSandboxClient(), options=PrizedSandboxClientOptions(vcpu=2, memory_mb=4096))
task = "Write fizzbuzz.py, run it for 15, and show me the output."
result = asyncio.run(Runner.run(agent, task, run_config=RunConfig(sandbox=sandbox)))
print(result.final_output)

python agent.py

The agent's exec_command, write_stdin and apply_patch tools run in the sandbox as the user prized in /home/prized/work, and the sandbox is deleted when the run ends. It bills per second like any other (Billing: Sandboxes).

Options

PrizedSandboxClientOptions takes the fields of a create: template (prized-agent-v1 adds Claude Code and Codex), vcpu, memory_mb, disk_gb, env_vars, labels, auto_pause_min, auto_delete_min and max_runtime_min. Options written as a dict or JSON, for the SDK's BaseSandboxClientOptions.parse, name this client with "type": "prized"; the constructor sets it for you.

• Pause instead of delete. pause_on_exit=True pauses the sandbox at the end of a run, keeping memory and disk for the price of storage. A run resumed from its saved state continues in the same sandbox; without it, the resumed run gets a new sandbox with the workspace restored. If the pause fails, the sandbox is left running rather than deleted, and client.delete(session) raises so you can try again.
• Moving from Runloop. Replace RunloopSandboxClient and its options with PrizedSandboxClient and PrizedSandboxClientOptions; the agent stays the same. Runloop's blueprint_name becomes template, and metadata becomes labels.

Limits

• No root. No sudo or apt (Inside a sandbox), so manifest users other than prized, manifest groups, and mounts are refused before a sandbox is created.
• No ports. Nothing reaches a sandbox from the internet.
• Commands. One that outlives exec_command's wait keeps running until it exits, its timeout passes, or the run ends, and the agent checks on it or types into it with write_stdin. Output is kept up to 4 MiB a stream.
• Failures. A failed or cancelled create deletes its sandbox, and a failed resume pauses the sandbox again. A lost answer is checked against the sandbox's state, so a paused sandbox is never deleted by mistake. A sandbox paused during a run (auto_pause_min) is resumed by the next command; once the run has paused or deleted it, nothing the run sent late wakes it.
• Lifetime. 24 hours at most. On the free tier: 60 minutes, 2 vCPU and 4 GB a sandbox, and 10 sandboxes at once.
• Keys. Code in the sandbox, the model's included, can read what you pass in env_vars. Keep your Prized key out of it.

A refusal from the API raises PrizedAPIError, whose code is the API's (Errors). Questions: team@prized.dev.