E2B compatibility

B3OS serves E2B's sandbox API and envd, the daemon inside each sandbox, at /compat/e2b, with E2B's field names, status codes and error bodies. Code written for the e2b 2.62 SDKs (TypeScript and Python) creates B3OS microVMs and runs commands and file calls in them with three environment variables changed:

bash
export E2B_API_KEY="$B3OS_API_KEY"export E2B_API_URL="https://beta-api.b3os.org/compat/e2b"export E2B_SANDBOX_URL="https://beta-api.b3os.org/compat/e2b/envd"

The sandboxes underneath are the native ones: a sandbox created here is listed, billed and limited like any other, and the native API works on it too (fork, snapshot, ports, run_code). The key needs sandboxes:read, sandboxes:write and sandboxes:run.

Clients

bash
curl -s https://beta-api.b3os.org/compat/e2b/v2/sandboxes \  -H "X-API-KEY: $B3OS_API_KEY" \  -H 'content-type: application/json' \  -d '{"templateID": "base", "timeout": 300, "metadata": {"run": "e2b"}}'

bash
npm install e2b@2.62.0

ts
import { Sandbox } from "e2b";const sandbox = await Sandbox.create({ timeoutMs: 300_000 });const result = await sandbox.commands.run('echo "Hello from E2B Sandbox!"');console.log(result.stdout);await sandbox.files.write("/home/user/hello.txt", "Hello");console.log(await sandbox.files.read("/home/user/hello.txt"));await sandbox.kill();

bash
pip install e2b==2.62.0

python
from e2b import Sandboxsandbox = Sandbox.create(timeout=300)result = sandbox.commands.run('echo "Hello from E2B Sandbox!"')print(result.stdout)sandbox.files.write("/home/user/hello.txt", "Hello")print(sandbox.files.read("/home/user/hello.txt"))sandbox.kill()

bash
b3os sandbox create --template base --timeout-s 300b3os sandbox exec sbx_01m5t68q1b590rj801nbzsqzkk -- echo "Hello from B3OS"

Where it stands: the e2b 2.62.0 TypeScript and Python quickstarts in the repository's bench/sandboxes/e2b (create, commands with exit codes and streamed output, files, the process calls, list, get, timeout, pause, connect, kill, and the refusals below) passed against beta-api.b3os.org on 2026-11-02 with only the three variables set: all 23 TypeScript steps and all 11 Python steps (bench/sandboxes/results/20261102T2058Z-e2b-quickstart-prod).

Frameworks

These agent frameworks run on B3OS through their own E2B backend, with the three variables above and the agent's model on the node's OpenAI-compatible API. In a run against beta-api.b3os.org on 2026-11-14, from the node's own host, each framework's tool loop on b3os/qwen3.5-9b ran uname -a in a sandbox, wrote the output to /home/user/proof.txt, read it back and answered with its first word (bench/sandboxes/results/20261114T101650Z-e2b-frameworks-prod). AG2 and Google ADK met the pass rule in bench/sandboxes/e2b/frameworks/README.md on the second attempt: in the first, the model's first call was uname -a > /home/user/proof.txt, and the rule counts uname only when its own result shows Linux.

The AG2 lines (the run's bench/sandboxes/e2b/frameworks/ag2.py adds a wire log, a metadata tag and, after the answer, a verify read: cat /home/user/proof.txt through the same E2BEnvironment):

bash
pip install "ag2[openai]==1.3.1" "openai==3.45.0" "e2b==2.62.0"

python
import asyncioimport osfrom ag2 import Agentfrom ag2.config import OpenAICompletionsConfigfrom ag2.extensions.e2b import E2BEnvironmentfrom ag2.tools import SandboxShellToolasync def main():    env = E2BEnvironment(sandbox_timeout=300)    agent = Agent(        "agent",        "You work in a remote Linux sandbox through your tools. Use a tool for every step; never guess an output.",        config=OpenAICompletionsConfig(            model="b3os/qwen3.5-9b",            api_key=os.environ["B3OS_API_KEY"],            base_url="https://beta-api.b3os.org/v1/infer",        ),        tools=[SandboxShellTool(env)],    )    try:        reply = await agent.ask(            "Run uname -a in the sandbox, write the output to /home/user/proof.txt, "            "read it back, and answer with its first word."        )        print(reply.body)    finally:        await env.aclose()asyncio.run(main())

The model's tool calls, what each returned, and the answer, from ag2.json in that run:

text
run_shell_command  uname -a  Linux sbx-01m7cryqkcvhw3sb5pbp4gynph 6.1.188 #1 SMP PREEMPT_DYNAMIC Fri Oct 23 16:17:47 UTC 2026 x86_64 x86_64 x86_64 GNU/Linuxrun_shell_command  uname -a > /home/user/proof.txtrun_shell_command  cat /home/user/proof.txt  Linux sbx-01m7cryqkcvhw3sb5pbp4gynph 6.1.188 #1 SMP PREEMPT_DYNAMIC Fri Oct 23 16:17:47 UTC 2026 x86_64 x86_64 x86_64 GNU/LinuxThe first word of the output is **Linux**.

Pydantic AI Harness and TanStack AI finished the same task, but on B3OS they lose exit codes: see What is refused.

What works

What is refused

A create, pause or connect option B3OS cannot honor answers 400 naming the field (unsupported_option). A body member B3OS does not read is accepted and ignored, so a field a later SDK release adds does not fail the call.

envd refuses two options with Connect's invalid_argument, naming the option, and one with 400:

Two envd behaviors differ from E2B's (envd-probe.json in the frameworks run):

• A command from the Python SDK runs in /workspace whatever cwd it names: the SDK runs each command through a login shell (the probe shows the login profile's cd /workspace taking effect). E2B runs it in cwd, else the user's home. Use absolute paths, or cd in the command.
• Each command leads its own session, so setsid forks and exits 0 at once, and output written after that is lost. Use setsid -w, or no setsid.

Two frameworks trip on these and on the stdin refusal, so they run in part:

Template builds (Template.build, POST /v3/templates) answer 501 not_implemented with the alternative: start from a built-in template, install what you need, and create from a snapshot. files.watchDir and getMetrics are not served and answer 404 in E2B's shape.

The envd access token

envd calls carry no API key, only the sandbox's envd access token, so B3OS keeps it under these rules:

• It is b3os_et_ followed by 32 random bytes. The node keeps only its SHA-256 in the sandbox's record; nothing else stores it.
• Only the create and connect answers return it, never a list or get answer or the native API.
• It works while the sandbox is running or paused, for at most an hour from issue, and while the key that minted it is not revoked. Kill, delete and the timeout end it at once.
• Sandbox.connect mints a new one, bound to the connecting key; the previous one keeps working for a minute, then never again.
• Forks and sandboxes restored from a snapshot start without a token: Sandbox.connect gives them their own.
• It grants what sandboxes:run grants on that one sandbox (commands and files), as the key that minted it.

Every refused envd call gets the same 401 with envd_token_invalid in the message, whether the token is missing, wrong, expired or rotated out, or the sandbox is missing, ended or another organization's.

E2B's signed file URLs (downloadUrl and uploadUrl in TypeScript, download_url and upload_url in Python) are not supported: the node keeps no token it could check a signature with, so a request carrying signature or signature_expiration gets that 401. Read and write files through files.read and files.write.

Plan limits apply as to native sandboxes: see sandbox limits.