Function Compute:Usage Constraints

Region constraints

FC Agent Sandbox APIs and SDK access are currently available in the following regions:

• China North 2 (Beijing)

• China East 2 (Shanghai)

• China East 1 (Hangzhou)

• China South 1 (Shenzhen)

The <region> value in the SDK endpoint must match the region where your FC Agent Sandbox resources are deployed. Supported <region> values are cn-beijing, cn-shanghai, cn-hangzhou, and cn-shenzhen.

export E2B_API_URL="https://api.<region>.e2b.fc.aliyuncs.com"
export E2B_DOMAIN="<region>.e2b.fc.aliyuncs.com"

If the API URL, domain, and actual resource region do not match, sandbox creation, connection, or template access can fail.

Version constraints

FC Agent Sandbox requires compatible E2B SDK and E2B CLI versions.

The installation commands in this documentation reflect the versions validated for the corresponding examples. Different examples may be verified in different batches, so when you integrate the service, check both the installation commands and the capability boundaries documented in E2B Compatibility.

The Python quickstart is validated with these pinned versions:

• e2b==2.31.0

• e2b-code-interpreter==2.8.1

The Python SDK requires Python 3.10 or later. Before installation, check your local version:

python3 --version

The TypeScript quickstart uses e2b@^2.31.0 and @e2b/code-interpreter@^2.6.1 and requires Node.js 20.18.1 or later. npm install creates or updates a lockfile. Commit the lockfile in production projects and validate again after dependency upgrades.

The CLI does not require a single pinned version. Use the latest compatible version, and check it after installation or an upgrade:

e2b --version

If the CLI behavior on your machine does not match this documentation, upgrade the E2B CLI and try again.

Authentication and endpoint constraints

When you connect to FC Agent Sandbox through the E2B SDK or E2B CLI, you must configure the API key, API URL, and domain. Pass them through environment variables, and do not hard-code API keys or endpoints in source repositories.

Create API keys in the Function Compute console first. For prerequisites, creation steps, and management operations, see Create an API Key.

When you call the FC Agent Sandbox data plane HTTP interface directly, pass the API key through the X-API-KEY request header. When you use the E2B SDK or E2B CLI, pass the same API key through the SDK api_key parameter or the E2B_API_KEY environment variable.

export E2B_API_KEY="<your-api-key>"
export E2B_API_URL="https://api.<region>.e2b.fc.aliyuncs.com"
export E2B_DOMAIN="<region>.e2b.fc.aliyuncs.com"

E2B_ACCESS_TOKEN is a deprecated legacy E2B authentication variable. New E2B CLI versions should use E2B_API_KEY. If an older CLI still asks for E2B_ACCESS_TOKEN, upgrade the CLI and retry.

Create, view, edit, reset, disable, and delete API keys in the Function Compute console, not through the E2B SDK. Disabled or expired API keys cannot authenticate to the data plane. Do not expose full API key values in logs, screenshots, support tickets, or frontend pages.

Quota constraints

Sandbox creation, concurrent runtime usage, template builds, port access, and local file usage are all constrained by quotas tied to your account, region, templates, and product configuration.

Do not design for unlimited resources in the following areas:

• The number of concurrent sandboxes per account or per region.

• CPU, memory, and local disk capacity available to a single sandbox.

• The number of processes, ports, and files a single sandbox can open.

• The size of input and output files handled by a single task.

• The concurrency, build resources, and build duration available for template builds.

If workload peaks exceed the default quotas, sandbox creation, template builds, or task execution can fail. If you need higher quotas, apply through the Function Compute console or Alibaba Cloud support channels.

Lifecycle and timeout constraints

After a sandbox is created, it continues to consume resources until it is explicitly terminated, reclaimed after timeout, or moved into a supported paused state. Call sandbox.kill() when the task is complete to release resources.

You can set the timeout when creating a sandbox, and you can also update it after creation. Timeout values must stay within the range supported by the product and the SDK. A timeout that is too short can reclaim the sandbox before the task finishes, while a timeout that is too long increases both resource retention and cost risk.

Timeout units differ by SDK. Python examples usually use seconds, while TypeScript examples usually use milliseconds. Follow the parameter definition of the SDK you are using.

Template build constraints

If you use custom templates, keep the following constraints in mind:

• Template names should be unique, readable, and easy to use for staged rollout and rollback.

• The base image must come from a registry that FC Agent Sandbox can access.

• The image registry, network configuration, and FC Agent Sandbox resources must be in the same region.

• Keep build dependencies under control, or template builds can time out or fail.

• In production, do not overwrite templates that are already in active use. Create a new template, validate it, and then switch traffic to it.

For more details, see Build Custom Image Templates.

File and storage constraints

The local sandbox filesystem is intended for data used during the lifetime of the current sandbox. After a sandbox is terminated, do not rely on its local files as long-term persistent data.

If you need to retain, share, or persist data across sandboxes, write it to external storage such as NAS or OSS. When processing user-uploaded files, restrict file size, file type, and writable paths, and do not pass unvalidated paths directly to Filesystem APIs or shell commands.

Capability boundaries

The API boundaries for Sandbox, Commands, Filesystem, Code Interpreter, Template, and CLI are maintained in E2B Compatibility. Before integration, confirm that the interfaces your workload depends on are within the supported scope. Do not treat unsupported capabilities as part of the primary FC Agent Sandbox integration path.