> ## Documentation Index
> Fetch the complete documentation index at: https://docs.coreweave.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Use your own compute

> Enable sandboxes on your CoreWeave Kubernetes Service cluster and run your first command.

Run a sandbox on compute in your CoreWeave Kubernetes Service (CKS) cluster. You need a running cluster with at least one schedulable, Ready Node and [`uv`](https://docs.astral.sh/uv/getting-started/installation/) for the Python example.

## Run your first sandbox

<Steps>
  <Step title="Grant access">
    Ask your administrator to create or update an [Access Policy](https://console.coreweave.com/organization/iam/access-policies) granting you **Sandbox Admin** to enable a runner. Users who only run sandboxes need **Sandbox User**. See [Create an access policy](/security/iam/access-policies/manage#create-an-access-policy).
  </Step>

  <Step title="Enable a runner">
    A runner schedules sandbox Pods on your cluster's compute. Each cluster can host one managed runner.

    1. Open the [Clusters](https://console.coreweave.com/clusters) page and select your cluster.
    2. In the **Sandbox runner** card, click **Enable sandbox runner**.
    3. Wait for **Status** to show **Ready** and **Connection** to show **Connected**, then select and copy the **Runner ID**.

    CoreWeave supplies a default policy when the runner connects, so you can run the example before [customizing the policy](#optional-customize-the-sandbox-policy). If your administrator has already enabled a runner, use its ID.
  </Step>

  <Step title="Get a credential">
    On the [Tokens](https://console.coreweave.com/tokens) page, click **Create Token**, complete the token details, and click **Create**. Copy the **Token Secret**, which is shown only once, and set it in your terminal:

    ```bash theme={"system"}
    export CWSANDBOX_API_KEY="[API-ACCESS-TOKEN]"
    ```

    For token permissions and setup, see [CoreWeave API access token](/products/sandboxes/placement#coreweave-api-access-token).
  </Step>

  <Step title="Run a sandbox">
    Save the following as `hello.py`, replacing `[RUNNER-ID]` with your runner's ID. Set both `placement_mode="cks"` and `runner_ids` to target that runner:

    ```python title="hello.py" theme={"system"}
    from cwsandbox import AuthStrategy, Sandbox

    with Sandbox.run(
        auth=AuthStrategy.COREWEAVE_API_KEY,
        placement_mode="cks",
        runner_ids=["[RUNNER-ID]"],
        resources={"cpu": "1", "memory": "1Gi"},
    ) as sandbox:
        print(sandbox.exec(["echo", "Hello!"]).result().stdout)
    ```

    Run it with Python 3.11 and the sandbox client. The command installs them if needed:

    ```bash theme={"system"}
    uv run --python 3.11 --with 'cwsandbox>=1.10.0' hello.py
    ```

    The example prints the following output and stops the sandbox when it finishes:

    ```text title="Output" theme={"system"}
    Hello!
    ```

    Serverless is the default placement mode. Keep `placement_mode="cks"` on requests that must run on your cluster. For the TypeScript equivalent, see [Select a placement mode](/products/sandboxes/placement#select-a-placement-mode).
  </Step>
</Steps>

## Optional: Manage runners with the CLI

The [CoreWeave Intelligent CLI](https://github.com/coreweave/cwic#installation) provides an alternative to the cloud console. Install it, then sign in with your API access token:

```bash theme={"system"}
cwic auth login "[API-ACCESS-TOKEN]"
```

The CLI saves the token locally. The Python client reads `CWSANDBOX_API_KEY` instead.

To enable a runner on another cluster, choose a runner ID and start the creation wizard:

```bash theme={"system"}
cwic sandbox runner create [RUNNER-ID]
```

Select your cluster and release channel, then review the runner configuration and policy in the editor before submitting.

Check the runner's status:

```bash theme={"system"}
cwic sandbox runner get [RUNNER-ID]
```

Wait for `INSTALL` to show `READY` and `CONN` to show `CONNECTED`. For REST API examples and deployment troubleshooting, see [Deploy and manage a runner](/products/sandboxes/operations/managed-runners).

## Optional: Customize the sandbox policy

The runner's policy applies to sandboxes scheduled by that runner. Save this example as `policy.json`. It supplies CPU and memory defaults, limits resource requests, and leaves the default egress list empty. The lifetime default is 15 minutes. It isn't a maximum.

```json title="policy.json" theme={"system"}
{
  "displayName": "default",
  "constraints": {
    "resources": {
      "defaultCpu": "1",
      "defaultMemory": "2Gi",
      "maxCpu": "4",
      "maxMemory": "8Gi",
      "requireLimits": true
    },
    "network": {
      "defaultEgress": []
    },
    "security": {
      "allowPrivileged": false,
      "allowedRuntimeClasses": ["kata-qemu"],
      "defaultCpuRuntimeClass": "kata-qemu"
    },
    "lifecycle": { "defaultLifetimeSeconds": 900 }
  }
}
```

Apply it to the runner you enabled, then inspect the saved policy:

```bash theme={"system"}
cwic sandbox runner policy edit [RUNNER-ID] -f policy.json
cwic sandbox runner policy describe [RUNNER-ID]
```

This example replaces the runner's policy. For an existing shared runner, coordinate changes with its administrator. To restrict which outbound destinations users can request, configure `allowedEgress`. The `defaultEgress` field alone sets defaults. See [Configure a sandbox policy](/products/sandboxes/profiles/configure).

## Optional: Disable the runner

Keep the runner enabled to create more sandboxes. When you no longer need it, stop its running sandboxes, then disable it using either interface:

<Tabs>
  <Tab title="Cloud console">
    1. Open your cluster's **Sandbox runner** card.
    2. Click **Disable sandbox runner** and confirm.
  </Tab>

  <Tab title="CLI">
    ```bash theme={"system"}
    cwic sandbox runner delete [RUNNER-ID]
    ```

    Confirm the deletion when prompted.
  </Tab>
</Tabs>

Disabling the runner removes it from the cluster. To use sandboxes there again, enable a runner.

## Next steps

Explore the following guides:

* [Configure a sandbox policy](/products/sandboxes/profiles/configure): customize resources, network access, and security settings.
* [Deploy and manage a runner](/products/sandboxes/operations/managed-runners): inspect, update, and troubleshoot runners.
* [Sandbox placement and spillover](/products/sandboxes/placement): fall back between CKS and serverless capacity.
* [Python client](/products/sandboxes/client): execute commands, work with files, and manage sandbox lifecycles.


## Related topics

- [About CoreWeave sandboxes](/products/sandboxes.md)