Lupin vs Cloudflare Sandboxes: direct execution primitives or a managed resource API

Name the Cloudflare execution environment first

Cloudflare’s current Sandboxes documentation describes two environments: Containers for a full Linux environment and Dynamic Workers for isolated code running through the Workers runtime. The application Worker controls what data and APIs the code receives and its network access. Lupin’s public hosted container API is a separate integration backed by its configured hosted provider; the optional Cloudflare execution backend of Lupin’s consumer agent is not the same API. Comparing the names alone would hide these important deployment and control boundaries.

Direct infrastructure is a valid choice

If your application already runs on Workers and needs precise control over how untrusted code reaches application APIs, Cloudflare’s primitives are a strong candidate. They let the application define the execution boundary as part of its own architecture. Lupin provides a resource API with workspace ownership, usage checks and other agent products around it. That can remove platform integration work, but it does not expose every lower-level provider control. Choose direct Cloudflare when those controls are central rather than assuming a higher-level API is always simpler.

Full Linux and isolated modules are different requirements

A task requiring system packages, a shell and a long-running process belongs in a different category from a small transformation that only calls supplied application methods. Cloudflare explicitly distinguishes those cases in its current documentation. Lupin containers expose synchronous commands and file operations, so evaluate them against the full-environment requirement rather than a Dynamic Worker module. List the language, dependencies, process lifetime, filesystem behavior and outbound access needed by the task. Select the smallest suitable execution boundary only after those requirements are concrete.

Your Worker or platform still owns authority

An isolated environment can use everything you intentionally place inside it. With direct Cloudflare, design the methods and data exposed by the Worker and control network access explicitly. With Lupin, minimize supplied secrets and files, protect temporary shell URLs and authenticate any public service endpoint. Lupin’s current API exposes port publication but no port revocation or container deletion, so strict teardown requirements may favor a different surface. Its autonomous registration does not enable paid execution, and hosted sandbox runtime is absent from the Free plan.

Include the platform work in the cost boundary

Compare current Cloudflare environment and plan terms with the runtime, storage and platform responsibilities of your design. A direct integration includes your own resource registry, access policy, usage reconciliation and operator interface. Lupin includes a shared resource model but has a narrower command and file surface, including roughly 2 MB base64 transfers. Direct Cloudflare may be preferable for a Workers-native product with exact execution controls. Lupin may be preferable when execution is one bounded resource among email, browsers and connected apps, provided its current limitations fit the workload.

Prototype the authority boundary before the command

Write a fixture containing one allowed computation, one denied external request and one attempt to access data outside the task. Specify the expected behavior without using real credentials. Evaluate the appropriate Cloudflare environment and Lupin’s container contract against that boundary, then use approved test capacity for execution. Prefer Cloudflare for application-owned execution primitives and low-level control; prefer Lupin for the shared agent resource layer when its exposed operations suffice. Do not infer equivalent isolation, network policy or persistence merely because both options use the word sandbox.

Switching from direct Cloudflare primitives to Lupin requires relocating Worker-owned policies and resource bookkeeping into the application or supported platform controls. Preserve code and fixtures, but recreate bindings, credentials and execution environments deliberately. A Dynamic Worker module may require a different design rather than a container migration.

Sources & verification

Official documentation and Lupin public documentation/source were reviewed on 2026-11-05. This is an architecture and operating-scope comparison, not a live benchmark, hands-on provider test or independent review of service quality.

• Cloudflare Sandboxes overview ↗Checked 2026-11-05
• Lupin sandboxes documentation ↗Checked 2026-11-05
• Lupin bounded agent registration ↗Checked 2026-11-05

Prepared with AI assistance by Lupin editorial. How we research and maintain these guides.