Cloud buckets - E2B Docs

To connect a bucket for storing data from the sandbox, we will use the FUSE file system to mount the bucket to the sandbox. You will need to create a custom sandbox template with the FUSE file system installed. The guide for building a custom sandbox template can be found here.

Google Cloud Storage

Prerequisites

To use Google Cloud Storage, you’ll need a bucket and a service account. You can create a service account here and a bucket here. If you want to write to the bucket, make sure the service account has the Storage Object User role for this bucket. You can find a guide on creating a service account key here.

Mounting the bucket

To use the Google Cloud Storage we need to install the gcsfuse package. There’s simple template that can be used to create a container with the gcsfuse installed.

const template = Template()
  .fromTemplate("code-interpreter-v1")
  .aptInstall(["gnupg", "lsb-release"])
  .runCmd("lsb_release -c -s > /tmp/lsb_release")
  .runCmd(
    'GCSFUSE_REPO=$(cat /tmp/lsb_release) && echo "deb [signed-by=/usr/share/keyrings/cloud.google.asc] https://packages.cloud.google.com/apt gcsfuse-$GCSFUSE_REPO main" | sudo tee /etc/apt/sources.list.d/gcsfuse.list',
  )
  .runCmd(
    "curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo tee /usr/share/keyrings/cloud.google.asc",
  )
  .aptInstall(["gcsfuse"])

template = (
    Template()
    .from_template("code-interpreter-v1")
    .apt_install(["gnupg", "lsb-release"])
    .run_cmd("lsb_release -c -s > /tmp/lsb_release")
    .run_cmd(
        'GCSFUSE_REPO=$(cat /tmp/lsb_release) && echo "deb [signed-by=/usr/share/keyrings/cloud.google.asc] https://packages.cloud.google.com/apt gcsfuse-$GCSFUSE_REPO main" | sudo tee /etc/apt/sources.list.d/gcsfuse.list'
    )
    .run_cmd(
        "curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo tee /usr/share/keyrings/cloud.google.asc"
    )
    .apt_install(["gcsfuse"])
)

The bucket is mounted during the sandbox runtime using the gcsfuse command.

import { Sandbox } from 'e2b'

const sandbox = await Sandbox.create('<your template id>')
await sandbox.files.makeDir('/home/user/bucket')
await sandbox.files.write('key.json', '<your service account key>')

await sandbox.commands.run('sudo gcsfuse <flags> --key-file /home/user/key.json <bucket-name> /home/user/bucket')

from e2b import Sandbox

sandbox = Sandbox.create("<your template id>")
sandbox.files.make_dir("/home/user/bucket")
sandbox.files.write("key.json", "<your key file content>")

output = sandbox.commands.run(
    "sudo gcsfuse <flags> --key-file /home/user/key.json <bucket-name> /home/user/bucket"
)

Flags

The complete list of flags is available here.

Allow the default user to access the files

To allow the default user to access the files, we can use the following flags:

-o allow_other -file-mode=777 -dir-mode=777

Amazon S3

To use Amazon S3, we can use the s3fs package. The template setup is similar to that of Google Cloud Storage.

const template = Template()
  .fromImage("ubuntu:latest")
  .aptInstall(["s3fs"])

template = (
    Template()
    .from_image("ubuntu:latest")
    .apt_install(["s3fs"])
)

Similar to Google Cloud Storage, the bucket is mounted during the runtime of the sandbox. The s3fs command is used to mount the bucket to the sandbox.

import { Sandbox } from 'e2b'

const sandbox = await Sandbox.create('<your template id>')
await sandbox.files.makeDir('/home/user/bucket')

// Create a file with the credentials
// If you use another path for the credentials you need to add the path in the command s3fs command
await sandbox.files.write('/root/.passwd-s3fs', '<AWS_ACCESS_KEY_ID>:<AWS_SECRET_ACCESS_KEY>')
await sandbox.commands.run('sudo chmod 600 /root/.passwd-s3fs')

await sandbox.commands.run('sudo s3fs <flags> <bucket-name> /home/user/bucket')

from e2b import Sandbox

sandbox = Sandbox.create("<your template id>")
sandbox.files.make_dir("/home/user/bucket")

# Create a file with the credentials
# If you use another path for the credentials you need to add the path in the command s3fs command
sandbox.files.write("/root/.passwd-s3fs", "<AWS_ACCESS_KEY_ID>:<AWS_SECRET_ACCESS_KEY>")
sandbox.commands.run("sudo chmod 600 /root/.passwd-s3fs")

sandbox.commands.run("sudo s3fs <flags> <bucket-name> /home/user/bucket")

Flags

The complete list of flags is available here.

Allow the default user to access the files

To allow the default user to access the files, add the following flag:

-o allow_other

Cloudflare R2

For Cloudflare R2, we can use a setup very similar to S3. The template remains the same as for S3. However, the mounting differs slightly; we need to specify the endpoint for R2.

import { Sandbox } from 'e2b'

const sandbox = await Sandbox.create({ template: '<your template id>' })
await sandbox.files.makeDir('/home/user/bucket')

// Create a file with the R2 credentials
// If you use another path for the credentials you need to add the path in the command s3fs command
await sandbox.files.write('/root/.passwd-s3fs', '<R2_ACCESS_KEY_ID>:<R2_SECRET_ACCESS_KEY>')
await sandbox.commands.run('sudo chmod 600 /root/.passwd-s3fs')

await sandbox.commands.run('sudo s3fs -o url=https://<ACCOUNT ID>.r2.cloudflarestorage.com <flags> <bucket-name> /home/user/bucket')

from e2b import Sandbox

sandbox = Sandbox.create("<your template id>")
sandbox.files.make_dir("/home/user/bucket")

# Create a file with the R2 credentials
# If you use another path for the credentials you need to add the path in the command s3fs command
sandbox.files.write("/root/.passwd-s3fs", "<R2_ACCESS_KEY_ID>:<R2_SECRET_ACCESS_KEY>")
sandbox.commands.run("sudo chmod 600 /root/.passwd-s3fs")

sandbox.commands.run(
    "sudo s3fs -o url=https://<ACCOUNT ID>.r2.cloudflarestorage.com <flags> <bucket-name> /home/user/bucket"
)

Flags

It’s the same as for S3.

Azure Blob Storage

Prerequisites

To use Azure Blob Storage, you’ll need a storage account and a container. The container must exist before you mount it. You can authenticate with the storage account access key or with a shared access signature (SAS) token for the container. Give the SAS token read and list permissions, plus write permission if you want to write files. Without list permission the mount fails.

Mounting the container

To mount the container, install Microsoft’s blobfuse2 package from the Microsoft package repository in a template.

const template = Template()
  .fromImage("ubuntu:24.04")
  .aptInstall(["wget", "ca-certificates"])
  .runCmd(
    "wget -q https://packages.microsoft.com/config/ubuntu/24.04/packages-microsoft-prod.deb -O /tmp/packages-microsoft-prod.deb && sudo dpkg -i /tmp/packages-microsoft-prod.deb",
  )
  .aptInstall(["fuse3", "blobfuse2"])

template = (
    Template()
    .from_image("ubuntu:24.04")
    .apt_install(["wget", "ca-certificates"])
    .run_cmd(
        "wget -q https://packages.microsoft.com/config/ubuntu/24.04/packages-microsoft-prod.deb -O /tmp/packages-microsoft-prod.deb && sudo dpkg -i /tmp/packages-microsoft-prod.deb"
    )
    .apt_install(["fuse3", "blobfuse2"])
)

blobfuse2 reads its settings from a config file. Replace the placeholders with your storage account name, container name and access key.

blobfuse2.yaml

allow-other: true

logging:
  type: silent

components:
  - libfuse
  - block_cache
  - attr_cache
  - azstorage

block_cache:
  block-size-mb: 16
  mem-size-mb: 256
  prefetch: 11
  path: /tmp/blobfuse2-cache
  disk-size-mb: 4096

azstorage:
  type: block
  account-name: <storage-account-name>
  container: <container-name>
  mode: key
  account-key: "<storage-account-key>"

mem-size-mb is the memory blobfuse2 reserves for its block cache. Keep it below the sandbox’s memory. It must be at least prefetch times block-size-mb (176 MB here), or the mount fails. prefetch is set explicitly because its default grows with the number of vCPUs. disk-size-mb caps the disk space the block cache may use under path. The container is mounted during the sandbox runtime using the blobfuse2 mount command.

import { Sandbox } from 'e2b'

const sandbox = await Sandbox.create('<your template id>')
await sandbox.files.makeDir('/home/user/bucket')
await sandbox.files.write('/home/user/blobfuse2.yaml', '<your config file content>')
// The config file contains your credentials, so make it readable only by its owner
await sandbox.commands.run('chmod 600 /home/user/blobfuse2.yaml')

await sandbox.commands.run('sudo blobfuse2 mount /home/user/bucket --config-file=/home/user/blobfuse2.yaml')

from e2b import Sandbox

sandbox = Sandbox.create("<your template id>")
sandbox.files.make_dir("/home/user/bucket")
sandbox.files.write("/home/user/blobfuse2.yaml", "<your config file content>")
# The config file contains your credentials, so make it readable only by its owner
sandbox.commands.run("chmod 600 /home/user/blobfuse2.yaml")

sandbox.commands.run(
    "sudo blobfuse2 mount /home/user/bucket --config-file=/home/user/blobfuse2.yaml"
)

To unmount the container, run sudo blobfuse2 unmount /home/user/bucket.

Authenticate with a SAS token

To use a SAS token instead of the access key, replace the mode and account-key lines in the config file with:

  mode: sas
  sas: "<sas-token>"

Options

For the full list of config options, see advancedConfig.yaml in the azure-storage-fuse repository.

Allow the default user to access the files

The container is mounted with sudo, so only root can access it by default. The allow-other: true line in the config file lets the default user read and write the files.

​Google Cloud Storage

​Prerequisites

​Mounting the bucket

​Flags

​Allow the default user to access the files

​Amazon S3

​Flags

​Allow the default user to access the files

​Cloudflare R2

​Flags

​Azure Blob Storage

​Prerequisites

​Mounting the container

​Authenticate with a SAS token

​Options

​Allow the default user to access the files

Google Cloud Storage

Prerequisites

Mounting the bucket

Flags

Allow the default user to access the files

Amazon S3

Flags

Allow the default user to access the files

Cloudflare R2

Flags

Azure Blob Storage

Prerequisites

Mounting the container

Authenticate with a SAS token

Options

Allow the default user to access the files