Supported packages
The sandbox runs Python 3.12 with the full standard library plus a curated, version-pinned package set baked into the runtime image. Nothing else is importable — and that is a security property, not a missing feature.
The package set
| package | version | use for |
|---|---|---|
numpy | 2.1.3 | numerical arrays |
pandas | 2.2.3 | dataframes |
pyyaml | 6.0.2 | YAML parsing (import yaml) |
python-dateutil | 2.9.0.post0 | date parsing (import dateutil) |
orjson | 3.10.12 | fast JSON |
jinja2 | 3.1.4 | templating |
markdown | 3.7 | Markdown → HTML |
beautifulsoup4 | 4.12.3 | HTML parsing (import bs4) |
pillow | 11.0.0 | image processing (import PIL) |
cryptography | 44.0.0 | hashing, HMAC, symmetric/asymmetric crypto |
pydantic | 2.10.3 | data validation |
Declare what you use in the deploy request (both pip names and import names are accepted, e.g. bs4 or beautifulsoup4). An unsupported package is refused at deploy time with a clear 422 unsupported_package — turning what would be a guaranteed runtime ImportError into an immediate message. At most 16 packages per function.
# declare packages when deploying a version:
{"source": "…", "entrypoint": "main", "packages": ["numpy", "pandas"]}Why there is no HTTP client
requests, httpx and aiohttp are deliberately absent, and stdlib network modules (socket, http, urllib) are rejected by the validator. The sandbox container is started with --network none: there is no network interface inside it at all, so an HTTP client would have nothing to talk to. The only outbound path is animica.http.fetch, which the host performs on your behalf — https-only, SSRF-guarded (private/loopback/internal targets blocked, DNS re-checked at request time, redirects not followed), size-capped and metered as egress. See Security.
Why pip at runtime is impossible
pip install needs the network, and the sandbox has none — by construction, not by policy. The validator additionally rejects pip/setuptools/distutils imports at deploy time so the failure is explained early. Packages exist in exactly one place: the runtime image (sandbox/Dockerfile), where they are version-pinned so every function on the platform runs the same audited set. The pinned versions are part of the canonical artifact manifest that gets anchored on-chain with your deployment.
Blocked stdlib modules
The deploy-time validator refuses modules that cannot work in the sandbox or only make sense as an attack, with the reason in the finding:
- No network:
socket,socketserver,http,urllib,ftplib,smtplib,telnetlib - No subprocesses / native access:
subprocess,ctypes,multiprocessing,fcntl,mmap,pty,tty - Runtime integrity:
resource(limits are platform-enforced),pdb,asyncio(unsupported by the ABI),eval/exec/compile/__import__as calls, and sandbox-escape attribute patterns like__subclasses__/__globals__
Everything else in the standard library — json, re, math, statistics, datetime, hashlib, base64, csv, collections, itertools, decimal, random, time, … — works normally.