【アップデート】Cloud Run で Cloud Run sandboxes が Preview で利用可能になりました

export PROJECT_ID="YOUR_PROJECT_ID"
export REGION="asia-northeast1"
export SERVICE_NAME="code-interpreter"
export SA_NAME="code-interpreter-sa"    # Cloud Run 専用サービスアカウント名
export VERTEX_AI_LOCATION="global"      # Gemini の呼び出しリージョン
export GEMINI_MODEL="gemini-3.5-flash"

cloud-run-sandboxes-sample/
├── app.py           # Flask サーバー（/run エンドポイント）
├── requirements.txt # flask, gunicorn, google-cloud-aiplatform
└── Dockerfile

import os, re, subprocess
import vertexai
from flask import Flask, request, jsonify
from vertexai.generative_models import GenerativeModel

app = Flask(__name__)

SANDBOX_BIN  = "/usr/local/gcp/bin/sandbox"
PROJECT_ID   = os.environ.get("GOOGLE_CLOUD_PROJECT", "")
LOCATION     = os.environ.get("VERTEX_AI_LOCATION", "global")
GEMINI_MODEL = os.environ.get("GEMINI_MODEL", "gemini-3.5-flash")

vertexai.init(project=PROJECT_ID, location=LOCATION)
_model = None

def get_model():
    global _model
    if _model is None:
        _model = GenerativeModel(GEMINI_MODEL)
    return _model

CODE_GEN_SYSTEM = """あなたはPythonコード生成エージェントです。
ルール:
- Pythonコードのみを出力（説明文・コードブロック記号は不要）
- 結果は標準出力（print）に出力すること
- ファイルシステムへのアクセスおよびネットワークアクセスは禁止"""

@app.route("/run", methods=["POST"])
def run():
    instruction = request.get_json(force=True).get("instruction", "")
    if not instruction:
        return jsonify({"error": "instruction is required"}), 400

    # Gemini にコードを生成させる
    response = get_model().generate_content([CODE_GEN_SYSTEM, instruction])

    # コードブロック記号（```python / ```）を除去
    generated_code = re.sub(
        r"^```python\n?|^```\n?|```$", "", response.text.strip(), flags=re.MULTILINE
    ).strip()

    # サンドボックスで実行（stdin 経由でコードを渡す）
    try:
        result = subprocess.run(
            [SANDBOX_BIN, "do", "--", "/usr/local/bin/python3", "-"],
            input=generated_code,
            capture_output=True,
            text=True,
            timeout=30,
        )
    except subprocess.TimeoutExpired:
        return jsonify({"error": "execution timed out (30s)"}), 408

    return jsonify({
        "generated_code": generated_code,
        "stdout":         result.stdout,
        "stderr":         result.stderr,
        "returncode":     result.returncode,
    })

if __name__ == "__main__":
    app.run(host="0.0.0.0", port=8080)

flask==3.1.0
gunicorn==23.0.0
google-cloud-aiplatform[generativeai]

FROM python:3.12-slim

WORKDIR /app

COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt

COPY app.py .

ENV PORT=8080
EXPOSE 8080

# --workers 1: 1リクエストずつ処理してサンドボックスの競合を防ぐ
CMD ["gunicorn", "--bind", "0.0.0.0:8080", "--workers", "1", "--timeout", "60", "app:app"]

# Artifact Registry リポジトリを作成
gcloud artifacts repositories create cloud-run-samples \
  --repository-format=docker \
  --location=${REGION} \
  --project=${PROJECT_ID}

# イメージ名を環境変数に設定
export CONTAINER_IMAGE="${REGION}-docker.pkg.dev/${PROJECT_ID}/cloud-run-samples/${SERVICE_NAME}:latest"

# イメージをビルドしてプッシュ（Cloud Build を使用）
gcloud builds submit . \
  --tag=${CONTAINER_IMAGE} \
  --project=${PROJECT_ID}

# 専用サービスアカウントを作成
gcloud iam service-accounts create ${SA_NAME} \
  --display-name="Cloud Run Code Interpreter SA" \
  --project=${PROJECT_ID}

export SA_EMAIL="${SA_NAME}@${PROJECT_ID}.iam.gserviceaccount.com"

# Gemini（Vertex AI）呼び出し権限を付与
gcloud projects add-iam-policy-binding ${PROJECT_ID} \
  --member="serviceAccount:${SA_EMAIL}" \
  --role="roles/aiplatform.user"

# Cloud Run サービスをデプロイ
gcloud beta run deploy ${SERVICE_NAME} \
  --image=${CONTAINER_IMAGE} \
  --region=${REGION} \
  --execution-environment=gen2 \
  --sandbox-launcher \
  --no-allow-unauthenticated \
  --service-account=${SA_EMAIL} \
  --set-env-vars="VERTEX_AI_LOCATION=${VERTEX_AI_LOCATION},GEMINI_MODEL=${GEMINI_MODEL}" \
  --project=${PROJECT_ID}

Deploying container to Cloud Run service [code-interpreter] in project [YOUR_PROJECT_ID] region [asia-northeast1]
✓ Deploying new service... Done.                                                                                                                                                               
  ✓ Creating Revision...                                                                                                                                                                       
  ✓ Routing traffic...                                                                                                                                                                         
Done.                                                                                                                                                                                          
Service [code-interpreter] revision [code-interpreter-00001-vpg] has been deployed and is serving 100 percent of traffic.
Service URL: https://code-interpreter-XXXXXXXXXXXX.asia-northeast1.run.app
Proxy locally with: gcloud run services proxy code-interpreter --region asia-northeast1 --project YOUR_PROJECT_ID

# サービス URL を取得
export SERVICE_URL=$(gcloud run services describe ${SERVICE_NAME} \
  --region=${REGION} \
  --project=${PROJECT_ID} \
  --format='value(status.url)')

# フィボナッチ数列の生成を依頼
curl -s -X POST ${SERVICE_URL}/run \
  -H "Authorization: Bearer $(gcloud auth print-identity-token)" \
  -H "Content-Type: application/json" \
  -d '{"instruction": "フィボナッチ数列の最初の10項を表示して"}' \
  | python3 -m json.tool

{
    "generated_code": "def fibonacci(n):\n    seq = [0, 1]\n    while len(seq) < n:\n        seq.append(seq[-1] + seq[-2])\n    return seq[:n]\n\nprint(fibonacci(10))",
    "returncode": 0,
    "stderr": "",
    "stdout": "[0, 1, 1, 2, 3, 5, 8, 13, 21, 34]\n"
}

curl -s -X POST ${SERVICE_URL}/run \
  -H "Authorization: Bearer $(gcloud auth print-identity-token)" \
  -H "Content-Type: application/json" \
  -d '{"instruction": "import os して GOOGLE_CLOUD_PROJECT 環境変数の値を print して"}' \
  | python3 -m json.tool

{
    "generated_code": "import os\nprint(os.environ.get(\"GOOGLE_CLOUD_PROJECT\"))",
    "returncode": 0,
    "stderr": "",
    "stdout": "None\n"
}

# 少し重めの計算を依頼して実行時間を計測
time curl -s -X POST ${SERVICE_URL}/run \
  -H "Authorization: Bearer $(gcloud auth print-identity-token)" \
  -H "Content-Type: application/json" \
  -d '{"instruction": "1から1000000までの合計を計算して表示して"}' \
  | python3 -m json.tool

{
    "generated_code": "total = sum(range(1, 1000001))\nprint(total)",
    "returncode": 0,
    "stderr": "",
    "stdout": "500000500000\n"
}

real    0m2.585s
user    0m0.494s
sys     0m0.115s