sandbox: add gvisor runsc-based sandbox

This creates a VM (running Container-Optimized OS) with configuration
such that it boots up and downloads/configures the runsc Docker
runtime, reloading the existing Docker daemon on the VM, and then
creates a new privileged Docker container with the host's
/var/run/docker.sock available to the container. From within that
container it's then possible for the new sandbox HTTP server to create
its own Docker containers running under gvisor (using docker run

This then adds a regional us-central1 load balancer and instance group
manager & instane template to run these VMs automatically across
us-central1. Then the frontend can hit that URL

Fixes golang/go#25224
Updates golang/go#30439 (remove nacl)
Updates golang/go#33629 (this CL makes the playground support 2 versions)

Change-Id: I56c8a86875abcde9d29fa7592b23c0ecd3861458
Run-TryBot: Brad Fitzpatrick <>
Reviewed-by: Alexander Rakoczy <>
Reviewed-by: Emmanuel Odeke <>
18 files changed
tree: 98dd7620acf86ec72ae755dc7724de077214e7bc
  1. cmd/
  2. deploy/
  3. sandbox/
  4. static/
  5. .gitignore
  6. app.yaml
  8. cache.go
  9. client.go
  10. codereview.cfg
  13. Dockerfile
  14. edit.go
  15. edit.html
  16. enable-fake-time.patch
  17. fake_fs.lst
  18. fmt.go
  19. fmt_test.go
  20. go.mod
  21. go.sum
  23. logger.go
  24. main.go
  25. Makefile
  27. play.go
  28. play_test.go
  30. sandbox.go
  31. server.go
  32. server_test.go
  33. share.go
  34. store.go
  35. tests.go
  36. txtar.go
  37. txtar_test.go
  38. vet.go


This subrepository holds the source for the Go playground:


# build the image
docker build -t playground .


docker run --name=play --rm -p 8080:8080 golang/playground &
# run some Go code
cat /path/to/code.go | go run client.go | curl -s --upload-file - localhost:8080/compile


Deployment Triggers

Playground releases automatically triggered when new Go repository tags are pushed to GitHub, or when master is pushed on the playground repository.

For details, see deploy/go_trigger.json, deploy/playground_trigger.json, and deploy/deploy.json.

After making changes to trigger configuration, update configuration by running the following Make target:

make update-cloudbuild-trigger

Deploy via Cloud Build

The Cloud Build configuration will always build and deploy with the latest supported release of Go.

gcloud builds submit --config deploy/deploy.json .

Deploy via gcloud app deploy

Building the playground Docker container takes more than the default 10 minute time limit of cloud build, so increase its timeout first (note, app/cloud_build_timeout is a global configuration value):

gcloud config set app/cloud_build_timeout 1200  # 20 mins

Alternatively, to avoid Cloud Build and build locally:

make docker
docker tag golang/playground:latest
docker push
gcloud --project=golang-org app deploy app.yaml


gcloud --project=golang-org app deploy app.yaml


To submit changes to this repository, see