Cloud Run Sandboxes Reach Public Preview
Google Cloud announced the public preview of Cloud Run sandboxes, a native runtime for executing untrusted code and AI-agent-generated workloads directly inside a Cloud Run service instance. Rather than standing up a separate container-cluster sandboxing system or bolting on a specialist microVM service, developers enable sandboxing with a single deployment flag, and Cloud Run mounts a lightweight sandbox CLI binary into the execution environment automatically.
Under the hood, isolation is layered: each Cloud Run instance already runs as its own microVM, and the sandbox adds a nested gVisor (runsc) layer between the application and any user-supplied code it executes, so a compromised or misbehaving sandboxed process can't reach the host application, its credentials, or stored data. Cloud Run sandboxes start in milliseconds, which matters for the target use case — AI coding agents and code-interpreter-style features that need to run generated code on demand without the cold-start penalty of spinning up a dedicated sandbox service per request.
This lands squarely in the same problem space Docker Sandboxes and similar tools address for local and CI environments — isolating agent-executed code from production credentials and infrastructure — but built natively into Cloud Run's request-serving model.
Read more — Google Cloud Blog
Cloud Run Adds Direct Deploys from GitHub Container Registry
Cloud Run reached general availability for importing public container images directly from GitHub Container Registry (ghcr.io) on July 14, 2026. Previously, deploying a GHCR-hosted image to Cloud Run meant an intermediate step — pulling the image and re-pushing it to Artifact Registry, or configuring a proxy — before Cloud Run could deploy it. With this GA release, GHCR joins Artifact Registry and Docker Hub as a directly supported deployment source.
For teams that build and publish images through GitHub Actions and already push to GHCR as part of their CI pipeline, this removes a deployment step and one more piece of intermediate infrastructure to maintain, letting gcloud run deploy --image ghcr.io/... work without a registry-mirroring step in between.
Read more — Google Cloud Documentation
AWS Ships One-Click Coding Agent Setup for Lambda, GPT-5.6 on Bedrock
AWS's July 20 weekly roundup introduced a one-click Lambda setup prompt that configures a coding agent with AWS Serverless skills and the Serverless Model Context Protocol (MCP) server in a single step. Developers trigger it from the Lambda console's "Copy agent prompt" button, or by fetching the setup documentation directly, and it works across a wide range of agent platforms — Claude Code, Kiro, Cursor, GitHub Copilot, Codex, Devin Desktop, and OpenCode are all explicitly supported. This targets a specific friction point: getting a coding agent correctly wired up with the right serverless context and MCP tooling has historically required manual configuration per-agent.
The same roundup confirmed three new OpenAI models — Sol, Terra, and Luna — are now available on Amazon Bedrock, spanning capability tiers from flagship reasoning (Sol) through balanced performance (Terra) to fast, cost-efficient inference (Luna), all reachable through Bedrock's Responses API alongside AWS's existing model catalog.
Other notable items from the roundup: S3 now supports same-day transitions to the Standard-IA and One Zone-IA storage classes, down from a previous 30-day minimum, offering up to 40% cost savings for data that becomes infrequently accessed sooner than expected; and Amazon SQS marked its 20th anniversary as one of AWS's original launch services.
Read more — AWS News Blog
