Safeguard
Developer Tools•

OpenAI Code Interpreter containers: memory, expiry and files

How OpenAI's Code Interpreter tool uses sandboxed containers: auto versus explicit mode, 1g to 64g memory, the 20 minute expiry and file handling.

Safeguard Security Team
3 min read

OpenAI's Code Interpreter lets a model write and run Python in a sandboxed environment for data analysis, coding and math. Every use needs a container, a fully sandboxed virtual machine that holds uploaded or generated files. A container expires after 20 minutes of no use, so treat it as temporary.

What the tool does

Per the API documentation, the model can process files, generate files and graphs, iterate on failing code and manipulate images. The model refers to it as the python tool. It is available through the Responses, Chat Completions and Assistants APIs.

Two ways to get a container

  • Auto mode: pass a container config with type auto. The API creates a container or reuses an active one from a previous call. Optional fields include a memory limit and file IDs.
  • Explicit mode: create a container through the containers endpoint, then pass its ID.

Memory

Options are 1g (default), 4g, 16g and 64g. Higher tiers are billed at the built-in tools rates for Code Interpreter. The memory limit applies for the container's entire life. The page does not list per-unit prices, so check the pricing page for current figures.

Expiry

A container expires if not used for 20 minutes. After that, requests fail, metadata remains viewable, and the data is discarded and unrecoverable. Expired containers cannot be reactivated, and in-memory state such as Python objects is lost. Any container operation resets the last active time. The docs recommend treating containers as ephemeral and storing related data on your own systems.

Files

Files in model input are automatically uploaded to the container. Files the model creates appear as annotations with the container ID, file ID and filename, and you download them through the container file endpoints. Supported formats include CSV, JSON, PDF, DOCX, PPTX, XLSX, Markdown, source code, images and archives.

Limits and data controls

The page gives a rate limit of 100 requests per minute per organization and states that Zero Data Retention and data residency are supported.

Design implications

Save outputs as soon as they are produced. Do not store anything in a container that you cannot regenerate. Keep file uploads to what the task needs, since uploaded files sit in a virtual machine the model controls.

Compare this with consumer features such as Claude file creation, which run in a different product with different rules.

Safeguard offers a free scan at gold.safeguard.sh/scan.

When to use explicit containers

Auto mode is the simple path. An explicit container makes sense when several requests should share files, since you control the container's ID and can add files through the container file endpoints. Either way, remember the 20 minute idle expiry: a long pause in a workflow means re-uploading files and recreating state. Build your code so a fresh container is a normal event, not an error.

Quick check

How long does a container last?

It expires if it is not used for 20 minutes. Any container operation resets the timer.

Can I raise the memory later?

No. The memory limit applies for the container's entire life.

Sources

Last reviewed: 19 October 2026.

Never miss an update

Weekly insights on software supply chain security, delivered to your inbox.

Self-healing security runs on Safeguard.

Your first fix PR is minutes away.

No sales call required, even your agent can complete the purchase over MCP.