Run Expo in a sandbox

Run an Expo (React Native / Web) application inside a Blaxel sandbox and expose it securely through preview URLs with step-by-step setup.

This tutorial explains how to run an Expo (React Native / Web) application inside a Blaxel sandbox and expose it securely using sandbox preview URLs.

Prerequisites

• Blaxel CLI installed and authenticated (bl login)
• Node.js 18+ installed
• @blaxel/core package installed in your project (npm install @blaxel/core)

Architecture overview

Running Expo inside a Blaxel sandbox requires a few adjustments:

1. Injecting the preview URL into app.json
2. Setting EXPO_PACKAGER_PROXY_URL to force Expo to proxy assets through the preview URL
3. Restarting the dev server after configuration changes
4. Exposing the Expo dev server via a Blaxel preview URL

Create a base sandbox image

Dockerfile

FROM node:22-alpine

RUN apk update && apk add --no-cache \
  git \
  curl \
  netcat-openbsd \
  && rm -rf /var/cache/apk/*

WORKDIR /app

COPY --from=ghcr.io/blaxel-ai/sandbox:latest /sandbox-api /usr/local/bin/sandbox-api

# Create Expo project with default template
RUN npx create-expo-app@latest .

# Install web dependencies and expo-asset for asset loading support
RUN npx expo install react-dom react-native-web expo-asset

# Patch expo-asset: it hardcodes http:// when constructing asset URLs
# from the manifest's debuggerHost. Behind the Blaxel HTTPS proxy,
# Android's native downloader can't follow the HTTP→HTTPS redirect,
# so fonts and images fail to load. Force https://.
RUN sed -i "s|'http://' + manifest2.extra.expoGo.debuggerHost|'https://' + manifest2.extra.expoGo.debuggerHost|g" \
    node_modules/expo-asset/build/AssetSources.js

# Pre-warm Metro bundler cache by starting the dev server briefly
# This warms up the cache better than export since it matches actual dev usage
RUN timeout 120 npx expo start --web --port 8081 --no-dev-client 2>/dev/null || true

# Expose port for Expo web
EXPOSE 8081

# Add npm global modules to PATH
ENV PATH="/usr/local/bin:$PATH"

ENTRYPOINT ["/usr/local/bin/sandbox-api"]

blaxel.toml

Create a blaxel.toml file in the same directory as your Dockerfile:

type = "sandbox"
name = "expo-template"

[runtime]
memory = 8096

[[runtime.ports]]
name = "expo-web"
target = 8081

Deploy the sandbox image

Deploy the image by running:

bl deploy

Create or reuse a sandbox

Create a sandbox from the base image:

import { SandboxInstance } from "@blaxel/core";

const sandboxName = "my-expo-sandbox";

const sandbox = await SandboxInstance.createIfNotExists({
  name: sandboxName,
  labels: {
    framework: "expo",
  },
  image: "expo-template:latest",
  memory: 8096,
});

Configure CORS for preview URL access

Expo servers require permissive CORS headers when accessed through a preview URL:

const responseHeaders = {
  "Access-Control-Allow-Origin": "*",
  "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS, PATCH",
  "Access-Control-Allow-Headers":
    "Content-Type, Authorization, X-Requested-With, X-Blaxel-Workspace, X-Blaxel-Preview-Token, X-Blaxel-Authorization",
  "Access-Control-Allow-Credentials": "true",
  "Access-Control-Expose-Headers": "Content-Length, X-Request-Id",
  "Access-Control-Max-Age": "86400",
  Vary: "Origin",
};

Alternatively, you can use custom domains to expose previews on your own domain.

Create the preview URL

Expo runs on port 8081, so expose that port via a preview URL:

const preview = await sandbox.previews.createIfNotExists({
  metadata: { name: "dev-server-preview" },
  spec: {
    responseHeaders,
    // Must be public for Android scenarios: Expo Go on Android doesn't forward the auth
    // cookie to subsequent bundle/asset requests, so private previews
    // fail with 401 when fetching the JS bundle.
    // WARNING: This makes the preview publicly accessible with no authentication.
    // Do not use this pattern for sensitive workloads.
    // If Android support is not required, set to false for private previews
    public: true,
    port: 8081,
  },
});

Generate a preview token

To securely access the preview, a token is required:

const expiresAt = new Date(Date.now() + 1000 * 60 * 60 * 24); // 1 day
const token = await preview.tokens.create(expiresAt);

Inject the preview URL into Expo’s app.json

The Expo application router requires the correct origin when running behind a proxy:

async function addRouterOriginToAppJson(
  sandbox: SandboxInstance,
  previewUrl: string
) {
  const appJsonPath = "/app/app.json";

  const appJsonContent = await sandbox.fs.read(appJsonPath);
  const appJson = JSON.parse(appJsonContent);

  appJson.expo = {
    ...appJson.expo,
    extra: {
      ...(appJson.expo.extra || {}),
      router: {
        ...(appJson.expo.extra?.router || {}),
        origin: previewUrl,
      },
    },
  };

  await sandbox.fs.write(appJsonPath, JSON.stringify(appJson, null, 2));
}

Configure the proxy URL

Expo must be configured to serve assets through the preview URL. This function checks if the configuration is already correct and only updates if needed:

async function configureExpoProxyUrl(
  sandbox: SandboxInstance,
  previewUrl: string
): Promise<boolean> {
  const baseUrl = previewUrl.replace(/\/$/, ""); // Remove trailing slash

  // Check if the .env file already has the correct proxy URL
  let envContent = "";
  try {
    envContent = await sandbox.fs.read("/app/.env");
  } catch {
    // File doesn't exist yet
  }

  const expectedEnvLine = `EXPO_PACKAGER_PROXY_URL=${baseUrl}`;

  if (envContent.includes(expectedEnvLine)) {
    console.log("Expo proxy URL already configured correctly");
    return false; // No changes made
  }

  // Remove any existing EXPO_PACKAGER_PROXY_URL line and add the new one
  const lines = envContent
    .split("\n")
    .filter((line) => !line.startsWith("EXPO_PACKAGER_PROXY_URL="));
  lines.push(expectedEnvLine);

  await sandbox.fs.write("/app/.env", lines.join("\n"));
  console.log(`Configured Expo to use proxy URL: ${baseUrl}`);
  return true; // Changes were made
}

Start the dev server

After setting the proxy URL you can start the dev server:

async function startDevServer(sandbox: SandboxInstance) {
  await sandbox.process.exec({
    name: 'dev-server',
    command: 'npx expo start --web --port 8081',
    workingDir: '/app',
    waitForPorts: [8081],
    restartOnFailure: true,
    maxRestarts: 25,
  })
}

Stream logs

Monitor the Expo server output in real-time:

const logStream = sandbox.process.streamLogs("dev-server", {
  onLog(log) {
    console.log(log);
  },
});

// When done monitoring, close the stream:
logStream.close();

Access the Expo application

Once everything is running, the Expo application will be available at https://<PREVIEW-URL>?bl_preview_token=<TOKEN>

Complete example

Here is a full example combining all the steps:

import { SandboxInstance } from "@blaxel/core";

const sandboxName = "my-expo-sandbox";

const responseHeaders = {
  "Access-Control-Allow-Origin": "*",
  "Access-Control-Allow-Methods": "GET, POST, PUT, DELETE, OPTIONS, PATCH",
  "Access-Control-Allow-Headers":
    "Content-Type, Authorization, X-Requested-With, X-Blaxel-Workspace, X-Blaxel-Preview-Token, X-Blaxel-Authorization",
  "Access-Control-Allow-Credentials": "true",
  "Access-Control-Expose-Headers": "Content-Length, X-Request-Id",
  "Access-Control-Max-Age": "86400",
  Vary: "Origin",
};

async function addRouterOriginToAppJson(
  sandbox: SandboxInstance,
  previewUrl: string
) {
  const appJsonPath = "/app/app.json";
  const appJsonContent = await sandbox.fs.read(appJsonPath);
  const appJson = JSON.parse(appJsonContent);

  appJson.expo = {
    ...appJson.expo,
    extra: {
      ...(appJson.expo.extra || {}),
      router: {
        ...(appJson.expo.extra?.router || {}),
        origin: previewUrl,
      },
    },
  };

  await sandbox.fs.write(appJsonPath, JSON.stringify(appJson, null, 2));
}

async function configureExpoProxyUrl(
  sandbox: SandboxInstance,
  previewUrl: string
): Promise<boolean> {
  const baseUrl = previewUrl.replace(/\/$/, "");

  let envContent = "";
  try {
    envContent = await sandbox.fs.read("/app/.env");
  } catch {
    // File doesn't exist
  }

  const expectedEnvLine = `EXPO_PACKAGER_PROXY_URL=${baseUrl}`;

  if (envContent.includes(expectedEnvLine)) {
    return false;
  }

  const lines = envContent
    .split("\n")
    .filter((line) => !line.startsWith("EXPO_PACKAGER_PROXY_URL="));
  lines.push(expectedEnvLine);

  await sandbox.fs.write("/app/.env", lines.join("\n"));
  return true;
}

async function startDevServer(sandbox: SandboxInstance) {
  await sandbox.process.exec({
    name: 'dev-server',
    command: 'npx expo start --web --port 8081',
    workingDir: '/app',
    waitForPorts: [8081],
    restartOnFailure: true,
    maxRestarts: 25,
  })
}

async function restartDevServer(sandbox: SandboxInstance) {
  try {
    await sandbox.process.kill('dev-server')
  } catch {
    // Process might not be running
  }
  await new Promise((r) => setTimeout(r, 1000))
  await startDevServer(sandbox)
}

async function configureExpo(sandbox: SandboxInstance, previewUrl: string) {
  await addRouterOriginToAppJson(sandbox, previewUrl)
  const proxyChanged = await configureExpoProxyUrl(sandbox, previewUrl)

  const processes = await sandbox.process.list()
  const devServerRunning = processes.find((p) => p.name === 'dev-server')

  if (proxyChanged && devServerRunning) {
    await restartDevServer(sandbox)
  } else if (!devServerRunning) {
    await startDevServer(sandbox)
  }
}

async function main() {
  try {
    // Create or reuse the sandbox
    const sandbox = await SandboxInstance.createIfNotExists({
      name: sandboxName,
      labels: {
        framework: "expo",
      },
      image: "expo-template:latest",
      memory: 8096,
    });

    // Create preview
    const preview = await sandbox.previews.createIfNotExists({
      metadata: { name: "preview" },
      spec: {
        responseHeaders,
        // Must be public for Android scenarios: Expo Go on Android doesn't forward the auth
        // cookie to subsequent bundle/asset requests, so private previews
        // fail with 401 when fetching the JS bundle.
        // WARNING: This makes the preview publicly accessible with no authentication.
        // Do not use this pattern for sensitive workloads.
        // If Android support is not required, set to false for private previews
        public: true,
        port: 8081,
      },
    });

    // Generate preview token
    const expiresAt = new Date(Date.now() + 1000 * 60 * 60 * 24);
    const token = await preview.tokens.create(expiresAt);

    // Configure Expo (will restart dev server if needed)
    await configureExpo(sandbox, preview.spec?.url!);

    // Print access URLs
    const webUrl = `${preview.spec?.url}?bl_preview_token=${token.value}`;
    // Use exps:// (HTTPS variant) so Expo Go connects over TLS.
    // Android 9+ blocks cleartext HTTP, and the Blaxel proxy redirects
    // HTTP→HTTPS which Android's native downloader can't follow.
    const expoUrl = webUrl.replace("https://", "exps://");


    console.log(`Web Preview URL: ${webUrl}`);
    console.log(`Expo Mobile URL: ${expoUrl}`);

    // Stream logs
    const logStream = sandbox.process.streamLogs("dev-server", {
      onLog(log) {
        console.log(log)
      },
    });

    // Keep running until interrupted
    process.on("SIGINT", () => {
      logStream.close();
      process.exit(0);
    });
  } catch (error) {
    console.error("Error:", error);
    process.exit(1);
  }
}

main();