Foundry's Code Interpreter forgets your dataframe unless you pin the container ID

Amnesia here has a specific cause. The thing you attach to the agent definition is `CodeInterpreterTool` in the Python SDK, or `CodeInterpreterToolboxTool` when it goes through a toolbox, and the post is blunt that this only declares a capability ^[3]. A container arrives later, provisioned lazily on first use, bound either to an explicit ID you manage or to an automatically managed lifecycle tied to the conversation ^[4]. Keep no ID and you take the automatic path, which the post says quietly returns a fresh, empty sandbox on every call ^[7]. An agent that cannot remember a dataframe it loaded 40 seconds ago is on its second container.

The session is the billable, time-bounded life of that container: up to one hour by default, with a 30-minute idle timeout that tears it down early ^[5]. The two numbers interact. Sixty minutes of ceiling divided by a 30-minute idle window leaves two windows, so the hour is only reachable if something executes in each of them ^[15]. A user who comes back with "now compute the median" 35 minutes later is addressing a container that no longer exists, along with every intermediate file it wrote ^[5][7].

Isolation is per conversation. Two concurrent conversations calling the tool get two container sessions, with no shared state and no shared filesystem ^[6]. Any state that two conversations both need has to live somewhere other than the sandbox.

Files move through a staging path outside the model's context. The post describes the lifecycle as upload, execute, citation, download, with file staging through Azure Storage and citations returned as annotations ^[8]. It also flags that prompt agents and hosted agents built on the Microsoft Agent Framework take divergent paths through the runtime ^[9]. That split is where container-handling code would have to change to port from one to the other.

The payoff for accepting all this machinery is deterministic execution. According to the post, LLMs are terrible at arithmetic and at exact string manipulation over large datasets, and GPT-5-class models asked to reason out the factorial of 100 in tokens return plausible-looking wrong answers more often than you would like ^[11]. What the sandbox gets is a real Python runtime with no network access to your infrastructure and no persistent state across unrelated conversations ^[10]. OpenAI shipped the same pattern as Code Interpreter for ChatGPT, and it appears as the local sandbox tool in Anthropic's Claude and in Gemini ^[12].

Provenance matters for the two numbers people will plan against. This is one developer's write-up, day 8 of a 100-day Foundry series on dev.to, not Microsoft's own documentation ^[1]. The copy available here stops mid-sentence in the request-flow section, ahead of the sections it advertises on security, session economics and cost ^[14][13]. Before anyone sizes a session budget on a one-hour default and a 30-minute idle timeout, those defaults should be read out of the service docs ^[5].