Best Sandboxes and Cloud VMs for AI Agents in 2026

The Short Answer

Pick E2B if you want a single sensible default; pick something else only when one constraint is binding. An agent that writes and runs code needs a place to do it that is not your laptop and not your production server. Every platform below sells that place, but they disagree about what a sandbox is: a disposable code runner, a persistent Linux computer, or a slice of a larger cloud. The wrong shape shows up in week three, when the working tree you assumed would stay put disappears at the ten-minute mark.

As of Nov 11, 2026 the split looks like this. E2B, Vercel Sandbox and Fly.io put each sandbox in a Firecracker microVM. Modal defaults to gVisor. Daytona defaults to a Linux container and offers a VM class. Cloudflare runs each Container instance in its own VM behind a Durable Object. Northflank offers microVMs and gVisor. List prices run from about $0.017 to $0.128 per vCPU-hour, but the billing model (active CPU versus full wall-clock) moves real bills by an order of magnitude.

E2B's co-founder and CEO explains E2B Embed, the single-machine package of the E2B runtime that sits alongside E2B Cloud and bring-your-own-cloud (official E2B video, September 2026).

Quick Picks

These picks follow the evidence in the sections below. None of them is sponsored; the methodology section explains how we ranked.

Master Comparison Table

Prices are list prices from each vendor's own pricing page, checked on Nov 11, 2026. Per-second rates are converted to hourly figures for comparison. “Not captured” means the page we fetched did not state the value, so we do not guess.

The second axis is persistence and snapshots. This table shows how each platform treats state when the agent goes quiet:

What Actually Differs Between Agent Sandboxes

Four properties separate these products, and all four live in the reference docs rather than on the landing page.

The isolation primitive. A microVM boots its own guest kernel behind a virtualization boundary, so a kernel exploit inside the sandbox should not reach the host. gVisor interposes a user-space kernel that answers the tenant's system calls itself, shrinking the attack surface to that component. A plain container shares the host kernel through namespaces and cgroups, which is fine for code you wrote and riskier for code a model produced from untrusted input. A V8 isolate, used by Cloudflare's Dynamic Workers, starts in milliseconds but isolates at the process level. The primitive also sets a floor on startup time: a booted kernel costs more than a container, which costs more than an isolate.

What survives idle time. Some products discard everything when the sandbox stops. Others keep the disk, and a few keep memory and running processes too. If your agent installs dependencies on Monday and returns on Thursday, you need the second or third kind.

The timers. Every hosted sandbox has a default timeout, an idle policy and sometimes a hard session cap. What happens at zero matters more than the number: E2B kills a sandbox at timeout unless you set the action to pause, and a kill loses state.

The billing shape. Full wall-clock billing charges for every second a sandbox waits on a model. Active-CPU billing (Modal, Vercel) charges for work done. The benchmark section shows how far that gap can go.

E2B

E2B is the most widely adopted purpose-built agent sandbox. Each sandbox is a Firecracker microVM with its own kernel; the E2B runtime is Go code under Apache-2.0 (e2b-dev/runtime), and the main SDK repository e2b-dev/E2B shows about 14.8K GitHub stars as of Nov 11, 2026. Creation works by restoring a snapshot, with lazily loaded memory and a copy-on-write root filesystem, and an in-VM daemon called envd handles commands and files. E2B's homepage claims 100K+ teams and that 94 of the Fortune 100 have signed up; both are vendor claims we did not verify.

Pricing (Nov 11, 2026). Hobby is free. Pro is $150 per month plus usage, with 100 concurrent sandboxes expandable to 1,100. Usage is billed per second: 1 vCPU costs $0.000014 per second (about $0.0504 per hour) and 1 GiB of memory costs $0.0000045 per second (about $0.0162 per hour). Disk is free up to 10 GiB on Hobby and 20 GiB on Pro. Enterprise starts at a $2,000 monthly commitment with 500 concurrent sandboxes. Hobby sessions last up to 1 hour and Pro sessions up to 24 hours; pausing resets the window.

Strengths. Persistence is the best-documented in the category. Pausing saves filesystem and memory together, takes roughly 4 seconds per GiB of RAM, resumes in about a second and keeps the paused sandbox indefinitely. You can fork a running sandbox (up to 100 per request, and there is a CLI fork command), attach persistent volumes and apply an egress firewall with domain allow and deny lists. E2B documents self-hosting in concrete terms. E2B Embed, announced on Sep 30, 2026, packages the runtime and dashboard for one Linux host with KVM, with Terraform for GCP, AWS and Azure plus Kubernetes manifests, and E2B also sells bring-your-own-cloud on AWS, GCP and Azure for enterprises. Recent releases target governance as much as speed: E2B Secrets (Oct 7) keeps credentials outside the sandbox and injects them into the HTTPS headers you configure, and Workload Identity (Nov 3) gives each sandbox a signed identity your backend can verify without long-lived credentials. AI agents can also provision E2B sandboxes through Stripe Projects (Jun 10, 2026), and prebuilt templates include Claude Code, Codex and Hermes Agent.

Weaknesses. There is no GPU option (E2B states its sandboxes are CPU-only). The Pro floor of $150 per month penalizes tiny projects, and billing covers the full sandbox duration, so a sandbox that waits on a model for minutes costs the same as one that computes. A sandbox is terminated at timeout unless you opt into pause, which surprises teams that expected persistence by default. Several of its newest features (Secrets, Workload Identity, DNS allowlists) are governance controls rather than speed, which suggests the roadmap is aimed at enterprise buyers.

Best for: coding agents, data-analysis agents and any product that needs strong isolation, resumable state and an exit path to self-hosting.

# pip install e2b
from e2b import Sandbox

with Sandbox.create() as sandbox:
    result = sandbox.commands.run('echo "Hello from E2B!"')
    print(result.stdout)

// npm install e2b
import { Sandbox } from 'e2b'

const sandbox = await Sandbox.create({ timeoutMs: 60_000 })
// ... run commands, write files, pause if you need the state later ...
await sandbox.kill()

Daytona

Daytona sells fast, stateful sandboxes with the widest SDK coverage. Its homepage advertises sandbox creation under 90 ms (vendor-reported), and its docs describe each sandbox as having a dedicated kernel, filesystem, network stack and vCPU, memory and disk allocation. The catch is the default: sandboxes run as Linux containers unless you pick a VM class, and the docs also list Windows, macOS and GPU classes. That matters because a container shares the host kernel, so for untrusted multi-tenant code you should choose the VM class deliberately.

Pricing (Nov 11, 2026). $0.0504 per vCPU-hour, $0.0162 per GiB-hour of memory and $0.000108 per GiB-hour of storage (first 5 GiB free), billed per second. New accounts get $200 in free compute, startups can apply for up to $50,000 in credits, and the enterprise tier adds SSO, audit logs and bring-your-own-cloud. The pricing page also lists GPU capacity, including preemptible H100 at $2.27 per hour. Default snapshots are daytona-small (1 vCPU, 1 GiB, 3 GiB disk), medium (2/4/8) and large (4/8/10).

Strengths. SDKs for Python, TypeScript, Ruby, Go and Java plus a CLI and API are the broadest in this guide. A stopped sandbox keeps its identity and filesystem, auto-stop defaults to 15 minutes (set it to 0 to disable) and there is no stated hard session cap, so Daytona behaves like a persistent machine you rent by the second. GPU classes and Windows or macOS sandboxes cover agents that drive desktops. The company raised a $60M Series B at a $1B valuation (FirstMark), and its homepage cites Writer running 300,000 sandboxes in a month (vendor claim).

Weaknesses. Daytona's open-source status changed. The daytonaio/daytona repository on GitHub is archived, and its README states that as of June 2026 core development has moved to a private codebase; the repo stays public under its license and still shows about 71K stars. If “open source” or self-hosting is a hard requirement, confirm the current path with Daytona before committing. LogRocket measured a slower resume (1,254 ms) than create (742 ms), because Daytona's stop and start flow rebuilds more than a memory-preserving pause.

Best for: long-lived agent workspaces, multi-language SDK needs and teams that want a cheap, persistent machine with a GPU option.

# pip install daytona
from daytona import Daytona

daytona = Daytona()  # uses DAYTONA_API_KEY from the environment
sandbox = daytona.create()

response = sandbox.process.exec("echo 'Hello, World!'")
print(response.result)

Modal Sandboxes

Modal is the pick when your sandboxes sit next to Python pipelines, batch jobs or GPU workloads. Sandboxes share Modal's container runtime, so a sandbox can use the same images, volumes and secrets as your Modal Functions. The default isolation is gVisor, a user-space kernel; Modal's security documentation also mentions microVMs, and the snapshot docs expose a runtime="vm" option. SDKs cover Python, JavaScript and Go.

Pricing (Nov 11, 2026). Sandboxes bill at non-preemptible rates, three times the list price for preemptible Functions: $0.00003942 per physical core-second (a physical core equals 2 vCPUs, so about $0.071 per vCPU-hour) and $0.00000667 per GiB-second (about $0.024 per GiB-hour). Billing follows max(request, actual use), and for most sandboxes Modal recommends requesting nothing, which defaults to a reservation of 0.125 cores and 128 MiB. The Starter plan includes $30 per month in compute credits and 100 containers; Team is $250 per month plus compute, with $100 in credits and 5,000 containers.

Strengths. Idle sandboxes cost almost nothing, which is why the active-resource model wins bursty workloads in LogRocket's cost scenario. GPU reservations are a Sandbox parameter, and network controls include block_network, outbound CIDR allowlists and domain allowlists. Filesystem and directory snapshots are kept for 30 days.

Weaknesses. Sandboxes default to a 5-minute lifetime and top out at 24 hours, after which you snapshot and restore. There is no in-place pause: LogRocket noted that Modal's 2,347 ms figure is snapshot boot time rather than resume, and its create time (2,437 ms) was the slowest of the five platforms it measured except Blaxel. Memory snapshots expire after 7 days, cannot use GPUs, restore only on the same instance type and cannot pin a region. Modal is managed-only.

Best for: data and ML agents already on Modal, bursty workloads where idle time dominates, and anything needing GPUs inside a sandbox.

# pip install modal
import modal

app = modal.App.lookup("agent-sandboxes", create_if_missing=True)
sb = modal.Sandbox.create(app=app)

p = sb.exec("python", "-c", "print('hello')", timeout=3)
print(p.stdout.read())
sb.terminate()

Vercel Sandbox

Vercel Sandbox is generally available and runs each sandbox in a Firecracker microVM with its own filesystem and network. It runs in 19 regions, the default image (vercel/sandbox/universal) ships Node LTS and Python 3.14, and sandboxes scale from 1 vCPU to between 2 and 32 even-numbered vCPUs with 2 GB of memory per vCPU. SDKs exist for JavaScript and Python, plus a CLI. Persistent Drives are in beta.

Pricing (Nov 11, 2026). Active CPU costs $0.128 per hour, provisioned memory $0.0212 per GB-hour, sandbox creations $0.60 per million and snapshot storage $0.08 per GB-month. Hobby includes 5 hours of active CPU, 420 GB-hours of memory and 5,000 creations; Pro adds a $20 monthly credit. Hobby allows 10 concurrent sandboxes, 4 vCPU and 8 GB and 45-minute sessions; Pro allows 10,000 concurrent, 8 vCPU and 16 GB and 24-hour sessions. Storage is 64 GB NVMe.

Strengths. Sandboxes are persistent by default: stopping takes a filesystem snapshot and a new session boots from it by name, with snapshots expiring 30 days after last use unless you change that. A network policy can go up to deny-all. For teams on Vercel the account, billing, observability and AI Gateway story is unified; see our Vercel AI Gateway guide for the model side.

Weaknesses. Because memory bills for the whole time it is provisioned, long-lived resident sandboxes get expensive: LogRocket's 50-agent persistent scenario put Vercel near $3,800 per month against about $533 for E2B and Daytona. Resume was also slower than create in LogRocket's run (3,333 ms against 1,852 ms), and background processes must be restarted from an onResume hook because only the filesystem is saved. Vercel Sandbox is managed-only.

Best for: Vercel-hosted products that run short agent tasks, previews or code evaluation next to the app.

// npm install @vercel/sandbox
import { Sandbox } from '@vercel/sandbox'

const sandbox = await Sandbox.create()
await sandbox.runCommand('echo', ['Hello from Vercel Sandbox!'])

Cloudflare Sandbox and Containers

Cloudflare offers two sandbox environments. Containers give each instance a full Linux environment in its own microVM with a separate kernel and network, started and addressed from a Durable Object. Dynamic Workers run JavaScript, Python or WebAssembly in V8 isolates for lighter code. A @cloudflare/sandbox SDK wraps the container path, and a coding agents guide covers Claude Code, Codex and Devin. Everything requires the Workers Paid plan at $5 per month.

Pricing (Nov 11, 2026). Containers cost $0.000020 per vCPU-second (about $0.072 per hour), $0.0000025 per GiB-second of memory (about $0.009 per hour) and $0.00000007 per GB-second of disk. The Workers Paid plan includes 25 GiB-hours of memory, 375 vCPU-minutes and 200 GB-hours of disk per month. Egress is $0.025 per GB in North America and Europe with 1 TB included. Instance types run from lite (1/16 vCPU, 256 MiB) up to standard-4 (4 vCPU, 12 GiB, 20 GB disk), and account limits are 1,500 concurrent vCPUs and 6 TiB of memory.

Strengths. Memory is the cheapest in this guide at $0.009 per GiB-hour, the edge network sits in front of the sandbox, and outbound HTTP can be blocked, allowed or intercepted with authorization headers injected in the Worker. The official quickstart shows the shape of the model: a Durable Object calls container.start() with an image and enableInternet: false, then container.exec() runs a command.

Weaknesses. Container disk is ephemeral and files are lost when the container stops unless you use snapshots with the durable_object scheduling policy, which is in public beta. Cold starts are often 1 to 3 seconds depending on image size (vendor docs). It is TypeScript-first and tied to the Workers platform; wrangler dev runs the instance in local Docker rather than a microVM, so local and deployed isolation differ. A GPU option and a session cap were not stated on the pages we checked.

Best for: agents already written as Workers, edge-adjacent tools and products that want sandboxed commands without leaving Cloudflare.

// Durable Object that starts a container and runs a command
import { DurableObject } from "cloudflare:workers";

export class MyContainer extends DurableObject<Env> {
  async exec(argv: string[]) {
    const container = this.ctx.container;
    if (!container) throw new Error("No container is configured");
    if (!container.running) {
      container.start({
        image: "cloudflare/debian-trixie",
        entrypoint: ["sleep", "infinity"],
        enableInternet: false, // block outbound traffic from the sandbox
      });
    }
    const process = await container.exec(argv);
    const output = await process.output();
    return { stdout: new TextDecoder().decode(output.stdout), exitCode: output.exitCode };
  }
}

Fly.io Machines and Sprites

Fly.io sells two things that fit agents. Machines are Firecracker microVMs controlled by an API, started and stopped in under a second according to Fly's docs, with per-second billing. Sprites are a newer product: persistent, hardware-isolated Linux computers that sleep when idle, checkpoint in about a second, get their own HTTPS URL and keep a 100 GB volume.

Pricing (Nov 11, 2026). Sprites cost $0.0385 per CPU-hour, $0.021875 per GB-hour of memory and $0.000683 per GB-hour of hot storage (about $0.50 per GB-month), with cold storage near $0.02 per GB-month. A $1 trial credit is included and bandwidth is not metered. Machines are priced per instance: a shared-cpu-1x with 256 MB is $2.19 per month and a performance-1x with 2 GB is $33 per month. A stopped Machine's root filesystem costs $0.15 per GB-month, and volumes are $0.15 per GB-month.

Strengths. A Sprite is the closest thing here to giving an agent a laptop: install once, come back days later and the repo is where you left it, with nothing billed while it sleeps. Per Fly's own comparison, the network policy is read-only from inside the Sprite, so an agent cannot rewrite its own rules, and credentials can be brokered through Connectors rather than stored on disk. SDKs cover JavaScript, Go, Python and Elixir. Machines suit teams that want full control: Fly's architecture docs confirm Firecracker, and the Machines API lets you build your own sandbox pool.

Weaknesses. Machines are a primitive, not a sandbox product: there is no code-interpreter API, snapshot workflow or per-sandbox network policy layer that you do not build yourself. Sprites are young, and processes sleep when idle (Fly says a Sprite pauses after about 30 seconds of inactivity, with services relaunching from cold). Fly's comparison article is vendor-authored, so treat its table as a useful index to docs rather than a neutral review. Neither product is self-hostable.

Best for: coding agents with long-lived workspaces (Sprites), or custom sandbox fleets built on a microVM API (Machines).

// npm install @fly/sprites
import { SpritesClient } from "@fly/sprites";

const client = new SpritesClient(process.env.SPRITES_TOKEN!);
const sprite = client.sprite("my-sprite");
await sprite.exec("echo hello");

Northflank

Northflank is a general container and workload platform with a sandbox product on top. It isolates workloads with microVMs (Cloud Hypervisor, with Kata runtimes mentioned) or gVisor, with gVisor used for GPU workloads, and it applies sandboxing on every plan.

Pricing (Nov 11, 2026). Pay as you go starts at $0.01667 per vCPU-hour and $0.00833 per GB-hour of memory, the lowest published rate in this guide. Bring-your-own-cloud nodes cost $0.02083 per vCPU-hour, egress is $0.06 per GB, and a free Sandbox tier includes $20 per month in resources and one BYOC cluster up to 12 vCPU and 48 GB.

Strengths. The lowest list price, no session time limit, sandboxes up to 288 vCPU and 2 TB of memory, GPU support, and a BYOC option that lets you keep workloads in your own AWS, GCP or Azure account. Because it is a full platform, the same account can run your databases, jobs and APIs next to the sandboxes.

Weaknesses. The sandbox SDK surface is smaller than E2B or Daytona (a JS SDK and REST API), and its startup claims reach us only second-hand: LogRocket summarizes them as sub-second, but we did not find a precise vendor-published figure or independent measurement. Some Northflank features assume you will use the wider platform.

Best for: cost-sensitive fleets, teams that want BYOC without running their own control plane, and GPU-backed sandboxes.

Runloop

Runloop sells Devboxes, cloud development environments built for agent workloads such as coding agents and evaluation harnesses. Its docs say Devboxes use virtual machine technology but do not name the hypervisor, so we do not claim one here. SDKs cover Python and TypeScript, and features include blueprints for reusable images, snapshots, suspend and resume, network policies, an Agent Gateway and an MCP Hub.

Pricing (Nov 11, 2026). $0.108 per CPU-hour, $0.0252 per GB-hour of memory and $0.00034236 per GB-hour of storage. The Basic tier is free plus usage with 100 GB; Pro is $250 per month plus usage and adds suspend and resume and repository connections; Enterprise deploys into your VPC. New accounts get $50 in trial credit and three running Devboxes.

Strengths. Benchmark and eval workflows are the focus, with blueprints and snapshots that make it easy to launch many identical environments. Suspend and resume (vendor-reported near 25 ms per LogRocket's summary) and VPC deployment suit larger teams.

Weaknesses. It has the highest compute rate among the dedicated sandboxes here after Vercel's active-CPU price, the isolation technology is unspecified, key lifecycle features sit behind a $250 per month tier and it is managed-only apart from the enterprise VPC option.

Best for: teams building coding-agent products or evaluation pipelines that want a managed devbox abstraction rather than a raw sandbox API.

# pip install runloop_api_client
import asyncio
from runloop_api_client import AsyncRunloopSDK

runloop = AsyncRunloopSDK()  # RUNLOOP_API_KEY from the environment

async def main():
    devbox = await runloop.devbox.create()
    result = await devbox.cmd.exec(command="echo 'Hello from Runloop!'")
    print(await result.stdout())
    await devbox.shutdown()

asyncio.run(main())

CodeSandbox SDK

CodeSandbox exposes its cloud development environments through the @codesandbox/sdk package. Its docs list browser-based IDEs, code interpretation and AI agent runtime environments as use cases. LogRocket describes the sandboxes as Firecracker microVMs with memory snapshots and live cloning, which is useful when an agent wants to branch from a known good state. The SDK is TypeScript-first, and CodeSandbox lists SOC 2 Type II compliance.

Pricing (Nov 11, 2026). VM credits cost $0.015 each, and the paid plan is $170 per month per workspace including 40 hours of VM credits. We could not fetch the SDK launch blog (it returned a 403), so cold start numbers (1 to 3 seconds for a VM clone) come from LogRocket's summary of vendor claims and remain unverified.

Strengths. Memory snapshots and live cloning (vendor-reported, per LogRocket) make branching experiments cheap, and its developer-environment origins show in the Hosts docs, which cover exposed ports and custom domains for previews.

Weaknesses. TypeScript only, credit-based pricing that is harder to forecast than per-second compute, a $170 per month workspace entry point and no self-host option.

Best for: TypeScript teams that need fork-and-branch environments or previewable web apps built by agents.

// npm install @codesandbox/sdk
import { CodeSandbox } from "@codesandbox/sdk";

const sdk = new CodeSandbox();
const sandbox = await sdk.sandboxes.create();
const client = await sandbox.connect();
const output = await client.commands.run("echo 'Hello World'");

OpenSandbox

OpenSandbox (opensandbox-group/OpenSandbox) is an Apache-2.0 sandbox runtime you host yourself. The repository was created on Dec 17, 2025, shows about 17K GitHub stars as of Nov 11, 2026 and is an AAIF project. It runs on Docker locally and on Kubernetes, supports pluggable backends (gVisor, Kata or Firecracker), and ships SDKs for Python, Java and Kotlin, TypeScript, C# and Go, a CLI called osb, MCP support, egress policy and a Credential Vault. Pause and resume with memory and disk is supported. The project README reports Firecracker creation at 64 ms P50 in a serial run and 125.4 ms P99 with 10 concurrent creations; that is a vendor-reported figure on the project's own hardware.

There is no price because there is no platform fee: you pay for the hosts and for the engineering time to operate them. The trade-off is the usual one for self-hosting, since isolation, patching and capacity become your job. We cover installation and the security model in the dedicated OpenSandbox secure agent runtime guide. It is the right choice when data cannot leave your network, when you need a single runtime across Docker and Kubernetes, or when per-sandbox cost at high volume outweighs ops cost.

Others Worth Watching

LogRocket's August 2026 comparison covers several platforms we did not rank, and we report their details second-hand. Blaxel (microVM, perpetual hibernation) appeared in its measurements at 2,824 ms create and 1,924 ms resume. AWS Lambda MicroVMs uses Firecracker with snapshot resume and suspend for up to 8 hours. Google Agent Sandbox is built on GKE with gVisor and stateful time-to-live up to 14 days. Microsandbox is a libkrun-based self-hosted option, and AIO Sandbox is a Docker-based self-hosted option. Treat these as leads to verify, not recommendations. For agents that need a browser rather than a shell, see our guide to browser infrastructure for AI agents.

Benchmarks and Independent Data

No neutral, standardized leaderboard for sandbox cold start exists as of Nov 11, 2026. Vendor numbers are measured warm, in-region and under favorable conditions, and each vendor defines “ready” differently. The best independent data point we found is LogRocket's August 4, 2026 test, which created a sandbox, ran a command, confirmed execution inside the sandbox, paused it and timed the resume to the first command. It is one author's harness, not a peer-reviewed benchmark, and Blaxel is the only platform in the table we do not cover.

Two caveats from the same article: resume does not mean the same operation everywhere (E2B and Daytona pause and resume in place, Modal has no in-place resume), and measured numbers ran above vendor claims because real agents pay for setup, distance and the round trip. The vendor-reported figures we found are below, and none is directly comparable to the table above.

Cost needs the same care. The next table is plain arithmetic on the published list rates for a sandbox with 2 vCPU and 4 GB of memory running for one hour. It is a rough index, not a quote, because the platforms bill different things: Modal and Vercel meter active CPU, Fly Sprites bill nothing while asleep, and Cloudflare uses fixed instance tiers.

LogRocket modeled two workloads that show why list price misleads. For a bursty interactive agent running 30,000 sessions a month, each alive about five minutes with 30 seconds of CPU at 2 vCPU and 4 GB, it estimated Modal near $36, Vercel near $276 and E2B, Daytona and Blaxel near $414. For 50 agents each holding a persistent sandbox (active two hours a day, idle 22) with state retained, Modal looked cheapest near $426 but only because it ignores the cost of rebuilding state, E2B, Daytona and Blaxel landed near $533, and Vercel became the most expensive at roughly $3,800 because memory bills across all 24 hours. These are LogRocket's modeled figures, not invoices.

Isolation Is Not the Whole Security Story

A strong compute boundary does not protect an agent that has open network access and a highly privileged credential. LogRocket cites BeyondTrust research on AWS AgentCore: the Firecracker isolation itself held, but a “Sandbox” mode that promised no external access still allowed outbound DNS queries. Researchers built a command-and-control channel over DNS and used the interpreter's over-broad IAM role to read S3 data; AWS remediated DNS tunneling on April 15, 2026. Every product here needs the same checks on egress and credentials.

• Egress control. E2B is open by default and supports allow and deny lists of IPs, CIDR blocks and domains, and since Oct 26, 2026 it lets you choose which DNS servers sandboxes reach. Modal offers block_network plus CIDR and domain allowlists. Daytona applies a per-sandbox firewall that is restricted by default on lower tiers. Vercel takes a policy up to deny-all. Cloudflare can block, allow or intercept outbound HTTP.
• Secrets. Prefer injection at the network layer: E2B Secrets and Cloudflare's Worker header injection keep tokens out of the VM, and Fly brokers credentials for Sprites through Connectors.
• Identity. E2B Workload Identity gives each sandbox a signed identity so your backend can verify who is calling and decide what it can access.
• Least privilege. Give the sandbox the narrowest role you can, and never mount a Docker socket into a container-based sandbox.

The DeepLearning.AI course on building coding agents with E2B walks through the progression from local execution to containers to microVM sandboxes, which is a good primer if your team is deciding how much isolation it needs.

Course introduction comparing local execution, containers and microVM sandboxes for agent code (DeepLearning.AI and E2B; E2B is a partner on the course, so read it as an educational intro from an interested vendor).

How to Choose

Find the one dimension where a wrong choice breaks the agent, the security model or the budget. That dimension builds your shortlist; the others become filters.

Sandboxes are one layer of an agent stack. For where the agent process itself runs, read our sibling guides to the best VPS for AI agents and the best AI agent hosting platforms. If you build the agent itself, the best AI agent frameworks post covers which frameworks ship sandbox integrations, and the OpenAI Agents SDK write-up explains sandboxed execution and memory in that SDK. Coding-agent users can compare tools in the best AI coding agents of 2026, and if you also need raw GPU capacity, the best GPU cloud guide covers it. To wire sandbox tools into an editor agent, see the best MCP servers for Claude Code.

How We Evaluated

We fetched each vendor's own pricing page and documentation on Nov 11, 2026, and every price, limit and date in this guide comes from those pages or from a source named inline. Where a vendor does not publish a value (Runloop's isolation technology, CodeSandbox's session limit, Cloudflare's session cap), we say so instead of filling the gap. Vendor figures are labeled vendor-reported. Hourly prices are converted from per-second list rates with simple arithmetic and rounded to four decimals. Rankings follow evidence for isolation strength, documented persistence, session limits, list price, SDK breadth and self-host options. There is no paid placement, affiliate link or sponsorship in this ranking, and we did not run our own cold start tests; the only independent timings come from LogRocket.

Prices change often, and several of these products shipped notable changes in the last two months (E2B Embed, Secrets and Workload Identity; Daytona's repo going private; Cloudflare quickstart updates). Re-check the vendor pages before committing budget.

FAQ

Sources

All pages were fetched on Nov 11, 2026 unless noted.

• E2B pricing, sandbox persistence docs, product updates, e2b-dev/runtime on GitHub
• E2B: sandboxes through Stripe Projects (Jun 10, 2026)
• Daytona pricing, sandboxes docs, daytonaio/daytona on GitHub
• Modal pricing, Sandboxes guide, Sandbox snapshots, security
• Vercel Sandbox docs and pricing
• Cloudflare Sandbox docs, Run a Linux command quickstart (updated Oct 22, 2026), Containers pricing
• Fly.io pricing, Machines docs, architecture, Sprites
• Northflank pricing and sandboxes product page
• Runloop pricing and Devboxes docs
• CodeSandbox pricing and SDK docs
• OpenSandbox on GitHub
• LogRocket: Comparing AI agent sandbox platforms (Aug 4, 2026, independent measurements and cost scenarios)
• Fly.io: AI agent sandbox providers compared (Sep 9, 2026, vendor-authored, used for session and persistence details that cite each vendor's docs)
• E2B Embed: a new way to run E2B and New course with E2B (YouTube)