Guides / intermediate
Sandboxing and isolation
Why the agent needs its own computer, what isolation actually means, and which shortcuts turn a factory into a laptop with extra steps.
If the agent runs on a developer laptop, you do not have a factory. You have a very fast intern with the same SSH keys, the same npm tokens, and the same production kubeconfig as the person who started the chat.
Sandboxing is the computer. Isolation is the policy on that computer.
Three questions that end most debates
- Can the team open the machine? A hidden local session is not inspectable. A cloud workspace with a URL is.
- What can it reach? Network allowlists beat “the model promised not to curl prod.”
- What dies when the run ends? Ephemeral disks are a feature. Persistent workspaces are a different product. Name which one you bought.
E2B sells Firecracker microVMs for short-lived execution. Daytona sells longer-lived workspaces. Trevize sells a shared workspace plus a preview. Those are not interchangeable, and the marketing will try to make them sound like they are.
Isolation is not a logo
“We use Firecracker” is a start. It is not a policy.
Write down:
- Root or not.
- Whether the sandbox can talk to the public internet, to your package registry, to your staging VPC.
- Whether secrets are injected as short-lived tokens or as a
.envsomeone copied. - Whether two runs can see each other’s filesystem.
Firecracker is the hypervisor many vendors wrap. Using it does not make a product safe any more than “we use Postgres” makes a SaaS correct.
Previews are part of the sandbox
A diff the team cannot run is not verified. The sandbox should produce something a human can click: an authenticated preview, a Playwright trace, a failing test log that is not a screenshot of a terminal.
If your factory stops at “opened a PR,” the isolation work was wasted. The risk just moved to CI runners that also have too many secrets.
Local CLIs still need a box
Claude Code, Aider, and Goose will happily run on the laptop. That is fine for a single engineer. It is a liability for unattended parallelism. The execution layer and the sandbox layer are allowed to be different products. Wire them on purpose.
Self-hosted sandboxes (Modal workers, E2B infra, Coder, Gitpod) exist because some teams cannot send the repo to a vendor’s hypervisor. “The CLI runs locally” is not that. It is the laptop again.
What we will not pretend
We will not tell you a millsecond cold-start number we did not measure. Vendor blogs comparing E2B to Daytona to Blaxel disagree with each other and rarely publish a method. Pick on isolation and persistence, then measure start time in your image.
Related listings: e2b , daytona , trevize , modal , firecracker