Choosing a sandbox for coding agents
Coding agents need a workspace that survives between sessions, runs long builds and test suites, and exposes preview URLs, with egress control because they read untrusted code. Sandboxes that are persistent by default (Daytona, Vercel Sandbox, Fly.io Sprites, Freestyle) avoid reinstalling dependencies every session. Pause/resume with memory (E2B, CodeSandbox) gets you most of the way there. For agents on a developer’s laptop, use a local sandbox.
What coding agents need from a sandbox
Coding agents clone repositories, install dependencies, run test suites and start dev servers — often over many turns spread across hours or days. That shifts priorities compared with a code interpreter:
- Persistence: the workspace should survive between sessions so dependencies are not reinstalled every time.
- Long sessions or cheap pause/resume.
- Preview URLs so the agent (and user) can see the app it is building.
- Realistic Linux with a full toolchain, Docker-in-sandbox for some stacks, and enough CPU and memory to run builds.
- Egress control and credential brokering, because coding agents read untrusted code and issues.
Sandboxes that fit, by kind
13 sandboxes document what this workload needs. They are grouped by kind and listed alphabetically; the order is not a ranking. Shortlist two or three, then pilot them with your own workload.
Hosted sandbox platforms
SDK-driven sandboxes you create, run code in and destroy through an API.
Daytona
Stateful sandboxes for AI-generated code — Linux containers, Linux and Windows VMs, macOS and GPU sandboxes — with snapshots, volumes and preview URLs.
- Containers or VMs
- BYOC
- GPU
- Pause/resume
Why it fits: Stateful by default with no hard session limit, auto-stop and archive to control cost, preview URLs for any port, SSH/VNC access and SDKs in five languages.
E2B
Open-source cloud sandboxes for AI agents, each a Firecracker microVM, with pause/resume, snapshots and forking.
- Firecracker microVM
- Open source
- Self-hostable
- BYOC
- Pause/resume
Why it fits: MicroVM isolation with pause/resume that preserves memory, snapshots and forking; paused sandboxes are kept indefinitely. The most-integrated option across agent frameworks.
Superserve
Persistent Firecracker microVM sandboxes for long-running agents, with pause/resume, memory-and-disk snapshots, forks and a credentials broker that keeps secrets out of the sandbox.
- Firecracker microVM
- BYOC
- Pause/resume
Why it fits: Persistent Firecracker VMs with pause, forks and a credentials broker, built for long-running coding and personal agents.
Together Code Sandbox
Together AI’s microVM sandbox service, built on the CodeSandbox acquisition, with snapshot-based starts, hibernation, cloning and preview URLs.
- MicroVM
- Pause/resume
Why it fits: Mature microVM dev environments with fast snapshot-based resume and forking, rooted in years of browser-based development tooling.
Vercel Sandbox
Firecracker microVM sandboxes on Vercel’s infrastructure, persistent by default and billed on active CPU, with fine-grained egress control.
- Firecracker microVM
- Pause/resume
Why it fits: Persistent-by-default microVMs with credential brokering — valuable when agents handle untrusted repositories — and active-CPU billing for the long waits on model output.
Persistent VMs and agent computers
Full, long-lived virtual machines that an agent keeps, forks and returns to.
boat
Persistent Ubuntu VMs for AI agents in EU data centres, with SSH, Docker, disk snapshots, forking, a 60 fps virtual desktop and per-second billing from a $20/month plan.
- Full VM, own kernel
- Pause/resume
Why it fits: Persistent Ubuntu VMs in EU data centres with SSH, Docker, a desktop, disk snapshots and forking; Claude Code, Codex and OpenCode come preinstalled.
Fly.io Sprites
Persistent, hardware-isolated Linux computers for AI agents with a durable 100 GB disk, checkpoints, and no compute charges while idle.
- MicroVM
- Pause/resume
Why it fits: A persistent microVM computer per agent with a 100 GB disk and fast checkpoints for safe rollback; costs only storage while asleep.
Freestyle
Full Linux VMs for AI agents with live forking of running VMs, memory-preserving hibernation, VPCs and nested virtualization.
- VM
- Pause/resume
Why it fits: Full VMs that can run Docker and nested virtualization, live-forkable with memory, with default-deny networking — well suited to complex builds.
Upstash Box
Persistent Docker-container "boxes" for coding agents with Claude Code, Codex, OpenCode and Cursor built in, billed on active CPU time rather than wall-clock.
- Docker container
- Pause/resume
Why it fits: Per-user coding-agent workspaces that keep filesystem, environment and git state between runs and cost nothing while paused; billed on active CPU.
Compute platforms with sandboxes
General serverless or app platforms that also offer sandboxes, often with GPUs.
Modal Sandboxes
Sandboxes on Modal’s serverless compute platform for running untrusted code at very high scale, with GPUs, snapshots and tunnels.
- gVisor or VM
- GPU
- Pause/resume
Why it fits: Up to 24-hour sessions with filesystem and memory snapshots, and GPUs if your coding agent also runs models; less workspace-oriented than the leaders.
Cloud development environments
Cloud and in-browser development environments that coding agents increasingly run in.
Coder
Self-hosted cloud development environments defined in Terraform (VMs, Kubernetes pods or Docker containers) for developers and coding agents, with a control-plane-hosted agent loop so workspaces hold no model credentials.
- Template-defined (VM/pod/container)
- Open source
- Self-hostable
- Pause/resume
Why it fits: Open-source, self-hosted workspaces on your own clusters and clouds, with Coder Agents for running coding agents under audit and governance.
GitHub Codespaces
GitHub's cloud development environments: a Dev Container running on a freshly built, dedicated VM per codespace, created from the web, `gh` CLI or REST API, billed per core-hour with a free monthly quota.
- Dedicated VM per codespace
- Pause/resume
Why it fits: Dev Container workspaces tied to GitHub repositories, one VM per codespace with prebuilds and port forwarding, where an agent works alongside a developer.
Local sandboxes for coding agents
Isolation for agents like Claude Code, Codex or Gemini CLI on your own laptop.
Docker Sandboxes
Docker’s `sbx` CLI for running AI coding agents in microVM sandboxes on your machine, with an experimental Docker-hosted cloud.
- MicroVM
- Self-hostable
- GPU
- Pause/resume
Why it fits: For coding agents running on a developer’s own machine: microVM isolation with a private Docker Engine and deny-by-default networking.
Side by side
| Sandbox | Isolation | Open source | Self-host / BYOC | Cold start (vendor) | Max session | Snapshots / pause | GPU | SDKs |
|---|---|---|---|---|---|---|---|---|
| boat | Full VM, own kernel | No | No / No | Not documented | No cap (auto-stop 1 h default) | Yes / Yes | No | Python, JavaScript/TypeScript, CLI, REST API |
| Coder | Template-defined (VM/pod/container) | Yes | Yes / No | Not documented | Not documented | Not documented / Yes | Not documented | CLI, REST API, MCP server |
| Daytona | Containers or VMs | No | Not documented / Yes | <90 ms | Unlimited | Yes / Yes | Yes | Python, TypeScript, Ruby, Go, Java |
| Docker Sandboxes | MicroVM | No | Yes / No | Not documented | Until removed (local) | Yes / Yes | Yes | sbx CLI, TypeScript (cloud), REST API (cloud) |
| E2B | Firecracker microVM | Yes | Yes / Yes | Not documented | 1 h / 24 h (Pro) | Yes / Yes | No | Python, JavaScript/TypeScript |
| Fly.io Sprites | MicroVM | No | No / No | 0.1–2 s wake | Unlimited | Yes / Yes | No | JavaScript/TypeScript, Go, Python, Elixir |
| Freestyle | VM | No | No / Not documented | 65 ms | Unlimited (paid) | Yes / Yes | Not documented | TypeScript |
| GitHub Codespaces | Dedicated VM per codespace | No | No / No | Not documented | 12 h, 30 min idle | No / Yes | No | CLI, REST API |
| Modal Sandboxes | gVisor or VM | No | No / Not documented | <1 s | Up to 24 h | Yes / Yes | Yes | Python, JavaScript/TypeScript, Go |
| Superserve | Firecracker microVM | No | No / Yes | Not documented | Unlimited | Yes / Yes | Not documented | Python, JavaScript/TypeScript, CLI, REST API, MCP server |
| Together Code Sandbox | MicroVM | No | No / Not documented | 0.5 s (snapshot) | Until terminated | Yes / Yes | Not documented | Python, TypeScript |
| Upstash Box | Docker container | No | No / No | Not documented | No cap (idle pause 1 h / 6 h) | Yes / Yes | No | JavaScript/TypeScript, Python, CLI, MCP server |
| Vercel Sandbox | Firecracker microVM | No | No / No | Milliseconds (claim) | 24 h (Pro) | Yes / Yes | Not documented | JavaScript/TypeScript, Python |
Frequently asked questions
Which sandbox should I use for a coding agent?
Cite this page
Agent Sandboxes. (2026). Choosing a sandbox for coding agents. agentsandboxes.org. Last reviewed November 9, 2026. https://agentsandboxes.org/use-cases/coding-agents/
Found an error or a missing sandbox? Submit a correction — every entry links to the sources it relies on.