Choosing a sandbox for computer-use and browser agents
Computer-use agents drive a GUI, so the sandbox needs a virtual desktop you can stream or VNC into, enough memory for a browser, long sessions, and sometimes Windows or macOS. Most agent sandboxes are Linux-only. Check OS support first, then whether logged-in browser state can persist safely between runs.
What computer-use agents need from a sandbox
Computer-use agents operate a GUI through screenshots and input events, so the sandbox must provide:
- A virtual desktop with a way to stream or VNC into it.
- OS options — many enterprise workflows need Windows or macOS.
- Longer sessions and enough memory for a browser and desktop apps.
- Persistence for logged-in browser profiles, handled carefully.
Sandboxes that fit, by kind
13 sandboxes document what this workload needs. They are grouped by kind and listed alphabetically; the order is not a ranking. Shortlist two or three, then pilot them with your own workload.
Hosted sandbox platforms
SDK-driven sandboxes you create, run code in and destroy through an API.
Daytona
Stateful sandboxes for AI-generated code — Linux containers, Linux and Windows VMs, macOS and GPU sandboxes — with snapshots, volumes and preview URLs.
- Containers or VMs
- BYOC
- GPU
- Pause/resume
Why it fits: Linux and Windows VM sandboxes plus macOS, with VNC and web terminal access from the same API.
E2B
Open-source cloud sandboxes for AI agents, each a Firecracker microVM, with pause/resume, snapshots and forking.
- Firecracker microVM
- Open source
- Self-hostable
- BYOC
- Pause/resume
Why it fits: A dedicated Desktop SDK for computer-use agents on Firecracker microVMs, with pause/resume to keep sessions alive cheaply.
Persistent VMs and agent computers
Full, long-lived virtual machines that an agent keeps, forks and returns to.
Fly.io Sprites
Persistent, hardware-isolated Linux computers for AI agents with a durable 100 GB disk, checkpoints, and no compute charges while idle.
- MicroVM
- Pause/resume
Why it fits: Persistent microVM computers with durable disks — good for long-lived browser agents that keep state.
Compute platforms with sandboxes
General serverless or app platforms that also offer sandboxes, often with GPUs.
Modal Sandboxes
Sandboxes on Modal’s serverless compute platform for running untrusted code at very high scale, with GPUs, snapshots and tunnels.
- gVisor or VM
- GPU
- Pause/resume
Why it fits: High-concurrency sandboxes for running many headless browser agents in parallel.
Cloud provider code execution
Managed code-execution tools from AWS, Azure, Google Cloud and OpenAI.
AgentBay
Alibaba Cloud's on-demand cloud sandboxes for agents, offering browser, Windows/Linux desktop, Android cloud-phone and code-space environments through one SDK.
- Cloud environment instance
Why it fits: Browser, desktop and mobile environments hosted in Alibaba Cloud regions, including Singapore.
AWS Bedrock AgentCore
AWS’s managed agent platform: a Code Interpreter tool for running agent-generated code and a Runtime that hosts each agent session in its own microVM.
- MicroVM (Runtime)
Why it fits: Managed agent runtime with long sessions inside AWS; pairs with AWS’s managed browser tooling.
Browser and desktop sandboxes
Hosted browsers and full desktops that computer-use agents click, type and browse in.
Anchor Browser
Cloud browsers for agents with a dedicated VM per browser, managed authentication identities, persistent volumes and a Web-Bot-Auth-verified Chromium fork.
- Dedicated VM per browser
- BYOC
Why it fits: A dedicated VM per browser with managed logins, SSO and MFA for authenticated enterprise workflows.
Browserbase
Hosted headless Chromium sessions for web agents, driven over CDP with Playwright, Puppeteer, Selenium or the Stagehand SDK, with Contexts for persisted logins and four regions.
- Isolated Chromium session
Why it fits: Managed Chromium at scale with persisted logins, stealth and the Stagehand SDK.
Cua
Open-source computer-use infrastructure: Linux sandboxes as gVisor containers and macOS or Windows sandboxes as VMs, run locally, in your own cloud account or as shared "Spaces".
- gVisor container or VM
- Open source
- Self-hostable
- Pause/resume
Why it fits: Open-source computer-use sandboxes on your own Macs, servers or cloud accounts, including macOS VMs on Apple silicon.
Kernel
Browsers for agents where each Chromium runs in its own Unikraft unikernel VM, with standby that stops billing, profiles, and open-source images under Apache-2.0.
- Unikernel VM per browser
- Open source
- Self-hostable
- GPU
- Pause/resume
Why it fits: Each browser runs in its own hypervisor-isolated unikernel VM, billed only while active.
Orgo
Always-on cloud Linux and Windows desktops for AI agents, each an isolated VM billed by the second, with a computer-use API, MCP server, SSH, clone and fork.
- Isolated VM (hypervisor not named)
- GPU
- Pause/resume
Why it fits: Persistent cloud desktops that keep running around the clock with a browser, terminal and SSH.
Scrapybara
Hosted Ubuntu, browser and Windows desktop instances for computer-use agents, driven through Python and TypeScript SDKs with pause and resume.
- Not documented
- Pause/resume
Why it fits: Ready-made Ubuntu or Windows desktops with browser, bash, filesystem and Jupyter tools in one API; the company has since pivoted to a new product, so check its status.
Steel
Open-source browser API for agents (Apache-2.0, self-hostable with Docker) with a managed Steel Cloud adding stealth, captcha solving, profiles and a hosted MCP server.
- Isolated Chromium session
- Open source
- Self-hostable
Why it fits: Open-source (Apache-2.0) browser API with Playwright, Puppeteer and Selenium support, self-hostable or on a managed cloud.
Side by side
| Sandbox | Isolation | Open source | Self-host / BYOC | Cold start (vendor) | Max session | Snapshots / pause | GPU | SDKs |
|---|---|---|---|---|---|---|---|---|
| AgentBay | Cloud environment instance | No | No / No | Not documented | 30 min default; configurable | No / Not documented | Not documented | Python, JavaScript/TypeScript, Go, Java, CLI, MCP server |
| Anchor Browser | Dedicated VM per browser | No | No / Yes | Not documented | 3 h default, configurable | No / No | No | Python, JavaScript/TypeScript, REST API, MCP server |
| AWS Bedrock AgentCore | MicroVM (Runtime) | No | No / No | Not documented | Up to 8 h | Not documented / Not documented | No | Python (AgentCore SDK), AWS SDKs, AWS CLI |
| Browserbase | Isolated Chromium session | No | No / No | <2 s (claim) | 6 h (15 min Free) | No / No | No | Python, JavaScript/TypeScript, REST API, MCP server |
| Cua | gVisor container or VM | Yes | Yes / No | Not documented | Until destroyed | Yes / Yes | Not documented | Python, JavaScript/TypeScript, Rust, CLI, MCP server |
| Daytona | Containers or VMs | No | Not documented / Yes | <90 ms | Unlimited | Yes / Yes | Yes | Python, TypeScript, Ruby, Go, Java |
| E2B | Firecracker microVM | Yes | Yes / Yes | Not documented | 1 h / 24 h (Pro) | Yes / Yes | No | Python, JavaScript/TypeScript |
| Fly.io Sprites | MicroVM | No | No / No | 0.1–2 s wake | Unlimited | Yes / Yes | No | JavaScript/TypeScript, Go, Python, Elixir |
| Kernel | Unikernel VM per browser | Yes | Yes / No | ~30 ms p50 (claim) | Up to 72 h | Yes / Yes | Yes | JavaScript/TypeScript, Python, Go, CLI, REST API, MCP server |
| Modal Sandboxes | gVisor or VM | No | No / Not documented | <1 s | Up to 24 h | Yes / Yes | Yes | Python, JavaScript/TypeScript, Go |
| Orgo | Isolated VM (hypervisor not named) | No | No / No | Seconds (claimed) | Unlimited (paid) | Yes / Yes | Yes | Python, JavaScript/TypeScript, REST API, CLI, MCP server |
| Scrapybara | Not documented | No | No / No | <1 s (claimed) | 1 h default, configurable | No / Yes | No | Python, JavaScript/TypeScript, REST API, MCP server, CLI |
| Steel | Isolated Chromium session | Yes | Yes / No | Not documented | 15 min / 1 h / 24 h | No / No | No | Python, JavaScript/TypeScript, Go, Rust, CLI, REST API, MCP server |
Frequently asked questions
Which sandbox supports Windows desktops for agents?
Cite this page
Agent Sandboxes. (2026). Choosing a sandbox for computer-use and browser agents. agentsandboxes.org. Last reviewed November 9, 2026. https://agentsandboxes.org/use-cases/computer-use/
Found an error or a missing sandbox? Submit a correction — every entry links to the sources it relies on.