Choosing an agent sandbox for enterprise and BYOC
Enterprises usually need sandboxes inside their own cloud boundary plus audit evidence. The three routes are BYOC from a sandbox vendor (E2B, Daytona, Northflank), a hyperscaler-native service (AWS AgentCore, Azure Dynamic Sessions), or self-hosting open source. Ask each vendor for SOC 2 Type II reports, HIPAA BAAs, VPC and private-endpoint options, SSO and audit logs.
What enterprise and BYOC deployments need from a sandbox
Enterprises typically need code and data to stay within their own cloud boundary, plus audit evidence:
- BYOC or in-account deployment, or a hyperscaler-native service.
- Compliance: SOC 2 Type II, HIPAA BAAs, ISO 27001.
- Network integration: VPC peering, private endpoints, egress policy.
- Governance: SSO, audit logs, quotas.
Sandboxes that fit, by kind
10 sandboxes document what this workload needs. They are grouped by kind and listed alphabetically; the order is not a ranking. Shortlist two or three, then pilot them with your own workload.
Hosted sandbox platforms
SDK-driven sandboxes you create, run code in and destroy through an API.
Daytona
Stateful sandboxes for AI-generated code — Linux containers, Linux and Windows VMs, macOS and GPU sandboxes — with snapshots, volumes and preview URLs.
- Containers or VMs
- BYOC
- GPU
- Pause/resume
Why it fits: BYOC on your own runner nodes with SSO, audit logs and stated SOC 2 and HIPAA compliance.
E2B
Open-source cloud sandboxes for AI agents, each a Firecracker microVM, with pause/resume, snapshots and forking.
- Firecracker microVM
- Open source
- Self-hostable
- BYOC
- Pause/resume
Why it fits: Enterprise BYOC on AWS, Google Cloud or Azure with SOC 2 Type II and HIPAA BAA on request, plus an open codebase for review.
Compute platforms with sandboxes
General serverless or app platforms that also offer sandboxes, often with GPUs.
Modal Sandboxes
Sandboxes on Modal’s serverless compute platform for running untrusted code at very high scale, with GPUs, snapshots and tunnels.
- gVisor or VM
- GPU
- Pause/resume
Why it fits: SOC 2 on all plans and HIPAA on Enterprise, for teams comfortable with a hosted platform.
Northflank Sandboxes
Sandboxes on Northflank’s Kubernetes-based platform — microVMs for CPU work, gVisor for GPUs — on Northflank’s cloud or in your own cloud account.
- Cloud Hypervisor microVM
- BYOC
- GPU
- Pause/resume
Why it fits: BYOC on AWS, GCP, Azure, Oracle or bare metal with SOC 2 Type II, HIPAA and ISO 27001 — weigh the October 2026 incident.
Cloud provider code execution
Managed code-execution tools from AWS, Azure, Google Cloud and OpenAI.
AWS Bedrock AgentCore
AWS’s managed agent platform: a Code Interpreter tool for running agent-generated code and a Runtime that hosts each agent session in its own microVM.
- MicroVM (Runtime)
Why it fits: Runs natively in your AWS account context with IAM, VPC and HIPAA eligibility across 15 regions.
AWS Lambda MicroVMs
A Lambda resource type that runs a full Amazon Linux 2023 environment in a Firecracker microVM, restored from a pre-built snapshot, with suspend/resume and an HTTPS endpoint per VM.
- Firecracker microVM
- Pause/resume
Why it fits: A Lambda resource type giving each session a suspendable Firecracker microVM with an inbound endpoint, under your existing AWS IAM, VPC and billing.
Azure Container Apps dynamic sessions
Azure service that hands out Hyper-V-isolated sessions from prewarmed pools, either as a built-in code interpreter or running your own container image.
- Hyper-V VM
Why it fits: Hyper-V isolation inside your Azure subscription with egress off by default.
Browser and desktop sandboxes
Hosted browsers and full desktops that computer-use agents click, type and browse in.
Anchor Browser
Cloud browsers for agents with a dedicated VM per browser, managed authentication identities, persistent volumes and a Web-Bot-Auth-verified Chromium fork.
- Dedicated VM per browser
- BYOC
Why it fits: For browser agents: a dedicated VM per browser with managed logins, SSO and MFA.
Cloud development environments
Cloud and in-browser development environments that coding agents increasingly run in.
Coder
Self-hosted cloud development environments defined in Terraform (VMs, Kubernetes pods or Docker containers) for developers and coding agents, with a control-plane-hosted agent loop so workspaces hold no model credentials.
- Template-defined (VM/pod/container)
- Open source
- Self-hostable
- Pause/resume
Why it fits: Self-hosted on your own clusters and clouds, with audit and governance for coding agents.
Ona (formerly Gitpod)
Enterprise cloud development environments provisioned as isolated VMs (EC2 or Compute Engine) in your own VPC from a Dev Container config, with SDKs, a CLI and Codex-based background agents; hosted Ona Cloud was retired on 31 October 2026.
- Dedicated cloud VM
- BYOC
- GPU
- Pause/resume
Why it fits: VM-isolated Dev Container environments for developers and background agents, run inside your own AWS or GCP VPC; enterprise-only.
Side by side
| Sandbox | Isolation | Open source | Self-host / BYOC | Cold start (vendor) | Max session | Snapshots / pause | GPU | SDKs |
|---|---|---|---|---|---|---|---|---|
| Anchor Browser | Dedicated VM per browser | No | No / Yes | Not documented | 3 h default, configurable | No / No | No | Python, JavaScript/TypeScript, REST API, MCP server |
| AWS Bedrock AgentCore | MicroVM (Runtime) | No | No / No | Not documented | Up to 8 h | Not documented / Not documented | No | Python (AgentCore SDK), AWS SDKs, AWS CLI |
| AWS Lambda MicroVMs | Firecracker microVM | No | No / No | sub-second to seconds (claimed) | 8 h | Yes / Yes | No | Python, JavaScript/TypeScript, PHP, CLI, REST API |
| Azure Container Apps dynamic sessions | Hyper-V VM | No | No / No | Sub-second (pooled) | 220 s / exec | No / No | No | REST API, Azure CLI, LangChain, LlamaIndex, Semantic Kernel |
| Coder | Template-defined (VM/pod/container) | Yes | Yes / No | Not documented | Not documented | Not documented / Yes | Not documented | CLI, REST API, MCP server |
| Daytona | Containers or VMs | No | Not documented / Yes | <90 ms | Unlimited | Yes / Yes | Yes | Python, TypeScript, Ruby, Go, Java |
| E2B | Firecracker microVM | Yes | Yes / Yes | Not documented | 1 h / 24 h (Pro) | Yes / Yes | No | Python, JavaScript/TypeScript |
| Modal Sandboxes | gVisor or VM | No | No / Not documented | <1 s | Up to 24 h | Yes / Yes | Yes | Python, JavaScript/TypeScript, Go |
| Northflank Sandboxes | Cloud Hypervisor microVM | No | No / Yes | <1 s | Unlimited | Not documented / Yes | Yes | JavaScript/TypeScript, Python |
| Ona (formerly Gitpod) | Dedicated cloud VM | No | No / Yes | Not documented | Not documented | Not documented / Yes | Yes | Python, JavaScript/TypeScript, Go, CLI, REST API |
Frequently asked questions
Which agent sandboxes can run in my own AWS account?
Cite this page
Agent Sandboxes. (2026). Choosing an agent sandbox for enterprise and BYOC. agentsandboxes.org. Last reviewed November 9, 2026. https://agentsandboxes.org/use-cases/enterprise/
Found an error or a missing sandbox? Submit a correction — every entry links to the sources it relies on.