Choosing a GPU sandbox for AI agents
Most microVM sandboxes are CPU-only, because GPU passthrough to microVMs is hard. GPU sandboxes come mainly from compute platforms (Modal, Beam, Northflank, Koyeb), Daytona’s GPU sandboxes, or GKE on your own cluster. Compare the GPU models available, per-second vs hourly billing, multi-GPU support and the isolation used for GPU workloads, which is usually gVisor or containers rather than microVMs.
What GPU workloads need from a sandbox
Some agents need a GPU inside the sandbox — to fine-tune a model, run inference, process video or execute ML code they wrote. Most microVM sandboxes are CPU-only, because GPU passthrough to microVMs is hard, so GPU sandboxes usually use gVisor or containers. Check:
- GPU range and availability (and whether multi-GPU is supported).
- Billing granularity — per second matters for short jobs.
- Isolation for GPU workloads, which is often weaker than for CPU sandboxes.
Sandboxes that fit, by kind
10 sandboxes document what this workload needs. They are grouped by kind and listed alphabetically; the order is not a ranking. Shortlist two or three, then pilot them with your own workload.
Hosted sandbox platforms
SDK-driven sandboxes you create, run code in and destroy through an API.
Daytona
Stateful sandboxes for AI-generated code — Linux containers, Linux and Windows VMs, macOS and GPU sandboxes — with snapshots, volumes and preview URLs.
- Containers or VMs
- BYOC
- GPU
- Pause/resume
Why it fits: GPU sandboxes with up to 8 GPUs, from RTX 4090 to B300 and AMD MI355X, at published hourly rates.
Tensorlake Sandboxes
MicroVM sandboxes with memory snapshots, copy-on-the-fly cloning, warm pools and egress policy, alongside hosted Git and a versioned filesystem, with an Apache-2.0 runtime and BYOC on AWS.
- MicroVM (gVisor for GPU)
- Open source
- Self-hostable
- BYOC
- GPU
- Pause/resume
Why it fits: H100 GPU sandboxes on gVisor by request, at a reserved per-GPU-hour rate, alongside its CPU sandboxes.
Compute platforms with sandboxes
General serverless or app platforms that also offer sandboxes, often with GPUs.
Beam Sandboxes
Serverless AI compute platform whose sandboxes are gVisor-isolated containers with memory snapshots, optional GPUs and an open-source, self-hostable runtime.
- gVisor
- Open source
- Self-hostable
- BYOC
- GPU
- Pause/resume
Why it fits: Serverless GPU platform with sandboxes for running agent code on GPUs.
Koyeb Sandboxes
Ephemeral microVM sandboxes on Koyeb’s serverless platform for AI-generated code, with CPU or GPU and scale-to-zero.
- MicroVM
- GPU
Why it fits: GPU-capable microVM sandboxes (public preview) on Koyeb’s serverless platform, now part of Mistral AI.
Modal Sandboxes
Sandboxes on Modal’s serverless compute platform for running untrusted code at very high scale, with GPUs, snapshots and tunnels.
- gVisor or VM
- GPU
- Pause/resume
Why it fits: The full GPU range from T4 to B300 inside sandboxes at per-second rates, on gVisor isolation, with a mature serverless GPU platform behind it.
Northflank Sandboxes
Sandboxes on Northflank’s Kubernetes-based platform — microVMs for CPU work, gVisor for GPUs — on Northflank’s cloud or in your own cloud account.
- Cloud Hypervisor microVM
- BYOC
- GPU
- Pause/resume
Why it fits: L4 to B200 under gVisor on Northflank’s cloud, or on your own GPU nodes via BYOC.
Code execution APIs
Submit code, get output: online judges, compiler APIs and Jupyter kernels as a service.
Datalayer Runtimes
Remote Jupyter kernels as a service for AI agents: stateful CPU or GPU runtimes created on demand from Python or TypeScript, with snapshots of installed packages, files and variables, and a hosted Jupyter MCP Server.
- Not documented
- GPU
- Snapshots
Why it fits: GPU-backed Jupyter kernels as a service for agents that need a stateful kernel with accelerators.
Cloud development environments
Cloud and in-browser development environments that coding agents increasingly run in.
Ona (formerly Gitpod)
Enterprise cloud development environments provisioned as isolated VMs (EC2 or Compute Engine) in your own VPC from a Dev Container config, with SDKs, a CLI and Codex-based background agents; hosted Ona Cloud was retired on 31 October 2026.
- Dedicated cloud VM
- BYOC
- GPU
- Pause/resume
Why it fits: Enterprise environments in your own AWS VPC include GPU environment classes on g5 instances.
Open-source runtimes to self-host
Open-source sandbox runtimes you run on your own servers or Kubernetes.
Kubernetes Agent Sandbox
Open-source Kubernetes controller and CRDs for isolated, stateful sandbox pods for AI agents, with first-class support on GKE.
- gVisor or Kata
- Open source
- Self-hostable
- BYOC
- GPU
- Pause/resume
Why it fits: GPUs and TPUs with gVisor on GKE for teams running their own clusters.
Isolation primitives and runtimes
The hypervisors, user-space kernels, OS sandboxes and WebAssembly runtimes that sandbox platforms build on.
gVisor
Google's user-space application kernel for containers, with the runsc OCI runtime, GPU passthrough via nvproxy and checkpoint/restore; used by Modal, Beam, Anthropic, OpenAI and Google Cloud.
- User-space kernel
- Open source
- Self-hostable
- GPU
- Snapshots
Why it fits: If you build your own: gVisor’s nvproxy runs most CUDA applications on T4, A100, A10G, L4 and H100, which is how several platforms run GPU sandboxes.
Side by side
| Sandbox | Isolation | Open source | Self-host / BYOC | Cold start (vendor) | Max session | Snapshots / pause | GPU | SDKs |
|---|---|---|---|---|---|---|---|---|
| Beam Sandboxes | gVisor | Yes | Yes / Yes | ~0.5 s | Configurable | Yes / Yes | Yes | Python, TypeScript |
| Datalayer Runtimes | Not documented | No | No / No | Not documented | Minutes (set per runtime) | Yes / Not documented | Yes | Python, JavaScript/TypeScript, CLI, MCP server, REST API |
| Daytona | Containers or VMs | No | Not documented / Yes | <90 ms | Unlimited | Yes / Yes | Yes | Python, TypeScript, Ruby, Go, Java |
| gVisor | User-space kernel | Yes | Yes / No | ms (claim) | Not documented | Yes / Not documented | Yes | CLI |
| Koyeb Sandboxes | MicroVM | No | No / Not documented | Not documented | Up to 24 h | Not documented / Not documented | Yes | Python, JavaScript/TypeScript |
| Kubernetes Agent Sandbox | gVisor or Kata | Yes | Yes / Yes | <1 s (warm pool) | Not documented | Yes / Yes | Yes | Kubernetes CRDs, Python, kubectl |
| Modal Sandboxes | gVisor or VM | No | No / Not documented | <1 s | Up to 24 h | Yes / Yes | Yes | Python, JavaScript/TypeScript, Go |
| Northflank Sandboxes | Cloud Hypervisor microVM | No | No / Yes | <1 s | Unlimited | Not documented / Yes | Yes | JavaScript/TypeScript, Python |
| Ona (formerly Gitpod) | Dedicated cloud VM | No | No / Yes | Not documented | Not documented | Not documented / Yes | Yes | Python, JavaScript/TypeScript, Go, CLI, REST API |
| Tensorlake Sandboxes | MicroVM (gVisor for GPU) | Yes | Yes / Yes | ~100s of ms (claim) | 2 h / 24 h / unlimited (Pro) | Yes / Yes | Yes | Python, JavaScript/TypeScript, Rust, CLI, REST API |
Frequently asked questions
Does E2B support GPUs?
Cite this page
Agent Sandboxes. (2026). Choosing a GPU sandbox for AI agents. agentsandboxes.org. Last reviewed November 9, 2026. https://agentsandboxes.org/use-cases/gpu/
Found an error or a missing sandbox? Submit a correction — every entry links to the sources it relies on.