conceptagentssandboxesinfrastructuremicrovmisolationmodale2bdaytonastateUpdated 2026-07-04

Agent Sandboxes

Sandboxes started as safe environments for running untrusted code. As agents become persistent and stateful, the sandbox is evolving into the operating environment agents actually work inside. Source: X/@crystalxtang, 2026-05-27

View original tweet
View original tweet
View original tweet
View original tweet

Three workload shapes

Sandbox use cases split along two axes, how long they run and how much state they hold, which collapse into three dominant shapes. Source: X/@crystalxtang, 2026-05-27

  • Simple code execution: short-lived environments that spin up, run code, and disappear. The default for most LLM tool calls today.
  • Stateful environments: longer-lived, dev-like sessions with persistent filesystems and multi-step workflows that last hours.
  • Compute-heavy workloads: GPU-bound, parallelizable, cost-intensive jobs (small-model training, inference, batch, CI).

Market map evidence

The local chart groups providers by statefulness and compute intensity. In the reviewed image, E2B, Vercel, and Cloudflare sit in the stateless/lightweight execution quadrant; Daytona, Runloop, declaw, CodeSandbox, and Hopx sit toward stateful lightweight environments; Modal, Northflank, and Tensorlake sit toward stateless compute-heavy workloads; Blaxel is nearer the center. Treat this as a market snapshot, not a taxonomy contract. It is useful because it makes each provider's implicit bet visible: short code execution, persistent devboxes, or heavier compute. Source: local image artifact, 2026-07-02

Isolation primitives and performance

Containers are lightweight and fast; microVMs give stronger isolation and are generally seen as the default "right" primitive; gVisor sits in between. Performance becomes multi-dimensional once a sandbox persists past one request: cold start dominates for code execution, resume time (snapshotting, warm pools) dominates for long-running sessions, and concurrency, disk, and workload density dominate at scale. Source: X/@crystalxtang, 2026-05-27

Filesystem as the agent memory layer

As agents accumulate context across files, logs, and cached data, the filesystem has become the default memory layer, so the execution environment stops being disposable and starts behaving like a persistent workspace. That demands snapshot and restore across sessions, branching and forking of execution state, and mounting of external storage (S3, blob, databases). This is the infra-side counterpart to Agent Memory Patterns. Source: X/@crystalxtang, 2026-05-27

Vercel Sandbox persistence is the mainstream platform version of that shift. A Vercel Sandbox is a long-lived named entity; each Session is one running VM. Stopping snapshots filesystem state, and resuming starts a new session from the latest snapshot. That design keeps the orchestration layer in control while preserving agent workspace state across compute sessions, which is why it belongs on the sandbox page even though it is not the same product shape as an always-on devbox. Source: Vercel changelog, 2026-03-26; Source: Vercel Sandbox docs, 2026-07-04

The 2026-06-16 duration change pushes that platform model further into long-running work. Vercel Sandboxes can now run uninterrupted sessions for up to 24 hours, up from 5 hours, with Sandbox.create({ timeout: 24 * 60 * 60 * 1000 }). Vercel frames the limit around large-scale data processing, E2E test pipelines, and long-lived agentic workflows, and explicitly recommends pairing the longer runtime with persistent sandboxes for durable state. The 24-hour maximum is available on Pro and Enterprise. Source: X/@vercel_dev, 2026-06-17; Source: Vercel changelog, 2026-06-16

View original tweet

Harness placement

A core architecture question is where the harness lives. Outside the sandbox, orchestration stays always-on while environments spin up only when execution is needed; this improves responsiveness but complicates the trust boundary, and is the direction Claude Managed Agents and OpenAI's Agents SDK took. Inside the sandbox, isolation gets simpler but startup latency becomes critical and orchestration is less flexible. See Harness Engineering. Source: X/@crystalxtang, 2026-05-27

The same boundary is starting to appear in CI/CD product ideas. Brendan Irvine-Broque's "CI/CD from first principles" bookmark describes CI as a workflow plus a sandbox: TypeScript orchestration instead of opaque GitHub Actions YAML, local debugging, durable execution, retries, and VM/directory snapshots. There is no source artifact beyond the tweet, so this is not a tool endorsement; it is a concise statement of the product direction where CI becomes a debuggable workflow runtime over persistent execution state. Source: X/@irvinebroque, 2026-06-21

Provider bets

Each major provider optimizes for a different agentic future: Modal treats sandboxes as one workload on a broader compute layer (betting on traditional infra shapes), e2b uses Firecracker microVMs and bets most execution stays stateless, and Daytona ships a container-based devbox betting on persistent operating environments. At enough scale, companies stop buying and build in-house: the baseline is commoditizing, cold starts are converging, and the real competition is hyperscalers (AWS already exposes Lambda, ECS, and Firecracker). Source: X/@crystalxtang, 2026-05-27

Rivet agentOS is the WebAssembly/in-process VM counter-position: instead of provisioning a full sandbox per task, run an agent in a lightweight runtime with filesystem/process semantics, deny-by-default permissions, and orchestration hooks. Its launch claims extreme cold-start, memory, and cost improvements versus SaaS sandboxes, but the routing boundary matters: use it for resident agent loops and controlled command execution; keep full sandboxes or microVMs for browser/dev-server/native dependency work and hostile code. Source: X/@rivet_dev, GitHub, npm, local video review, 2026-07-04

A newer shape worth tracking: Orgo sells computer-use desktops — full GUI VDI machines agents drive by screenshot, sub-500ms boot — rather than code sandboxes, a distinct bet from the Modal/e2b/Daytona code-execution lineage. Source: orgo.ai, 2026-06-15

Above the providers sits a unification layer: ComputeSDK gives one typed API over 14+ of them (E2B, Modal, Daytona, Vercel, Cloudflare, …), so app code is provider-agnostic — the sandbox analog of the Vercel AI SDK / OpenRouter for models, and the open-source shape of Agent Machines' substrate routing. Source: computesdk.com, 2026-06-15

Relevance to Kevin

Grounds the agent-infra layer behind Open Agents.dev (Sandboxes plus Workflow SDK plus AI Gateway) and the Browser Testing Skills skill. AI SDK 7 HarnessAgent pairs harness adapters with createVercelSandbox() — see AI SDK HarnessAgent. The "sandbox as agent OS" framing reinforces Agent Operating System: persistent, stateful execution is becoming the substrate, not a disposable utility.

Timeline

Related Pages

Open Agents.devBrowser Testing SkillsAgent Operating SystemHarness EngineeringAgent Memory PatternsAI SDK HarnessAgentOrgoComputeSDKContainers Are Not a Security BoundaryMicroVM and Sandbox Isolation ArchitectureSandbox Startup Latency (Started ≠ Ready)Modal LabsagentOS

28 pages link here

Agent MachinesProjectsAgent Process Tracking, Audit, And CleanupConceptsagentOSToolsAgents as Service Workers (as a Service)ConceptsAI SDK HarnessAgentToolsBrowser Agent ConsoleConceptsClaude Managed AgentsToolsComputeSDKToolsConcept System MapConceptsContainers Are Not a Security BoundaryConceptsCrabboxToolsEmulate (Vercel-labs)ToolsFirecrackerToolsFlociToolsHyperagentToolsJuiceFSToolsManus (AI Agent)ToolsMicroVM and Sandbox Isolation ArchitectureArchitectureMiniMax M3ToolsOpen Agents.devToolsOpenComputer Durable Agent SessionsToolsOrgoToolsSandbox ArenaProjectsSandbox Startup Latency (Started ≠ Ready)ConceptsX Bookmark Ingest 2026-06-28ResearchX Bookmarks: AI Agents & Tools (Jan 2025 – Jun 2026)ToolsX Bookmarks: Dev Tools (Mar–Jun 2026)ToolsZeroFSTools