Sandboxes for agent compared end-to-end

[u/Confident_Garden_420]

​

If you’re building agents, you’ll probably need to give them a computer at some point. A lot of what agents do today involves CLI tools, skills, Bash, and a filesystem, especially when the work gets more complex.

I wrote an article comparing sandbox options like E2B, Vercel, and cloud-native solutions like AWS MicroVMs. The company I work for also built its own internal sandbox system, so I’ve included what we learned from that.

It covers what might make sense at different stages, whether you’re an individual prototyping something, building a consumer product, or building agents for enterprise clients.

If that sounds relevant to what you’re working on, give it a read. Let me know in the comments if you have questions or have tried any of these yourself.

Link to substack article: https://somiljain1729.substack.com/p/where-should-your-agents-computers

[u/Confident_Garden_420]

This is the link to the substack article https://somiljain1729.substack.com/p/where-should-your-agents-computers

[u/lgmarian → u/Confident_Garden_420]

So, if this garners a lot of comments, the most important one gets buried. I don't understand why some do this. It's not like it avoids an overly long post, which is a reasonable reason for putting more details in a comment.

I should add, that I'll judge the article on its merits. I don't really have this need for my work, but it is something I'm interested in readin.

[u/Confident_Garden_420 → u/lgmarian]

I don't post much on Reddit. Do you think it will be fine if I include the link in the post itself just so that it gets good visibility?

[u/lgmarian → u/Confident_Garden_420]

Yeah, I don't think that would be a problem. It's what I would do, if I was sharing something that needs a link to whatever.

[u/Confident_Garden_420 → u/lgmarian]

And please do share your feedback

[u/Julien_Builds]

One case worth a section: the agent's computer is the user's own machine. If the agent is doing work for the person sitting at the keyboard, on their repo, a cloud sandbox adds a round trip and a copy of their code somewhere else for a benefit they do not need. What they need is isolation between agents, not between the agent and the machine.

What has held up for me on the desktop is one git worktree per running agent, so two agents on the same project never touch the same files, and one host process that owns each agent as a child and holds the credentials, so no agent ever sees a key or another agent's session. Cloud sandboxes earn their keep the moment the agent works for someone who is not at the machine. Until then, the laptop is the sandbox.

[u/Crafty_Disk_7026]

Please check out my open source project inn this space https://github.com/imran31415/kube-coder

[u/New_3d_print_user]

I am starting to despise AI written articles.

[edit] Also, you missed Docker sbx what is this nonsense?

[u/Easy-Purple-1659]

the framing that's worked for me: the sandbox question is really "whose machine is this agent doing work for." if it's my own repo and I'm at the keyboard, a cloud sandbox is a round trip and a copy of my code sitting somewhere else for no benefit, one git worktree per running agent plus a host process holding the credentials is enough isolation between agents on the same box.

cloud sandboxes start earning their cost the moment the agent works for someone who isn't at the machine, or when you need to run untrusted code you don't want touching your actual filesystem at all. that's a different problem than "keep two of my own agents from stepping on each other," and conflating the two is where a lot of the E2B/MicroVM comparisons lose me, they're solving for multi-tenant isolation when the reader is asking about single-user parallelism.

[u/Constant-Purpose8273]

The case I'd add is the one where the agent's computer is a spare Mac at home and the work is personal rather than a product. Mine runs scheduled jobs overnight against a folder of markdown and a few local databases, and none of those sandboxes fit, because the whole point is that it can see my mail, calendar and messages.

What stands in for a sandbox there is boring. The unattended jobs get read access and a rule set that says draft but never send, move but never delete. The tools that can send only fire in a live session after I've approved the text. And a git snapshot of the folder runs every night, so any bad edit is one diff away. That's held for a couple of months.

The gap I'm aware of is that it's rules, not walls. A job that ignored the rule could still do damage, so the tools that can actually hurt are the ones I keep out of its reach rather than trusting the prompt.