Sandboxing & Execution Environments

Core concepts

1. Why sandboxes are ephemeral by default: Isolation is the whole point — a clean slate every run is a safety property, not a limitation, until your agent's task genuinely requires state across runs.
2. Persistent storage as an add-on, not a default: Every serious sandbox provider now offers some form of persistent volume or drive — the trick is only reaching for it when the task actually needs it.
3. Pause/resume vs fresh-start: Some providers (E2B) let you pause a running sandbox and resume it in roughly a second; others favor spinning up fresh every time — a real architectural choice, not just a feature checkbox.

What Is It?

Sandboxing runs untrusted agent-generated code in micro-VMs or containers.

Features include pause/resume, forks, persistent volumes, and network policies.

Child pages compare E2B, Modal, and Vercel Sandbox.

Why Should I Care?

One rm -rf or crypto miner in your VPC ends the project — and maybe your job.

CodeAgent-style frameworks assume sandboxes exist.

Real World Analogy

Sandboxing is a science lab fume hood — experiments run inside so explosions do not take out the whole building.

Visual Mental Model

agent -> sandbox VM/container
  ephemeral vs persistent volumes

Beginner Explanation

Any agent that executes code needs isolation. This hub compares E2B, Modal, and Vercel Sandbox patterns — pause/resume, GPUs, drives.

Smallest Possible Example

POLICY = {"allow_subprocess": False}
print("sandbox required:", not POLICY["allow_subprocess"])

Common Mistakes

❌ Running agent code on the same host as prod DB credentials.

Treat sandboxes as hostile environments always.

❌ Wide-open egress from sandboxes.

Exfiltration and SSRF attacks start here.

❌ No timeouts on long-running agent commands.

Runaway loops burn CPU budgets forever.

Real Project Example

E2B powers many code-interpreter demos in agent products.

Modal sandboxes show up in GPU-heavy agent tooling.

Build This Mini Project

List every command your agent can run; mark read vs write vs network; decide which require sandbox isolation.

Interview Question

Why sandbox agent code execution?

Model-generated code is untrusted — sandboxes limit filesystem, network, and resource access so compromises stay contained.

Key Takeaways

• Non-optional for code execution.
• Hub compares major sandbox vendors.
• Restrict network egress by default.
• Always enforce timeouts.

YouTube learning

Core concepts from video walkthroughs:

• Building coding agents with tool execution (E2B course)
• E2B — let LLM agents run code safely
• Agent sandboxes with Vercel AI SDK workshop

The 60-second story

You would not let a new hire debug a production database by running whatever script they typed into your laptop’s terminal. An agent that writes code is that hire, fast and confident. A sandbox is a hotel room you can throw away. They can make a mess. The mess does not follow you home.

Ephemeral is the default because leftover files are how the next guest inherits the last guest’s secrets. A clean room every run is a safety property. It feels like a limitation the first time you want a cache. Persistent storage is the add-on: a locker in the hall, not a suitcase you leave in the room. Reach for the locker when the task truly spans runs. Do not reach for it because wiping files feels rude.

Pause and resume is freezing the room, mess and all, and walking back in about a second later. E2B is known for that. A fresh start is a new room, which is simpler and sometimes slower. That choice is architecture. A paused room remembers a half-edited file. A fresh room cannot leak it, and it also cannot continue it. Pick with the threat in mind, not with the demo in mind.

Map the hotel.

• The agent is the guest who writes code.
• The sandbox is the room.
• Ephemeral means housekeeping strips the room.
• A volume or drive is the hall locker.
• Pause/resume is freezing the room.
• A fresh start is a new key.
• E2B, Modal, and Vercel Sandbox are different hotels with different locker rules.

run agent in a room
keep secrets and repos out of the room unless the task needs them
throw the room away

Three lines. The incidents come from line two, when someone mounts the home directory because it was easy.

Sandboxes exist because “the model only writes Python” is not a permission system. Python can read files. Isolation is the permission. Persistence was added later because real jobs have artifacts. The mistake is making persistence the default and calling the result safe.

Mental model: a hotel room, not your house. Housekeeping is a feature. The hall locker is optional and deliberate.

You have the page if you can argue for a clean room first, and name what you would store outside it. If you cannot name the locker, you are probably about to mount your home directory because it was the fastest path through the tutorial.