AI coding agent sandboxes 2026: E2B vs Daytona vs Modal vs Vercel on cost and security

Summary. For coding agents in October 2026, the sandbox choice comes down to isolation boundary, egress control and region, because list prices cluster tightly. E2B and Daytona both work out to $0.1656 an hour for a 2 vCPU / 4 GiB sandbox; E2B adds a $150 monthly Pro fee for 24-hour sessions and 100 concurrent sandboxes, while Daytona has no plan fee. Modal Sandboxes cost about $0.238 an hour at its 3x sandbox rate, Runloop $0.317, and Northflank's compute rate gives $0.067. Vercel Sandbox ($0.128 per active vCPU-hour plus $0.0212 per GB-hour of memory) and Cloudflare ($0.000020 per active vCPU-second) charge for CPU only while it is busy, which suits agents that mostly wait on a model. The 2026 news: Daytona moved its code to closed source on 11 June and archived the public repository in October; Vercel Sandbox went GA on 30 January and has run in 19 regions, including Mumbai, since September; Cloudflare Sandboxes went GA on 13 April; and E2B replaced its multi-node self-hosting guide with a single-machine edition. In our worked example for 40 engineers, monthly bills range from about $470 to $2,480. Pick E2B for an Apache-2.0 Firecracker default, Vercel for a managed sandbox in Mumbai today, and self-host on Kubernetes only when residency outweighs platform-team time.

About this article. Prices, isolation models, egress controls, regions and compliance claims were checked against vendor pages and documentation on 22 October 2026. Vendors change pricing often, so re-check before you commit. No vendor paid for inclusion or placement. Researched with AI assistance and reviewed by our editorial team.

What changed in 2026

Coding agents now run unattended for hours, cloning private repositories, installing packages and running test suites. The sandbox decides whether a prompt injection stays contained or becomes a leaked token. Six changes matter:

• Daytona went closed source. Its 11 June 2026 announcement says AI can now be pointed at an open repository to hunt for exploitable flaws. The last public release, v0.190.0, carries the AGPL-3.0 licence, and the repository was archived in October; Daytona's SDKs now live in a separate Apache-2.0 repository.

• Daytona fixed a credential exposure in April. API credentials passed into sandboxes could be read from memory because the default snapshot shipped with passwordless sudo. The issue was reported and fixed across regions on 9 April, in under five hours, and disclosed on 13 April.

• Vercel Sandbox went GA on 30 January 2026 and on 10 September expanded from four regions to Vercel's full set; its docs list 19, including Mumbai (bom1).

• Cloudflare Containers and Sandboxes went GA on 13 April 2026 with active-CPU pricing, and Modal added a VM runtime for sandboxes in its 28 September SDK release.

• E2B retired its Terraform self-hosting guide in September and replaced it with E2B Embed, a single-machine edition.

• GitHub's Copilot cloud agent runs in an ephemeral GitHub Actions environment and consumes Actions minutes plus GitHub AI Credits.

This article covers hosted sandbox providers. For hyperscaler agent runtimes, see our agent session isolation comparison.

The providers, one by one

E2B

E2B runs every sandbox in its own Firecracker microVM with its own kernel. The SDK repository and the runtime repository (formerly e2b-dev/infra) are Apache-2.0. Self-hosting is now E2B Embed, which its README describes as one machine by design, installed with Docker Compose, Terraform on AWS, Google Cloud or Azure, or a single Kubernetes node. The managed service runs mainly on Google Cloud, with an AWS US West option.

Billing is per second: $0.000014 per vCPU-second and $0.0000045 per GiB-second ($0.0504 per vCPU-hour, $0.0162 per GiB-hour). Hobby is free with a one-time $100 credit, 1-hour sessions and 20 concurrent sandboxes. Pro costs $150 a month plus usage, with 24-hour sessions and 100 concurrent sandboxes; the 600 and 1,100 concurrency add-ons (an extra $500 or $1,000) are listed but currently sold through support. Enterprise has a $3,000 monthly minimum and adds multi-day sessions and BYOC into your AWS, Google Cloud or Azure account.

Egress is open by default. IP and CIDR ranges can be allowed or denied, but domains can only be allow-listed, and domain filtering reads only the Host header on port 80 and SNI on port 443. Per-host request transforms, in public beta, inject a secret at the egress proxy on HTTPS requests so the value never enters the VM. E2B lists a SOC 2 Type II report, HIPAA BAAs on Enterprise and a GDPR DPA.

Best for: microVM isolation with Apache-2.0 code you could run yourself.

Daytona

Daytona charges $0.0504 per vCPU-hour, $0.0162 per GiB-hour and $0.000108 per GiB-hour of storage beyond 5 GiB, billed per second. Windows costs $0.0858 per vCPU-hour; GPUs run from $0.57 an hour (preemptible RTX 4090) to $6.25. New accounts get $200 of compute, not usable on GPUs; SSO, audit logs and BYOC sit on Enterprise.

Daytona's isolation docs describe container sandboxes (code runs as root), VM sandboxes with their own kernel, and GPU containers; pause, fork and hot snapshots are VM-only, so use the VM class for untrusted code. Internet access is restricted on usage Tiers 1 and 2 and open from Tier 3, which needs a $500 top-up, with block-all, CIDR and domain allowlists. Secrets enter as opaque placeholders that the outbound proxy swaps only for allowed hosts. Sandboxes have no hard time cap but stop after 15 minutes of inactivity by default, and a running process does not count as activity. Shared regions are the US and EU, plus dedicated regions and custom regions on your own compute. Daytona's trust centre shows a SOC 2 Type II report issued in July 2026. It advertises sub-90 ms sandbox creation; that is vendor-reported and eCorpIT did not test it.

Best for: stateful workspaces that fork and snapshot, plus Windows or GPU sandboxes.

Modal Sandboxes

Modal bills sandboxes at three times list: $0.00003942 per physical core-second (one core is 2 vCPUs) and $0.00000667 per GiB-second, charging the higher of request or actual usage. Starter is $0 with $30 of monthly credit and 100 containers; Team is $250 a month with $100 of credit and 5,000 containers; audit logs, SSO and HIPAA are Enterprise features. Pinning a region multiplies compute by 1.15x (broad) or 1.75x (narrow).

Sandboxes run on gVisor, which answers system calls in a user-space kernel, or on a VM runtime with its own Linux kernel; GPU sandboxes run on gVisor only. Timeouts reach 24 hours. Egress is open by default; Modal's networking guide offers a full block, a CIDR allowlist and a beta SNI-based domain allowlist, and DNS stays open unless everything is blocked. Secret injection, also in beta, replaces headers on outbound HTTPS requests.

Best for: agents that also need GPUs or burst to thousands of sandboxes. See our inference platforms comparison.

Vercel Sandbox

On Pro in iad1, Vercel charges $0.128 per active vCPU-hour, $0.0212 per GB-hour of memory, $0.60 per million creations and $0.08 per GB-month of snapshots; in Mumbai the CPU and memory rates are $0.140 and $0.0232. Time spent waiting on I/O or model calls is not active CPU, but memory is billed for the whole run. Each vCPU comes with 2 GB of memory. Hobby includes 5 CPU-hours, 420 GB-hours and 45-minute sessions; Pro allows 24-hour sessions, 10,000 concurrent sandboxes and up to 8 vCPU / 16 GB.

Each sandbox is a Firecracker microVM with its own kernel, persistent by default, and Vercel lists SOC 2 Type II. Snapshots expire 30 days after last use and cannot move between regions. Egress is open by default and restricted with firewall network policies; transform rules broker credentials so secrets never enter the sandbox. Secure Compute, which adds static IPs and VPC peering, is Enterprise-only.

Best for: TypeScript teams on Vercel, and anyone needing a managed sandbox in Mumbai today.

Cloudflare Sandboxes

Cloudflare Sandboxes run on Containers under the $5-a-month Workers Paid plan, billed per 10 ms: $0.000020 per active vCPU-second (375 vCPU-minutes included), $0.0000025 per GiB-second of provisioned memory (25 GiB-hours included) and $0.00000007 per GB-second of provisioned disk (200 GB-hours included). Workers and Durable Objects charges apply on top.

Each instance is a microVM with its own kernel; the Durable Object scheduling policy that sandboxes use is in public beta. Default instance limits run to 4 vCPU and 12 GiB, custom types need at least 3 GiB per vCPU, and accounts start at 1,500 concurrent vCPUs, all of which Cloudflare can raise. Plain Containers can be constrained to regions or the EU jurisdiction, but sandboxes cannot, and no Indian placement exists. The standout feature is the outbound handler: trusted Worker code allows hosts and attaches credentials after the request leaves the sandbox.

Best for: Workers teams wanting credential brokering in code they control.

Northflank and Runloop

Northflank runs sandboxes in Kata Containers microVMs or under gVisor, on its own infrastructure or inside your VPC, with no forced time limit. Its compute rates, $0.01667 per vCPU-hour and $0.00833 per GB-hour, billed per second with no plan fee, are the lowest list price here. Its security page lists SOC 2 and HIPAA, with BAAs under an Enterprise contract.

Runloop sells microVM devboxes at $0.108 per vCPU-hour and $0.0252 per GB-hour; Pro costs $250 a month, and suspended devboxes stop accruing compute and memory charges. It lists a Credential Gateway for opaque token injection, per-devbox egress policies, SOC 2 Type II and VPC deployment on Enterprise. A devbox can stay alive for up to 48 hours.

Self-hosted: Kubernetes agent-sandbox

kubernetes-sigs/agent-sandbox (Apache-2.0, v1.0.x, with v1.0.7 the latest release at the time of writing) adds a Sandbox resource plus template, claim and warm-pool extensions. It orchestrates; gVisor or Kata isolates, through a RuntimeClass:

            apiVersion: agents.x-k8s.io/v1beta1
kind: Sandbox
metadata:
  name: agent-task-1234
spec:
  podTemplate:
    spec:
      runtimeClassName: gvisor   # must match a RuntimeClass in your cluster
      containers:
      - name: workspace
        image: registry.internal/agent-workspace:2026-10
        resources:
          requests: { cpu: "500m", memory: "4Gi" }
          limits: { cpu: "2", memory: "4Gi" }
          

The template, claim and warm-pool resources use the extensions.agents.x-k8s.io/v1beta1 API group. You own runtime hardening, egress proxies, secrets and audit. Our agent-sandbox patterns guide covers the build.

Agent products with a built-in sandbox

In OpenAI's legacy Codex cloud environments, internet access is blocked during the agent phase by default, and the docs list code or secret exfiltration among the risks of opening it. The current environments add an internet toggle with presets and pass network secrets as placeholders that a proxy replaces. GitHub's Copilot firewall is on by default, but GitHub notes it covers only processes the agent starts through its Bash tool, not MCP servers. Anthropic's sandbox-runtime is an Apache-2.0 research preview that wraps local processes with sandbox-exec on macOS and bubblewrap on Linux. See our coding-agent harness comparison.

Head-to-head comparison

Cloudflare needs at least 6 GiB for 2 vCPU; the row uses its 8 GiB standard-3 type, which comes with 16 GB of disk.

Security model: where exfiltration happens

Containers share the host kernel. gVisor narrows that surface in user space; a microVM adds a hardware virtualisation boundary and a separate guest kernel. For code an LLM wrote after reading an untrusted README, use gVisor or a microVM, never a plain container.

The boundary is rarely how data leaves, though. The usual chain: a malicious issue or dependency tells the agent to run a command, the command reads a token from an environment variable or .git/config, and curl sends it out. Cloudflare's sandbox security guide uses exactly this example: a Worker puts a token in a clone URL, Git saves it in .git/config, and code from a test dependency reads it. Its containers start with internet access off, and the guide says to keep it off when you use an outbound handler.

Control checklist:

1. Boundary: microVM or gVisor for agent-executed code; Daytona VM class, not container class.

1. Default-deny egress: allow only your git host, package proxy and model API; SNI filters miss DNS and non-TLS ports.

1. Secrets outside the VM: proxy-side injection, never tokens in environment variables, clone URLs or files.

1. Short-lived credentials: one scoped token per task, revoked when the sandbox exits.

1. Snapshot hygiene: snapshots carry leaked tokens too; set retention and never reuse one across users.

1. Supply chain: install through a scanning registry proxy, pin lockfiles, disable install scripts where possible.

1. Identity binding: derive the sandbox name from the authenticated user.

1. Audit: log creation, commands and blocked egress.

1. Output: treat sandbox output and previews as untrusted.

Our guides on prompt injection guardrails and Xcode 27 agent security cover the agent side.

Decision table

Worked cost example: 40 engineers

Assumptions, labelled so you can swap in your own:

• 40 engineers × 8 sandbox-hours per working day (two parallel agents for four hours) × 22 days = 7,040 sandbox-hours a month.

• 2 vCPU / 4 GiB per sandbox, 10 GiB disk, peak concurrency under 100.

• 25% average CPU utilisation for active-CPU billers, because agents mostly wait on the model.

• Default-region list prices; egress, snapshots, model tokens, seat fees and taxes excluded.

Cloudflare's line excludes Workers and Durable Objects request charges, and Vercel's excludes Pro seats. In Mumbai, Vercel's higher rates lift its line to $1,146.11.

Self-hosted estimate (EKS, gVisor, agent-sandbox). Assume m7i.2xlarge nodes (8 vCPU, 32 GiB) at AWS's Mumbai on-demand rate of $0.4242 an hour, six sandboxes per node, a 1.3x packing factor, two always-on nodes and the $0.10 an hour EKS fee:

• Sandbox nodes: 7,040 ÷ 6 × 1.3 ≈ 1,525 node-hours × $0.4242 = $647

• Baseline nodes: 2 × 730 × $0.4242 = $619

• Control plane: 730 × $0.10 = $73

• Total ≈ $1,339 a month ($1,277 in US East), before storage, NAT, logging and engineer time

Three readings. Active-CPU billing matters: at 100% utilisation Vercel rises to $2,399.23. Region pinning costs money: Modal's 1.75x narrow-region multiplier lifts it to $3,081.67. And self-hosting roughly matches E2B on infrastructure, so its case is residency and control, not savings.

India, DPDP and source-code residency

Source code is not usually personal data, but repositories, fixtures, logs and database dumps often contain it. Under the DPDP Act 2023 and sector rules from regulators such as the RBI, know where agent workspaces and snapshots live.

E2B lists its regions in its egress FAQ, and Northflank lists Delhi among its managed-cloud regions. For EU teams, E2B, Daytona, Vercel and Modal all offer European placement, and E2B and Daytona publish DPAs.

Implementation checklist

1. Inventory which agents execute code, where, and with which credentials.

1. Choose microVM or gVisor isolation for anything model-driven.

1. Build a minimal workspace image with pinned toolchains and no default sudo.

1. Put a registry proxy between sandboxes and npm, PyPI and Maven.

1. Default-deny egress; allow the git host, registry proxy and model endpoint.

1. Broker credentials at the proxy with per-task tokens.

1. Set timeouts, resource caps and snapshot retention, and ship lifecycle logs to your SIEM.

1. Pilot with 5–10 engineers for two weeks, measure sandbox-hours and CPU use, then re-run the cost table behind a thin internal interface so you can switch providers.

How eCorpIT can help

eCorpIT is a Gurugram-based technology organisation, founded in 2021, assessed at CMMI Level 5 and MSME certified, with senior-led engineering teams working across AWS, Microsoft and Google platforms. Our AI coding agent rollout and governance service runs a short sandbox evaluation against your repositories, designs egress allowlists and proxy-side secrets, and sets up audit trails, so coding agents ship work without holding production keys. Talk to us at /contact-us/.

Last updated: 22 October 2026.

References

1. Pricing — E2B

1. Pricing — Daytona

1. Daytona is going closed source — Daytona

1. Daytona LICENSE at v0.190.0 (AGPL-3.0) — GitHub

1. Daytona clients and SDKs repository — GitHub

1. Security advisory: API credential exposure in sandboxes — Daytona

1. Vercel Sandboxes are now generally available — Vercel changelog

1. Vercel Sandbox is now available in all regions — Vercel changelog

1. Sandbox regions — Vercel documentation

1. Containers and Sandboxes are now generally available — Cloudflare changelog

1. Changelog — Modal documentation

1. E2B Embed README — GitHub

1. About automations — GitHub Docs

1. Security and compliance — E2B

1. E2B SDK repository (Apache-2.0) — GitHub

1. Bring your own cloud — E2B documentation

1. Internet access — E2B documentation

1. Isolation — Daytona documentation

1. Sandboxes — Daytona documentation

1. Regions — Daytona documentation

1. Trust Center — Daytona

1. Pricing — Modal

1. Region selection — Modal documentation

1. Sandboxes — Modal documentation

1. Sandbox networking and security — Modal documentation

1. Sandbox secret injection — Modal documentation

1. Sandbox pricing and quotas — Vercel documentation

1. Understanding sandboxes — Vercel documentation

1. Snapshots — Vercel documentation

1. Sandbox firewall — Vercel documentation

1. Secure Compute — Vercel documentation

1. Containers pricing — Cloudflare documentation

1. Sandbox SDK overview — Cloudflare documentation

1. Containers limits — Cloudflare documentation

1. Container placement — Cloudflare documentation

1. Sandbox security — Cloudflare documentation

1. Sandboxes — Northflank

1. Pricing — Northflank

1. Security — Northflank

1. Pricing — Runloop

1. Create a devbox — Runloop API reference

1. agent-sandbox repository — Kubernetes SIGs on GitHub

1. Codex Cloud (legacy): internet access — OpenAI

1. Codex cloud environments — OpenAI

1. Customise the firewall for Copilot — GitHub Docs

1. sandbox-runtime repository — Anthropic on GitHub

1. Amazon EC2 on-demand pricing — Amazon Web Services

1. Amazon EKS pricing — Amazon Web Services

1. Egress IP ranges and regions — E2B documentation

1. Northflank cloud regions — Northflank