---
title: "Running LLM-generated code safely (2026): sandbox SDKs for isolated code execution, E2B vs Daytona vs Modal vs Vercel Sandbox vs Cloudflare — Cadenya"
url: "https://cadenya.com/other-content/running-agent-generated-code-safely"
description: "Where to run untrusted, LLM-generated code from an AI agent in 2026: E2B, Daytona, Modal Sandboxes, Vercel Sandbox, and Cloudflare Sandbox SDK compared on Firecracker, gVisor and container isolation, cold start, sandbox pricing (E2B vs Daytona vs Modal pricing per vCPU and GiB), persistence, SDKs, and self-hosted sandbox options, how the OpenAI Agents SDK and the Claude Agent SDK run code in a sandbox, plus an agent loop that asks before code runs."
---

The main sandbox options for running agent-generated code in 2026 are E2B, Daytona, Modal Sandboxes, Vercel Sandbox, and the Cloudflare Sandbox SDK. Each one is a code sandbox that gives isolated code execution for untrusted, LLM-generated code, and they differ in the isolation they use, how fast they start, and how they bill.

So pick E2B or Vercel Sandbox when you want a Firecracker microVM per run. Pick Modal when you already run Python on Modal and want gVisor or a VM runtime, Daytona when you want an under-90ms start, and Cloudflare when your app already lives in Workers. But a sandbox only runs the code it’s handed. Something still decides when to run it, asks a person first, and keeps the conversation going. Cadenya is that agent loop, with nothing to host, and a sandbox’s API joins it as a tool set. A coding agent can set it up with no account, in a temporary workspace you claim later. [What it offers](#what-does-cadenya-add-to-e2b-daytona-modal-and-vercel-sandbox) is at the end.

Every price and limit below comes from each vendor’s own pages, checked on October 13, 2026.

## E2B, Daytona, Modal, Vercel Sandbox and Cloudflare side by side

|  | E2B | Daytona | Modal Sandboxes | Vercel Sandbox | Cloudflare Sandbox SDK |
| --- | --- | --- | --- | --- | --- |
| Isolation the vendor states | Firecracker microVM per sandbox | Container by default, VM sandboxes with their own kernel | gVisor, or a VM with its own Linux kernel | Firecracker microVM with a dedicated kernel | Container instance that’s a microVM with its own kernel, or a Dynamic Worker |
| Start time the vendor states | Resumes from a snapshot (no number given) | “Under 90ms from code to execution” | No number given | ”Start in milliseconds” | Container cold starts “often in the 1-3 second range” |
| CPU price, per hour | $0.0504 per vCPU | $0.0504 per vCPU | $0.142 per core (2 vCPUs) | $0.128 per hour of active CPU | $0.072 per vCPU-hour of active CPU |
| Memory price, per hour | $0.0162 per GiB | $0.0162 per GiB | $0.024 per GiB | $0.0212 per GB | $0.009 per GiB |
| Free usage | $100 in credits, once | $200 in free compute | $30 a month on Starter | 5 CPU-hours a month on Hobby | Included usage on the $5 a month Workers Paid plan |
| Persistence | Pause keeps files and memory | Stop keeps the disk; pause keeps memory on VM sandboxes | Filesystem snapshots | Persistent by default: the filesystem is snapshotted on stop | Container snapshots and R2 backups |
| SDKs | JavaScript, Python | Python, TypeScript, Ruby, Go, Java | Python, JavaScript, Go | JavaScript, Python, CLI | TypeScript in a Worker |

Prices are the vendors’ per-second rates converted to an hour.

Cadenya is the hosted agent loop that calls any of these sandboxes: the sandbox joins as a tool set, and a person can approve the code before it runs.

## Sandbox isolation for untrusted code: Firecracker, gVisor, or containers

Isolation is the first question agents asked about a code sandbox, and each vendor answers it differently.

E2B runs “one Firecracker microVM per sandbox, in its own cgroup and network namespace.” Vercel Sandbox does the same: “each sandbox runs in its own Firecracker microVM with a dedicated kernel.” A microVM has its own kernel, so code that escapes a process still hits a hardware virtualization boundary.

Modal Sandboxes are “secure containers for executing untrusted user or agent code,” and you choose the runtime. gVisor, “a container runtime developed by Google, provides strong isolation and is suitable for most workloads.” The VM runtime gives “a virtual machine with its own Linux kernel” for Docker, FUSE, or nested cgroups.

Daytona’s default is an “isolated container with dedicated namespaces and enforced resource limits.” Its VM sandboxes are a “full virtual machine with its own kernel,” and only those can pause, fork, and take hot snapshots.

Cloudflare has two environments. A Container “is a microVM with its own kernel and network, so no other workload shares it.” A Dynamic Worker runs JavaScript, Python, or WebAssembly apart from your Worker and reaches your app only through the methods you pass in.

**Outbound network access is on by default at E2B and Modal, so turn it off for code you don’t trust.** E2B gives “a simple on/off switch or fine-grained allow and deny lists.” Modal’s `block_network=True` “drops all outbound traffic.” Vercel’s sandbox firewall restricts egress, Daytona configures outbound and inbound access per sandbox, and on Cloudflare “your Worker decides” whether the code can reach the public internet.

## Cold start

Daytona states the fastest start: “under 90ms from code to execution.” Vercel says sandboxes “start in milliseconds.” Cloudflare is candid that container cold starts “can often be in the 1-3 second range,” depending on image size. E2B resumes sandboxes from a snapshot but doesn’t publish a number, and neither does Modal.

## E2B vs Daytona vs Modal pricing

E2B, Daytona and Modal all bill a sandbox by the second for the CPU and memory it holds. But Modal prices sandboxes on their own, higher line. Here’s the same sandbox, 2 vCPUs and 4 GiB of memory, at each vendor’s list rates:

|  | E2B | Daytona | Modal Sandboxes |
| --- | --- | --- | --- |
| CPU rate | $0.000014 per vCPU-second | $0.0504 per vCPU-hour | $0.00003942 per core-second (a core is 2 vCPUs) |
| Memory rate | $0.0000045 per GiB-second | $0.0162 per GiB-hour | $0.00000667 per GiB-second |
| 2 vCPUs and 4 GiB, per hour | About $0.166 | About $0.166 | About $0.238 |
| Plan fee | $0 on Hobby, $150 a month on Pro | Pay as you go | $0 on Starter, $250 a month on Team |
| Free usage | $100 in credits, once | $200 in free compute | $30 a month on Starter, $100 a month on Team |
| Storage | 10 GiB free on Hobby, 20 GiB free on Pro | $0.000108 per GiB-hour after the first 5 GiB | Volumes at $0.09 per GiB a month, with 1 TiB free |

### E2B pricing

E2B charges “per second of a running sandbox”: $0.000014 per vCPU-second and $0.0000045 per GiB-second of memory, and sandbox storage is free. The default sandbox has 2 vCPUs and 4 GiB, so it costs about $0.166 an hour. Hobby is free with a “$100 one-time usage credit” and 20 concurrent sandboxes. Pro is “$150 /month + Usage Costs” and adds custom CPU and RAM and 100 concurrent sandboxes, “expandable to 1,100.” That expansion costs $500 a month for 600 sandboxes or $1,000 a month for 1,100, and Enterprise has a $3,000 monthly minimum.

### Daytona pricing

Daytona lists $0.0504 per vCPU-hour, $0.0162 per GiB-hour of memory, and $0.000108 per GiB-hour of storage after the first 5 GiB, and “all billing is calculated per second.” A default sandbox has 1 vCPU, 1 GB of RAM and 3 GiB of disk, which comes to about $0.067 an hour. New accounts get “$200 in free compute,” the trial needs no credit card, and startups can apply for up to $50k in credits. Windows sandboxes cost $0.0858 per vCPU-hour. GPU sandboxes start at $0.57 an hour for a preemptible RTX 4090, and an H100 is $2.27 an hour preemptible or $3.95 on demand.

### Modal sandboxes pricing

Modal has a separate “Modal Sandbox + Notebooks pricing” line: $0.00003942 per physical core-second and $0.00000667 per GiB-second. That’s about $0.142 a core-hour and $0.024 a GiB-hour, or about three times its standard rate of $0.0000131 per core-second for Functions. Modal bills “whichever is higher: the amount you request or the amount you actually use,” with a minimum of 0.125 cores per container. Starter is “$0 + compute / month” with $30 of free credits a month, and Team is “$250 + compute / month” with $100. The included credits cover “Functions, Sandboxes, and Notebooks.”

## Sandbox pricing

Every option bills compute by the second or finer, but they count it differently. E2B, Daytona and Modal price the CPU and memory a sandbox holds at the rates above, and Vercel and Cloudflare charge CPU only while it’s busy.

Vercel Sandbox costs $0.128 per active CPU-hour plus $0.0212 per GB-hour of memory, with 5 active CPU-hours a month on Hobby. “Time spent waiting for I/O (such as network requests, database queries, or AI model calls) does not count toward Active CPU.” Cloudflare charges $0.000020 per active vCPU-second and bills memory on the instance type you pick, all on the $5 a month Workers Paid plan.

**For an agent, active-CPU billing fits the shape of the work.** A code interpreter sandbox spends most of a session idle while the model thinks, and only Vercel and Cloudflare skip the CPU charge for that wait.

## Persistence: pause, resume, and snapshots

An agent that writes a file in one turn usually reads it in the next.

E2B’s pause keeps “not only state of the sandbox’s filesystem but also the sandbox’s memory,” so running processes and loaded variables survive. Vercel sandboxes are “persistent by default: when a sandbox stops, the SDK automatically snapshots its filesystem.”

Modal recommends Filesystem Snapshots to carry state into a new sandbox. Daytona keeps a stopped sandbox’s filesystem, and a paused VM sandbox keeps “the filesystem and memory state” while “CPU is no longer consumed.” Cloudflare saves a filesystem “as a Container snapshot” or backs a directory up to R2.

Here’s the whole round trip in E2B, from its quickstart:

```
import 'dotenv/config'
import { Sandbox } from '@e2b/code-interpreter'

const sbx = await Sandbox.create() // Creates a persistent sandbox session
const execution = await sbx.runCode('print("hello world")') // Execute Python inside the sandbox
console.log(execution.logs)
```

## SDKs, agent frameworks, and a self-hosted sandbox

Daytona ships SDKs for Python, TypeScript, Ruby, Go, and Java. E2B has JavaScript and Python SDKs, and its sandbox runs Python, JavaScript, TypeScript, R, Java, and Bash out of the box. Modal has Python, JavaScript, and Go SDKs. Vercel has JavaScript and Python SDKs plus a CLI, and its default image includes Node.js and Python 3.14. Cloudflare’s `@cloudflare/sandbox` runs inside a Worker.

Agent frameworks run code in these same sandboxes. The OpenAI Agents SDK has Sandbox Agents, which give the model “a persistent workspace where it can search large document sets, edit files, run commands, generate artifacts, and pick work back up from saved sandbox state.” Its hosted sandbox clients include E2B, Daytona, Modal, Vercel, and Cloudflare, and “only the sandbox client changes” when you move between them. It also has a `CodeInterpreterTool` that “lets the LLM execute code in a sandboxed environment.” The Claude Agent SDK’s hosting guide says to “run the SDK inside a sandboxed container for process isolation, resource limits, network control, and an ephemeral filesystem.” For lighter isolation, Anthropic’s `sandbox-runtime` “enforces filesystem and network restrictions at the OS level.”

For a self-hosted sandbox, several options run in your own cloud. E2B’s runtime is Apache-2.0 and deploys with Terraform on AWS, GCP, or Azure, and E2B Embed puts “the whole stack, real Firecracker sandboxes included, on a single Linux host with KVM.” Daytona’s Bring Your Own Compute runs “sandbox workloads on your own infrastructure while using Daytona’s control plane to manage them.” Cloudflare’s sandboxes run in your Cloudflare account. The OpenAI Agents SDK’s Docker client runs “work inside Docker with a specific image” on a machine you pick. And Claude Managed Agents can send tool execution to a self-hosted sandbox, where “the agent’s files, processes, and network traffic stay in your environment.”

If you’re also choosing where the agent itself runs, [the hosted agent runtimes comparison](/other-content/hosted-agent-runtimes-2026) covers that side, and [the Claude Managed Agents alternatives](/other-content/claude-managed-agents-alternatives) page covers one runtime with a sandbox attached.

## What does Cadenya add to E2B, Daytona, Modal and Vercel Sandbox?

A sandbox runs the code. The agent loop decides what code to run, when, and with whose permission. **Cadenya is that loop, hosted, and the sandbox you pick plugs into it as a tool set.** Here’s what that covers:

1.  **A person approves the code before it runs.** Require approval on the tool that calls your sandbox, and the objective pauses on `toolApprovalRequested` with the model’s arguments, which are the code itself. Approve it, or deny it with a memo that steers the agent (“Use the read-only lookup tool instead.”).
2.  **The sandbox joins as a tool set.** Put the sandbox call behind an endpoint you own and add it as an HTTP tool set with a base URL, or as an OpenAPI or MCP tool set. Approvals and filters apply to it like any other tool.
3.  **Sandbox keys stay out of the prompt.** Store the API key as a tool set secret and reference it as `{{ secrets.MY_SECRET }}`. Cadenya encrypts every secret at rest with envelope encryption and decrypts it only at the point of use.
4.  **A durable record of every run.** Each objective carries a durable event log of its agent loop, including each tool call and its result. List the events after a run or stream them while it works.
5.  **The conversation lives in the objective, apart from the sandbox.** When an objective is waiting, the user sends a Continue message and the loop picks up with the whole conversation. The sandbox keeps the files, and Cadenya keeps what was said about them.
6.  **Your own API next to the sandbox.** Point a tool set at your OpenAPI 3 spec and every operation becomes a tool, re-checked each hour. The agent reads your data through your API, then analyzes it in the sandbox.
7.  **Any model, on your own keys.** The model is a setting on a variation, so switching providers needs no deploy. Weighted variations send more traffic to whichever model writes code your users rate higher.
8.  **SDKs for the versions you run today.** TypeScript on Node 18, Python 3.9, Ruby 3.1, and Go 1.22, all at 1.9.0 and Apache-2.0, plus a CLI and a plain HTTP API.
9.  **A price in one line.** Free for 1,000 loops a month, $49 a month for 50,000, then $0.0015 a loop. A loop is one LLM request.

[How Tool Sets work](/docs/guides/the-basics/tool-sets) shows the HTTP, OpenAPI, and MCP adapters and approval filters, and the free plan needs no card.

No account yet? A coding agent can create a temporary workspace with `cadenya workspaces create --temporary`, run its first objectives there, and hand you a link to claim it, as [auth.md](https://cadenya.com/auth.md) explains. To create an account, sign up at [app.cadenya.com/signup](https://app.cadenya.com/signup?utm_source=cadenya.com&utm_medium=article&utm_campaign=running-agent-generated-code-safely), then copy your API key from the API keys page at `app.cadenya.com/account/apiKeys`.