Best Agent Sandboxes in 2026: Cold Start, Per-Second Pricing, and Network Policy Across E2B, Daytona, Modal, Cloudflare, and Vercel

Every agent that writes code wants someplace to run it. That “someplace” is now a product class with at the very least a dozen distributors, 4 incompatible billing fashions, and advertising pages that quote chilly begins measured below circumstances no person publishes.

This comparability fixes the items. It covers the 5 platforms most groups shortlist — E2B, Daytona, Modal Sandboxes, Cloudflare Sandbox SDK, and Vercel Sandbox — together with Runloop, Fly.io Sprites, and Northflank the place they modify the reply.

The 4 questions that truly determine this

Feature matrices for this class are principally noise. Four properties change structure, and the whole lot else is a choice:

1. Cold begin below concurrency: An agent loop that creates a sandbox per software name pays this tax 1000’s of instances a day.
2. Filesystem persistence between turns: Does flip 2 see the pip set up from flip 1, or does the agent rebuild its world?
3. Egress coverage: Can the sandbox attain the web, are you able to flip that off, and can you alter your thoughts mid-session?
4. Idle billing: Agents spend most of their wall-clock ready on a mannequin. Somebody is paying for these seconds.

1. Cold begin: what the numbers truly say

The vendor claims usually are not comparable to one another. Daytona’s pricing web page advertises sub-90ms sandbox creation. E2B is often cited at roughly 150ms. Modal advertises sub-second cold starts for pre-cached containers. None of those state concurrency, area, picture dimension, or whether or not the clock stops at API acknowledgment or at first executed command.

The most helpful public dataset is ComputeSDK’s sandbox leaderboard, which is open supply and runs on a schedule. It measures Time to Interactive (TTI): elapsed time from create() to the primary profitable command contained in the sandbox, 100 iterations per supplier, launched concurrently in a single burst, from a 4 vCPU host in Northern Virginia.

Results from the August 21, 2026 run:

Three issues in that desk matter greater than the rating.

• Burst is just not the identical check as sequential: Daytona’s quickest revealed median is actual, and on an earlier provider-page run it created sandboxes at a 0.10s median when launched separately. On the August burst run it posted the quickest median in the sector and accomplished 37 of 100 makes an attempt. A median you solely attain on a 3rd of your calls is just not a latency quantity, it’s a capability quantity. Retry logic is just not non-obligatory on any of those platforms.
• Tail latency is the quantity to design towards: Runloop’s median and Modal’s median are 10ms aside. Runloop’s P95 is 3.3x Modal’s. If your agent’s UX price range is one second, the median tells you nearly nothing.
• Cloudflare is measuring a unique product: Sandbox SDK sits on Cloudflare Containers, which schedules a container occasion and boots a picture. That is architecturally a heavier operation than resuming a pre-warmed Firecracker VM, and 5s medians mirror it. Cloudflare’s personal GA post is candid concerning the form of the issue: booting a sandbox, cloning a repo, and working npm set up takes about 30 seconds, whereas restoring the identical setting from a backup takes about two.

Reproducing this your self

The activity value measuring is the one your agent runs, not echo howdy. A helpful harness runs the identical unit of labor in all places: set up pandas, learn a CSV, plot it, return a PNG. Time 4 checkpoints individually.

# checkpoints: t_create -> t_ready -> t_deps -> t_result
# run 100 iterations sequential, then 100 concurrent, report median/P95/P99
import time, statistics

def one_run(supplier):
    t0 = time.perf_counter()
    sbx = supplier.create()              # API acknowledged
    t1 = time.perf_counter()
    sbx.exec("python -c 'print(1)'")     # first command returns: TTI
    t2 = time.perf_counter()
    sbx.exec("pip set up pandas matplotlib")
    t3 = time.perf_counter()
    sbx.exec("python /work/plot.py")     # writes /work/out.png
    png = sbx.read_file("/work/out.png")
    t4 = time.perf_counter()
    sbx.kill()
    return dict(create=t1-t0, tti=t2-t0, deps=t3-t2, activity=t4-t3, bytes=len(png))

Report tti and activity individually. Vendors optimize the primary and readers care concerning the second. Pin the area, pin the picture, and publish each the sequential and the concurrent sequence, as a result of they reply totally different questions.

2. Per-second pricing, normalized

Published charges as of August 27, 2026, transformed to a standard unit. Modal costs per bodily core, which it defines as 2 vCPU, so the vCPU-equivalent is proven for comparability.

Two footnotes that folks get incorrect.

• Modal’s sandbox tier is roughly 3x its commonplace Function fee ($0.00003942 vs $0.0000131 per core-second), and region selection adds 1.5–1.75x on high. Sandbox pricing is just not Modal’s headline compute pricing.
• Daytona’s GPU charges are broadly reproduced at $3.95/hr for an H100. Its live pricing page lists on-demand H100 at $2.27/hr and H200 at $2.61/hr. Third-party comparability tables in this class go stale inside 1 / 4.

3. Cost per 1,000 executions

Rates usually are not prices. The mannequin under fixes the workload and runs it by every fee card.

Assumptions: 2 vCPU / 4 GiB sandbox, 1,000 executions, no plan ground included, no egress, default area (Vercel iad1, Cloudflare standard-3 at 2 vCPU / 8 GiB / 16 GB disk since occasion sizes are fastened).

Scenario A: brief burst — 90s alive, 50% common CPU

Scenario B: idle-heavy — 10 min alive, 5% common CPU

This is what an actual agent loop seems to be like. The sandbox is open, the mannequin is pondering, nothing is working.

Vercel strikes from 4th-cheapest to third, and its CPU line drops from $3.20 to $2.13 whereas everybody else’s scales linearly. Cloudflare’s active-CPU line falls to $1.20. That is all the argument for active-CPU billing, and it’s value roughly 2x on this workload.

Scenario B with droop

The platforms that lose Scenario B can win it again, in case your orchestration suspends between turns as an alternative of holding the field open. Same workload, 30s awake per execution:

E2B’s quantity contains ~17s of pause and resume overhead for a 4 GiB sandbox. That overhead is the deciding variable: pausing is just economical when the hole between turns is meaningfully longer than the pause itself.

Fly’s idle detector is particular about what counts as exercise: an in-flight HTTP or API request, output to a session’s stdout, an open TCP connection, or an lively activity (sprites.dev). An agent that holds a connection open whereas it waits is an agent that’s billed. Redirecting output to a file doesn’t depend, which is an actual lever.

4. Filesystem persistence between turns

This is the place the platforms diverge most, and the place the incorrect selection reveals up as a rebuilt node_modules on each flip.

Three particulars value internalizing:

• E2B’s default kills your work: onTimeout is kill except you set lifecycle: { onTimeout: 'pause' } at creation. The killed state is terminal, and the docs describe no shutdown sign earlier than termination. Treat unsaved work as misplaced.
• Cloudflare’s disk is ephemeral throughout sleep: Container docs state plainly {that a} sleeping occasion restarts with a contemporary disk from its picture. Backup and restore to R2 works at the moment; the automated persistAcrossPeriods disk snapshot introduced at GA was nonetheless rolling out on the time of writing.
• Daytona splits persistence by sandbox class: Container sandboxes protect the filesystem throughout cease/begin however don’t help pause, so reminiscence is cleared each time. Linux VM sandboxes help each. GPU sandboxes are ephemeral and are deleted on cease; outcomes need to be written to a quantity.

5. Egress coverage

Every platform in this comparability can now run a sandbox with no web entry. The variations are in priority, granularity, and whether or not coverage can change and not using a restart.

The priority lure

E2B and Vercel resolve conflicts in reverse instructions. In E2B, allow rules take precedence over deny rules: an IP in each lists is allowed. In Vercel Sandbox, denied ranges override allowed ranges. A coverage ported from one to the opposite with out rewriting it doesn’t imply the identical factor.

The failure-mode lure

E2B paperwork that blocked TCP connections can look profitable from contained in the sandbox. The firewall accepts the connection earlier than deciding whether or not the vacation spot is allowed, so a socket opens and no packets arrive. Verify egress with an application-level response — an HTTP standing, a TLS handshake — not with a profitable join(). Any check suite that asserts “community is blocked” by checking for a connection error will cross towards an unblocked sandbox.

Credential injection is the true differentiator

Blocking egress is desk stakes. Letting a sandbox make an authenticated name with out ever holding the credential is just not.

Cloudflare runs outbound handlers in the Workers runtime, outdoors the sandbox, with entry to Workers bindings. The sandbox points a plain request, the handler attaches the key, and ctx.containerId scopes credentials per occasion (docs). Vercel brokers credentials on egress with matchers scoped by path, methodology, question string, or headers, and states the firewall runs on the host outdoors the microVM the place sandbox code can’t disable it (Vercel). E2B ships per-host request transforms in public beta that inject headers on the egress proxy, together with workload-identity tokens the sandbox by no means sees. Runloop gives a Credential Gateway with opaque token injection.

For brokers processing untrusted enter, this design issues greater than chilly begin. A prompt-injected agent with a GitHub token in its setting is a unique incident from one that may solely attain GitHub by a proxy holding the token.

6. Isolation, limits, and the superb print

7. How to decide on

• Pick Vercel Sandbox in case your agent waits on fashions greater than it computes, and you need the most affordable measured burst chilly begin in this set. Active-CPU billing is value roughly 2x on idle-heavy loops, the egress firewall with credential brokering is now out there on each plan, and the 0.67s median with a 1.12s P99 was the tightest distribution in the August run.
• Pick E2B in case you want per-session kernel isolation for adversarial code, need memory-state persistence throughout turns, or want a self-host path. Set onTimeout: 'pause' on day one. Budget for the $150/mo Pro ground as quickly as you exceed 20 concurrent sandboxes or 1-hour classes.
• Pick Daytona if persistence is the product and you may take up capability variance. The cease/archive/pause/fork lifecycle is essentially the most developed in the class, forking a stay VM with reminiscence intact has no clear equal elsewhere, and the compute fee matches E2B and not using a subscription ground.
• Pick Modal if any a part of the agent’s work touches a GPU. It is the one platform right here with a full GPU fee card contained in the sandbox, T4 by B300. Price the 3x sandbox multiplier and regional multipliers earlier than you commit.
• Pick Cloudflare Sandbox in case your app already lives on Workers and your egress safety mannequin issues greater than your chilly begin. Programmable egress handlers working outdoors the sandbox with binding entry are genuinely differentiated. Five-second burst medians usually are not, so maintain sandboxes open per session somewhat than creating one per software name, and plan for disk that resets on sleep.
• Pick Runloop if you’re constructing a coding agent and want SWE-Bench-style analysis in the identical platform. Note that droop/resume, the function that fixes its idle economics, is gated behind the $250/mo Pro plan.
• Pick Fly Sprites if you need a persistent laptop per consumer somewhat than a disposable one per name, and Northflank in case you want the bottom revealed fee, GPU help, and self-serve BYOC in one platform.

Key Takeaways

• Measured burst chilly begin spreads 7x throughout suppliers: Vercel 0.67s, Modal 0.88s, E2B 1.61s, Cloudflare 5.06s.
• Vendor "sub-90ms" and "~150ms" claims describe sequential creates, not the concurrent bursts brokers truly generate.
• Billing mannequin beats headline fee: the most affordable supplier flips relying on how lengthy your sandbox sits idle.
• Only Vercel and Cloudflare invoice CPU on lively use; E2B, Daytona, Modal and Runloop invoice wall-clock whereas the field is alive.
• Every platform right here can now deny egress by default, however enable/deny priority and TCP failure conduct differ in ways in which break assumptions.

Sources: E2B pricing, E2B persistence, E2B internet access, Daytona pricing, Daytona persistence, Daytona network limits, Daytona billing, Modal pricing, Modal sandbox networking, Modal sandbox resources, Modal sandbox snapshots, Cloudflare Containers pricing, Cloudflare outbound traffic, Cloudflare Sandboxes GA, Vercel Sandbox pricing, Vercel Sandbox firewall, Runloop pricing, Sprites and Northflank pricing

The submit Best Agent Sandboxes in 2026: Cold Start, Per-Second Pricing, and Network Policy Across E2B, Daytona, Modal, Cloudflare, and Vercel appeared first on MarkTechPost.