An agent that runs code, installs packages or opens a browser needs a boundary between that code and everything else: your files, your secrets, your network. This matrix compares the ways to draw that boundary, from a hardened Docker container on your own server to microVMs run by a managed service.
Every cell states what the provider's own page says, links to that page and shows the day it was read. Where a provider publishes no figure, the cell says so. Rows keep a fixed order, self-hosted software first, then managed services, each alphabetical; nothing here is a score.
The matrix
Pick what you need to narrow the rows. Each cell links to the page it was read from; a cell older than the refresh window is marked stale.
8 of 8 solutions shown.
| Provider | Isolation | Published startup | Network | Persistence | Resource limits | License | Public price |
|---|---|---|---|---|---|---|---|
| Docker Engine (hardened) | Containers share the host kernel; namespaces, cgroups, the default seccomp profile, optional rootless mode | Not published | Bridge network with internet access by default; --network none leaves loopback only; --internal networks have no external access | Volumes and bind mounts outlive the container | No limits by default; set with --memory (minimum 6m), --cpus and --pids-limit | Docker Engine (moby): Apache License 2.0 | Engine is open source, no license fee; Docker Desktop needs a paid plan above 250 employees or $10M revenue |
| Firecracker | A microVM per workload on Linux KVM, with a minimal device model; a jailer for production | Published: ≤ 125 ms from the InstanceStart call to the guest's /sbin/init (minimal kernel and rootfs) | A TAP device per microVM on the host; routing, NAT and filtering are set up on the host | Snapshots save a running microVM (memory and device state) to restore it later | vCPUs (default 1) and memory (default 128 MiB) set through the API; VMM overhead ≤ 5 MiB at 1 vCPU and 128 MiB | Apache License 2.0 | Open source, no license fee; the host needs KVM (bare metal or nested virtualization) |
| gVisor | A per-sandbox application kernel in user space between the workload and the host kernel | No figure published; the project states containers start in milliseconds | Its own user-space network stack; external networking can be disabled (loopback stays); egress rate limiting | Checkpoint a sandbox to a state file and restore it into a new container | The sandbox's threads and memory are subject to the container's cgroup; no maximums documented | Apache License 2.0 | Open source, no license fee; runs where existing container tooling runs |
| Kata Containers | Each pod or container in a lightweight VM with its own kernel, using hardware virtualization | Not published; the docs note that more vCPUs lengthen boot time | Uses the container's network namespace, so the network plugin's policies apply; traffic is redirected to a VM tap device | No checkpoint or restore; data outlives the sandbox on container volumes and block devices | VM vCPUs and memory (MiB) set per sandbox; the docs state a non-negligible overhead per sandbox | Apache License 2.0 | Open source, no license fee; needs bare metal or nested virtualization |
| Daytona | Linux containers by default; optional VM sandboxes with their own Linux or Windows system | Published: under 90 ms sandbox creation, from code to execution | Tiers 1 and 2: restricted access; tiers 3 and 4: open by default, with block-all or CIDR and domain allowlists | Persistent by default: stop and start, archive, snapshots and volumes; auto-stop after 15 minutes by default | Default 1 vCPU, 1 GB RAM, 3 GiB disk; up to 4 vCPU, 8 GB RAM and 10 GB disk per sandbox | Commercial service; the public repository (AGPL-3.0) is no longer maintained since June 2026 | Per second: $0.0504 per vCPU-hour, $0.0162 per GiB-hour of memory, disk past 5 GiB extra; $200 of free compute |
| E2B | A Firecracker microVM per sandbox, each booting its own kernel | Published: about 80 ms to load a sandbox from a template snapshot | Outbound internet on by default; switch it off or limit it with IP, CIDR and domain allow and deny lists | Pause and resume keep the filesystem and memory; a paused sandbox is kept with no time limit | Hobby: 8 vCPU, 1-hour runs, 20 concurrent; Pro: 8+ vCPU, 24-hour runs, 100 to 1,100 concurrent | The runtime and SDK are Apache License 2.0; E2B Cloud is a commercial service | Per second: $0.000014 per vCPU, $0.0000045 per GiB of memory; Hobby $0 with $100 of one-time credit, Pro $150 a month |
| Modal Sandboxes | gVisor container runtime by default; an optional VM runtime with its own Linux kernel | No figure published; the provider states sub-second cold starts, custom and large images included | Outbound open by default; block all, allow chosen CIDR ranges, or allow chosen domains (beta) | Volumes and filesystem, directory and memory snapshots; lifetime 5 minutes by default, up to 24 hours | A CPU and memory maximum is enforced at creation; no maximum figures published | Commercial service; the client SDK is Apache License 2.0 | $0.00003942 per physical core-second (2 vCPU) and $0.00000667 per GiB-second; $30 a month of free credits (Starter) |
| Vercel Sandbox | A Firecracker microVM per sandbox, each with its own kernel | No figure published; the provider states sandboxes start in milliseconds | Egress firewall: allow all (default), deny all, or domain and CIDR allow and deny rules | Persistent by default: the filesystem is saved on stop and restored on resume | Pro: up to 8 vCPU and 16 GB, 24-hour sessions, 10,000 concurrent; Hobby sessions 45 minutes | Commercial service; the SDK is Apache License 2.0 | Pro, iad1: $0.128 per Active CPU hour, $0.0212 per GB-hour of memory, $0.60 per million creations; a free Hobby quota |
How to read the columns
- Isolation
- The boundary between the agent's code and the host. A container shares the host's kernel; a user-space kernel (gVisor) answers the code's system calls itself; a microVM gives each sandbox its own kernel behind hardware virtualization.
- Published startup
- The startup time the provider itself publishes, with its conditions. Figures are measured by each provider in its own way and are not comparable with each other; we measured nothing.
- Network
- Whether outbound traffic is open by default and how it can be switched off or limited to chosen destinations.
- Persistence
- What survives when a sandbox stops: volumes, snapshots, pause and resume, and the default lifetime where one is published.
- Resource limits
- How CPU, memory and duration are capped, and the maximums the provider publishes.
- License and public price
- The license of the runtime or SDK, and the price as listed on the public pricing page. Self-hosted software has no license fee; you pay for the servers it runs on.
An example
An agent that runs untrusted code and must not reach the internet, on your own servers: choose "On my own servers" and "Outbound network can be blocked or limited". Every self-hosted row stays, so narrow by boundary: "MicroVM (own kernel)" leaves the microVM runtimes, and the Price column says what each needs from the host (KVM on bare metal or nested virtualization). Then size the servers with the Agent Workload Sizer.
Method
The rows are isolation runtimes you can run yourself (a hardened Docker Engine, gVisor, Firecracker, Kata Containers) and public managed services built to run agent code, each with public documentation and, for a service, a public pricing page. The list is fixed in advance and grows by the same rule; ANAROQ is never a row, and nobody pays for a place.
Each cell was read by hand from the provider's own documentation, pricing page or official repository, and keeps that page and the day it was read. A cell is stale 90 days after it was read. Startup figures and limits are the providers' own claims; this page runs no benchmark.
The filters only hide rows that miss a need; they never change the order. The facets they use (boundary, outbound control, persistence, open-source runtime) restate cells of the same row.
Limits
- No benchmark: startup times and limits are what each provider publishes, measured its own way.
- A sample, not every product: other runtimes and services exist, and a row's absence says nothing about it.
- Prices change and differ by plan and region; the cell names the plan it was read for, and the provider's page is authoritative.
- Isolation is one layer. Secrets in the sandbox, open outbound network and long-lived credentials are risks inside any boundary.
Next steps
Sources
Every page a cell was read from, with the day it was read.
- Docker Engine (hardened) docs.docker.com
- Docker Engine (hardened) docs.docker.com
- Docker Engine (hardened) docs.docker.com
- Docker Engine (hardened) docs.docker.com
- Docker Engine (hardened) docs.docker.com
- Docker Engine (hardened) github.com
- Docker Engine (hardened) docs.docker.com
- Firecracker github.com
- Firecracker github.com
- Firecracker github.com
- Firecracker github.com
- Firecracker github.com
- Firecracker github.com
- gVisor gvisor.dev
- gVisor gvisor.dev
- gVisor gvisor.dev
- gVisor gvisor.dev
- gVisor gvisor.dev
- gVisor github.com
- Kata Containers katacontainers.io
- Kata Containers github.com
- Kata Containers github.com
- Kata Containers github.com
- Kata Containers github.com
- Kata Containers github.com
- Kata Containers github.com
- Daytona www.daytona.io
- Daytona www.daytona.io
- Daytona www.daytona.io
- Daytona www.daytona.io
- Daytona github.com
- Daytona www.daytona.io
- E2B docs.e2b.dev
- E2B docs.e2b.dev
- E2B docs.e2b.dev
- E2B docs.e2b.dev
- E2B docs.e2b.dev
- E2B github.com
- E2B e2b.dev
- Modal Sandboxes modal.com
- Modal Sandboxes modal.com
- Modal Sandboxes modal.com
- Modal Sandboxes modal.com
- Modal Sandboxes github.com
- Modal Sandboxes modal.com
- Vercel Sandbox vercel.com
- Vercel Sandbox vercel.com
- Vercel Sandbox vercel.com
- Vercel Sandbox vercel.com
- Vercel Sandbox vercel.com
- Vercel Sandbox github.com