Agent execution differs from general code execution in three key ways: extremely low cold-start latency (millisecond response), frequent filesystem state synchronization (agents need to read and write intermediate code and output files), and flexible API/network access control.

Below are two streamlined recommended solutions:

Solution 1: E2B Infrastructure (Proprietary Agent Sandbox Based on Firecracker) – Production-Grade First Choice

E2B is the de facto standard for code execution sandboxes across the LLM industry (including AutoGPT, Devin-like projects, LangChain, etc.). Although it offers a cloud service, its core sandbox scheduling and isolation engine is fully open-source.

• Technical Foundation: Firecracker MicroVM (hardware-level kernel isolation).
• Multi-tenancy & Isolation: Each execution of an agent runs in an independent MicroVM. Because Firecracker removes all unnecessary peripheral drivers, cold-start times are kept under 150ms, making it ideal for interactive, high-concurrency agent execution.
• Dynamic Resource Limits: Fine-grained allocation of vCPUs (e.g., 1 core, 2 cores) and memory (e.g., 512MB, 1GB) can be set in template definitions and at startup. Resources are strictly enforced by KVM, preventing single-tenant overflow from affecting the host.
• Network Policy (Egress Control): Custom virtual NICs (TAP) combined with a host scheduler allow public internet to be disabled by default, granting only specific third-party API domains (e.g., OpenAI/Anthropic API endpoints) to prevent an agent from leaking sensitive host data.
• Filesystem & State Management: Agent-optimized: supports second-level snapshots based on Memfs/Overlayfs. An agent can install dependencies (e.g., pip install pandas) inside the sandbox, and E2B can instantly save that state as a custom sandbox template for reuse in the next task. Provides a dedicated API for bidirectional file synchronization between the host and the sandbox filesystem.
• Use Case: You want to build a commercial agent platform that allows users to input arbitrary prompts, have the agent generate and run Python/JS code, with zero security incidents.
• Open-Source Repo: http://github.com/e2b-dev/infra

Solution 2: OpenSandbox (Lightweight Agent Security Sandbox Based on Docker/K8s) – Preferred for Domestic/Intranet Environments

Open-sourced by Alibaba, this sandbox environment is specifically designed for LLM agent code execution. It is the best option if your physical machine or cloud server cannot enable KVM (e.g., nested virtualization is restricted) or if you want to run directly on an existing Kubernetes/Docker container cluster.

• Technical Foundation: Docker container isolation / K8s Pod isolation (optionally mount gVisor as a secure runtime).
• Multi-tenancy & Isolation: Provides multi-tenant management API. Although it defaults to container isolation, it performs security hardening and interception at the application layer and system call layer specifically against common agent attack patterns (e.g., using Python reflection to read system environment variables, executing sensitive system commands, port scanning).
• Dynamic Resource Limits: Based on Cgroups. When creating a sandbox via API, you can dynamically limit CPU shares, memory limits, and disk IOPS to prevent an agent from getting stuck in an infinite loop (e.g., while True) and overwhelming the host CPU.
• Network Policy: Integrates container network NetworkPolicy. Inbound and outbound traffic of the sandbox can be dynamically controlled (e.g., block access to internal databases and config centers, allow only public internet access).
• Filesystem & Directory Control: Agent-optimized: strictly restricts the root mount inside the sandbox. Agents can only read/write files in the designated /workspace directory and cannot touch any host files. Provides standard interfaces for external reads of charts, CSVs, and other result files generated by the agent.
• Use Case: Private deployment, intranet environments, or cloud server environments where KVM virtualization is unavailable, and you need quick integration with major domestic LLM development frameworks.
• Open-Source Repo: http://github.com/alibaba/OpenSandbox…

e2b-dev/infra

Source: https://github.com/e2b-dev/infra

[E2B Infra Preview Light]

[E2B Infra Preview Dark]

E2B Infrastructure

E2B (https://e2b.dev) is an open-source infrastructure for AI code interpreting. In our main repository e2b-dev/e2b (https://github.com/e2b-dev/E2B) we give you SDKs and CLI to customize and manage environments and run your AI agents in the cloud.

This repository contains the infrastructure that powers the E2B platform.

Contributing

See CONTRIBUTING.md for ways you can contribute to E2B Infrastructure.

Self-hosting

Read the self-hosting guide to learn how to set up the infrastructure on your own. The infrastructure is deployed using Terraform.

Supported cloud providers:

• 🟢 GCP
• 🟢 AWS (Beta)
• Azure
• General linux machine