E2B vs Daytona vs Modal vs Cloudflare Sandboxes: Pick on the Billing Shape

At a glance

Four platforms that all run untrusted agent-written code, built on four genuinely different isolation primitives. The primitive is what everything else follows from.

Worth noting for context: when OpenAI shipped Agents SDK v2 in April 2026 it came with seven sandbox providers wired in natively — Blaxel, Cloudflare, Daytona, E2B, Modal, Runloop and Vercel. Swapping providers is now close to a configuration change, which makes it easy to pick on the wrong axis and expensive to notice.

The idle problem, with arithmetic

Take an agent doing a data-analysis task: twenty steps, each one a model call of roughly twelve seconds followed by about two seconds of code execution. The sandbox has to exist across the whole thing, because the filesystem and the Python kernel carry state between steps.

That is 280 seconds of sandbox lifetime containing 40 seconds of compute. Under a bill-while-alive model you pay for 280. Under a bill-while-active model you pay for 40. The ratio is seven to one, and it is set by inference latency — a variable you do not control and which grows as reasoning effort goes up. Nothing in the cold-start benchmark predicts it.

Two consequences follow. First, per-vCPU-hour rates are close to meaningless as a comparison unless you normalise them by the billing shape; a platform charging noticeably more per active hour can be dramatically cheaper on an agent workload. Second, the idle share rises with the quality of your model, because better models think for longer. Teams that benchmark on a fast small model and deploy on a reasoning model see the sandbox line move in a direction the spreadsheet did not predict.

The counter-argument is real: a bill-while-alive platform with a short auto-stop interval and a fast resume approximates the same thing, and Daytona's auto-stop and auto-archive controls exist for exactly this. But that is a configuration you have to get right per workload, against a default that costs you money, whereas Modal's model is the default. Defaults determine what most teams actually pay.

Isolation: four different answers to the same threat

The threat is the code, not the user

All four platforms assume the workload is hostile, which is correct: agent-written code is untrusted code even when the agent is yours, because its behaviour depends on inputs — retrieved documents, issue comments, web pages — that you do not control. The differences are in how much of the host kernel the code can reach.

E2B's Firecracker microVMs give each sandbox its own guest kernel, so a kernel exploit has to escape a hypervisor rather than a namespace. Modal's gVisor sits between: a user-space kernel intercepts syscalls before they reach the host, which is a much smaller attack surface than a shared kernel and a larger one than hardware virtualization — and, usefully, it keeps GPU passthrough straightforward in a way microVMs make awkward. Daytona's container-from-snapshot is the fastest to start and the most conventional, which is the trade it makes. Cloudflare's containers inherit the Workers platform's boundaries and, uniquely, put the sandbox at the edge next to the request.

Where the difference actually bites

For most agent workloads the isolation tier is not the deciding factor, and saying so is more useful than pretending otherwise. If your agent runs your own generated Python against your own data in your own account, a container is fine. The tier starts to matter when you are running other people's agents — a multi-tenant product where one customer's prompt injection should not reach another customer's execution — and there the microVM boundary is the one you can put in a security questionnaire without a footnote.

The larger practical constraint is GPU. If the sandboxed work touches a model — running an embedding pass, executing generated CUDA, driving an RL environment — Modal is the platform in this set built for it. The others are CPU-shaped, and that is an architectural fact rather than a roadmap gap.

Lifetime and persistence: what survives between steps

Agent loops need state to persist across model calls, and each platform expresses that differently. This is the axis most likely to force a rewrite if you choose wrong.

Session length. E2B supports long-lived sandboxes measured in hours on paid tiers, which suits a research agent that works on one problem all afternoon. Cloudflare's sandboxes are shaped for shorter interactions and sleep after an inactivity window — ten minutes by default, configurable — which suits a request-scoped code interpreter and does not suit a job that thinks for an hour. Modal and Daytona both let a sandbox live until you end it, with idle timeouts and auto-stop intervals as the safety net.

Filesystem state. Daytona's snapshot model is the most developed here: a point-in-time capture of filesystem, packages and settings that any number of new sandboxes can start from, plus declarative image building from a Dockerfile. If your agent needs a repository already cloned and dependencies already installed, that is the difference between a five-minute setup tax on every run and a warm start — and it matters far more than the cold-start figure it is usually quoted alongside.

Resume semantics. The question to ask each platform is what happens when a sandbox stops and starts again: does the filesystem come back, does the process tree, does an open network connection. The answers differ, and an agent architecture that assumed a live process across a resume will fail in a way that looks like a model regression. Design for the weaker guarantee — reconstruct from the filesystem — and the platform choice stops constraining you.

Egress: the control that matters and the default that is wrong

This is the axis nobody benchmarks and the one that decides what a successful prompt injection can do. If an agent's sandbox can reach arbitrary hosts, then any instruction that reaches the agent — from a scraped page, a dependency's postinstall script, an issue comment — has a channel out for whatever the sandbox can read.

All four platforms now expose a control. Modal takes block_network or an outbound_cidr_allowlist per sandbox. E2B supports allow and deny lists covering IPs, CIDR blocks and domain names, resolving domains via Host-header inspection on port 80 and SNI on 443, and lets you replace the rules on a running sandbox without restarting it — which is the most agent-shaped design of the four, since it lets you widen access for one step and close it again. Cloudflare exposes enableInternet as a switch and, more interestingly, lets the Worker in front of the container mediate outbound requests, so a policy can be code rather than configuration. Daytona documents a network-limits layer whose default posture varies by account tier — check yours rather than assuming.

The uniform problem is that the permissive setting is the default everywhere. A sandbox created with the SDK's minimal constructor can talk to the internet, and the framework integrations that make providers swappable are the layer where this configuration is easiest to leave unset. Default-deny egress with a small allowlist — your package registry, your source host, the one API the task needs — is the highest-leverage control in this whole comparison, and it is one line at construction on three of the four platforms.

When to pick which

One caveat on all of it: rates and limits move quarterly, and every number quoted anywhere in this comparison should be re-checked against the provider's own documentation before you build a cost model on it. The billing shapes — alive versus active — are architectural and change far more slowly than the rates attached to them, which is why they are the thing to choose on.

Further reading

On this wiki:

• Sandboxing & Code Execution — the five independent isolation decisions underneath this choice.
• Sandbox & Isolation Patterns — the architecture layer above the provider.
• Sandboxing & Execution — running a coding agent's code specifically.
• Background Coding Agents — where environment snapshots and egress policy pay off most.
• Scoped Credentials for Agents — the other half of the egress story.

Project sources:

• E2B documentation
• Daytona documentation
• Modal — Sandbox networking and security
• Cloudflare Sandbox SDK documentation