An agent that executes code is only as trustworthy as the box it executes in. Sandbox architecture — the layered choice among containers, microVMs, WebAssembly, and language runtimes — is the decision that sets the ceiling on everything else your agent platform can safely offer.
The threat model is concrete: the code is untrusted-by-default (model-generated, potentially influenced by injected instructions), and it wants the same things all hostile code wants — filesystem, network egress, credentials in the environment, and a host to escape. The isolation technologies differ in where their walls are and what they cost. The platform choice is a trade among escape resistance, cold-start latency, and capability coverage — and getting it wrong in either direction (too open, too slow) kills the feature from one side or the other.
| Isolation layer | Escape resistance | Trade-off profile |
|---|---|---|
| Container | Shared kernel — good hygiene, not a security boundary alone | Fast starts, full language support; harden with seccomp, no-mount secrets, egress deny |
| MicroVM (Firecracker, gVisor) | Hardware-virtualized or syscall-interposed kernel | Strong boundary; ~125ms+ cold starts (Firecracker snapshot-restores approach containers) |
| WebAssembly | Capability-based, no ambient OS access by design | Millisecond starts, tiny surface; immature native/I/O story for general code |
| Language runtime (JS eval) | Process-level only; historically leaky | Cheapest to ship, weakest wall — acceptable solely for fully-static, no-I/O snippets |
The surrounding architecture matters as much as the wall. Sandboxes are ephemeral — created per run or per task, destroyed after, with no state carried between executions except through explicit, scanned channels. The environment contains no ambient secrets — credentials enter as short-lived scoped tokens only for calls the sandbox explicitly proxies.Network egress is denied by default and proxied through an allow-list, because exfiltration needs a route. And resource limits — CPU, memory, wall-clock, fork bombs — are enforcement, not suggestion, since even non-malicious generated code can loop forever.
The strategic view: sandbox depth is a product feature. Every autonomy level you want to offer — run-read-only code, run-with-filesystem, install-packages, touch-the-internet — is priced in isolation engineering paid up front. Platforms that skip the payment ship the feature anyway, and their incident write-ups eventually explain the difference.