Sandbox Execution for Code Agents
Never run model-generated code on your host — use gVisor, Firecracker, or E2B sandboxes.
Sandbox Execution for Code Agents is a free AI Agents lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the AI Agents learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Why Sandbox?
Code agents (Devin, Claude Code, OpenDevin) run model-generated code. If you run that code on your host, the model can:
- Read your secrets / API keys
- Delete files
- Make outbound network calls
- Mine crypto
Sandbox = isolated environment that limits damage.
Levels of Isolation
| Level | Tool | Use |
|---|---|---|
| Process | subprocess + chroot | Low security, dev only |
| Container | Docker | Decent default |
| VM / microVM | Firecracker, gVisor | Strong isolation |
| Hosted sandbox | E2B, Daytona | Easiest production |
Docker Sandbox Basics
docker run \
--rm \
--network=none \
--memory=512m \
--cpus=0.5 \
--read-only \
--user=nobody \
-v /tmp/work:/work:rw \
python:3.11-slim \
python /work/script.pyNetwork Isolation
--network=none disables outbound traffic. For some tasks you need limited internet — use an egress proxy that allowlists specific hosts.
Resource Limits
Caps prevent runaway CPU / memory:
--memory— RAM cap--cpus— CPU share--pids-limit— process count--ulimit— file descriptors
Firecracker / gVisor
For stronger isolation than Docker:
- Firecracker — microVM by AWS, used by Lambda
- gVisor — user-space kernel by Google, drop-in for Docker
- Kata Containers — Docker UX with VM isolation
E2B Hosted Sandbox
E2B (e2b.dev) gives you a remote sandbox via API:
# pip install e2b
import e2b
sandbox = e2b.Sandbox(template='python', api_key='...')
result = sandbox.run_code('print(2 + 2)')
print(result.stdout) # '4'
sandbox.close()Daytona
Daytona offers similar hosted-sandbox capabilities oriented toward dev workspaces.
File System Sandbox
Mount only what the agent needs read-write; everything else read-only or hidden:
docker run -v ${PWD}/workdir:/workdir:rw \
-v ${PWD}/readonly:/readonly:ro ...Time Limits
Bound execution wall time to prevent endless loops:
docker run --rm --stop-timeout 30 ... \
python -c 'import resource; resource.setrlimit(resource.RLIMIT_CPU, (30, 30)); exec(open("/work/script.py").read())'Logging
Capture every command, every output, every file change. For high-stakes agents, audit-log the full sandbox session.
Multi-Tenant Sandboxes
Per-user sandboxes prevent users from poisoning each other's state. Spin up a fresh sandbox per session; tear down after.
Cost vs Security
Stronger isolation = more cost (per-VM overhead). Match level to risk:
- Tutorial / sandbox feature for users: Docker is fine
- Production code that touches secrets: Firecracker / E2B
Network Lockdown
How do you prevent a code agent from making any outbound network calls?
Recap
Never run model-generated code on your host. Pick isolation level by risk: Docker for dev, gVisor / Firecracker / E2B for prod. Cap CPU, memory, time, network.
Frequently asked questions
Is the “Sandbox Execution for Code Agents” lesson free?
Yes — the full text of “Sandbox Execution for Code Agents” is free to read here on the web, and the AI Agents course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the AI Agents course, upgrade to CoddyKit PRO.
What will I learn in “Sandbox Execution for Code Agents”?
Never run model-generated code on your host — use gVisor, Firecracker, or E2B sandboxes. You practise AI Agents with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start AI Agents?
No prior experience is required. AI Agents on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Sandbox Execution for Code Agents” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this AI Agents lesson?
Yes. Every AI Agents lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Prompt Injection Defences
- Output Filtering (Llama Guard, NeMo)
- Sandbox Execution for Code Agents
- Access Control on Tools