Daytona: 90ms Sandboxes for Safe AI Agent Code Execution

Why AI Agents Need Dedicated Sandboxes

AI agents require a full execution loop: provision environment, read/write files, run commands, capture logs, and clean up. AI-generated code differs from human-written code in four critical ways:

Unknown dependencies that may install massive packages and pollute the host

Unpredictable logic risking infinite loops or resource exhaustion

Uncontrolled actions such as arbitrary file I/O or outbound network calls

Multi-turn tasks needing persistent context while guaranteeing isolation between runs

Traditional Docker containers fall short for high-frequency agent workloads: cold starts take 2–3 seconds, lifecycle/resource-quota/network-whitelist orchestration must be built from scratch, and the Docker API targets application deployment—not interactive, programmatic file/command execution by agents.

Daytona's Core Philosophy

Models generate code; infrastructure guarantees safety. Daytona provides not a simple function-call interface but a fully orchestratable, strongly isolated, programmable microcomputer called a Sandbox .

Sandbox Capabilities

Startup speed: Official metric 90 ms to ready, satisfying agent short-lived invocations.

Default resources: 1 vCPU, 1 GB RAM, 3 GB disk; max 4 vCPU, 8 GB RAM, 10 GB disk—covering most AI code execution, data analysis, and unit-test scenarios.

OCI/Docker image compatibility: Not a Docker container, yet reuses existing Docker images and Dockerfiles without migration.

Full Lifecycle Management

Sandbox state machine: Creating → Started → Stopped → Archived → Deleted, all controllable via API/SDK.

Stop – preserves filesystem, clears memory (like power-off); restart restores files.

Pause – saves memory state; resume continues processes, ideal for long-running context-heavy tasks.

Archive – snapshots filesystem to object storage, drastically cutting idle storage cost.

Auto policy – default 15 minutes without external interaction triggers stop. Critical caveat: the inactivity timer ignores internal background processes. Long-running inference or data jobs will be killed mid-run. Fix: set auto_stop_interval=0 at creation or send periodic heartbeats.

Snapshots & Experimental Fork

Snapshots capture a fully provisioned environment (dependencies, config) for instant, consistent sandbox creation. Built from Dockerfiles; compatible with Docker Hub, GHCR, Google Artifact Registry, etc. Experimental Sandbox Fork (API prefixed experimental ) clones a running sandbox including memory state, enabling agent exploration of multiple execution branches.

Network Security

Default standard policy; configurable egress allowlist or complete external-access denial to prevent rogue outbound requests from AI code.

Three-Layer Decoupled Architecture

Interface Plane – Entry points for agents and developers: multi-language SDKs (Python, TypeScript, Ruby, Go, Java), CLI, Web console, SSH, VNC, and MCP Server. All converge on the Control Plane.

Control Plane – Core brain: NestJS REST API handling auth, sandbox scheduling, snapshot management. Backed by Redis (cache/distributed locks), PostgreSQL (metadata), Auth0 (identity).

Compute Plane – Runner nodes executing sandboxes. Uses Linux Namespaces for process, filesystem, and network isolation. Each sandbox runs a Daemon agent exposing a Toolbox API for external file ops, command execution, and log streaming.

Decoupling enables three deployment modes: Daytona Cloud (managed), full self-hosted (air-gapped), or hybrid (control plane hosted, compute nodes on-prem).

MCP Protocol Integration

Daytona natively implements Anthropic's Model Context Protocol (MCP). Its built-in MCP Server wraps every sandbox capability as a model-callable tool. MCP-compatible clients (Claude, Cursor) invoke Daytona via MCP; the platform auto-provisions a sandbox, runs code in isolation, returns results—never touching the local host. Official docs provide ready-made integrations for LangChain, Mastra, OpenCode, enabling workflows like automated test runs and PR submissions.

Multi-Language SDK Hands-On

Five official SDKs (Python, TypeScript, Ruby, Go, Java) share a unified paradigm:

init client → create sandbox → execute code / read-write files → destroy sandbox

.

Prerequisites

Register at https://app.daytona.io and generate an API Key.

Python ≥ 3.10.

pip install daytona

Example 1: Spin Up a FastAPI Service (Python)

from daytona import Daytona, DaytonaConfig, CreateSandboxBaseParams
import time

def main():
    daytona = Daytona(DaytonaConfig(api_key="YOUR_API_KEY"))
    print("Daytona client initialized!")
    print("Creating Python sandbox...")
    sandbox = daytona.create(CreateSandboxBaseParams(language="python"))
    print(f"Sandbox created! ID: {sandbox.id}")
    time.sleep(5)
    # Install deps
    install_result = sandbox.process.exec("pip install fastapi uvicorn")
    print(f"Install result: {install_result.result}")
    # App code
    fastapi_code = '''from fastapi import FastAPI
app = FastAPI()
@app.get("/")
async def read_root():
    return {"message": "Hello World from Daytona Sandbox!"}
@app.get("/health")
async def health_check():
    return {"status": "healthy"}
if __name__ == "__main__":
    import uvicorn
    uvicorn.run(app, host="0.0.0.0", port=8000)'''
    # Write file
    sandbox.fs.upload_file(fastapi_code.encode(), "app.py")
    print("FastAPI app file created")
    # Background start
    run_result = sandbox.process.exec("nohup python app.py > app.log 2>&1 &")
    print(f"FastAPI start result: {run_result.result}")
    time.sleep(5)
    # Check process
    process_result = sandbox.process.exec("ps aux | grep python")
    print(f"Process info: {process_result.result}")
    # Test endpoint
    test_result = sandbox.process.exec("curl -s http://localhost:8000/")
    print(f"API test result: {test_result.result}")
    # View logs
    log_result = sandbox.process.exec("cat app.log")
    print(f"App logs: {log_result.result}")
    return sandbox

if __name__ == "__main__":
    sandbox = main()

Example 2: Get Public Preview Link for Sandbox Service

#!/usr/bin/env python3
import asyncio
from daytona import Daytona, DaytonaConfig

async def get_preview_url_simple():
    daytona = Daytona(DaytonaConfig(api_key="YOUR_API_KEY"))
    sandbox_id = "YOUR_SANDBOX_ID"
    port = 8000
    target_sandbox = daytona.find_one(sandbox_id)
    if not target_sandbox:
        print("❌ Sandbox not found")
        return
    print(f"✅ Sandbox state: {target_sandbox.state}")
    preview_link = target_sandbox.get_preview_link(port)
    print(f"
Access URL: {preview_link.url}")
    print(f"Access token: {preview_link.token}")

if __name__ == "__main__":
    asyncio.run(get_preview_url_simple())

TypeScript Minimal Example

import { Daytona } from "@daytona/sdk";

const daytona = new Daytona({ apiKey: "YOUR_API_KEY" });
const sandbox = await daytona.create();
const response = await sandbox.process.codeRun('print("Hello World!")');
console.log(response.result);

Java Minimal Example

DaytonaConfig config = new DaytonaConfig.Builder()
    .apiKey("YOUR_API_KEY")
    .build();
try (Daytona daytona = new Daytona(config)) {
    Sandbox sandbox = daytona.create();
    ExecuteResponse response = sandbox.getProcess().executeCommand("echo 'Hello World!'");
    System.out.println(response.getResult());
}

Self-Hosted One-Liner

(curl -sf -L https://download.daytona.io/daytona/install.sh | sudo bash) && daytona server -d

Create environment: daytona create. Integrates with VS Code, JetBrains IDEs, GitHub, GitLab, Bitbucket, Gitea; supports multi-project microservice workspaces with automatic VPN for secure connectivity.

Daytona vs Docker – Core Differences

Core Positioning: Docker is a general container platform for app packaging/deployment; Daytona is AI-agent-specific programmable sandbox execution infrastructure.

Target Scenario: Docker targets low-frequency app deployment & delivery; Daytona targets high-frequency dynamic create/destroy AI code execution tasks.

Agent Friendliness: Docker has ops-oriented API with high agent integration cost; Daytona offers native programmatic SDK/API, zero-friction.

Lifecycle Management: Docker requires custom orchestration logic; Daytona has built-in full lifecycle, auto-stop/archive/delete.

Startup Speed: Docker cold start takes seconds; Daytona reaches ready in 90 ms.

Isolation: Docker uses Linux Namespaces; Daytona adds network allowlist, resource quotas, snapshots, VNC/SSH on top of Linux Namespaces.

Summary: Docker packages your business apps; Daytona gives AI agents on-demand, ephemeral, isolated execution environments.

Applicable Scenarios

AI Coding Agents (OpenHands, SWE-agent): write code → sandbox execute → run tests → iterate fix, fully isolated.

Online Coding Education : per-student sandbox, zero interference, auto-recycle.

Data Analysis Automation : agent reads CSV, generates Python script, executes in sandbox, returns charts/stats—no host pollution.

Large-Scale Parallel Evaluation : batch LLM eval, RL environments, thousands of sandboxes scaling horizontally.

CI/CD Dynamic Test Environments : concurrent ephemeral test envs, auto-destroy on completion.

Secure Code Execution SaaS : expose online code-running to users with guaranteed isolation.

Selection Guidance & Final Thoughts

The next AI competitive moat isn't just model parameters—it's enabling AI to execute real tasks safely, reliably, and cost-effectively . Daytona solves the hardest engineering layer: the secure execution substrate for AI-generated code.

✅ Rapid prototyping: Daytona Cloud—API key only, zero infra ops.

✅ Data-sensitive / private deployment: Open-source self-hosted, all compute in-network.

✅ Enterprise hybrid: Control plane hosted, compute plane on-prem—convenience plus data sovereignty.

References:

Official docs: https://www.daytona.io/docs/

GitHub: https://github.com/daytonaio/daytona

When AI can autonomously write, run, and rewrite code, a trustworthy execution foundation becomes mandatory. Daytona is a leading candidate for that foundation.