Cloud Infrastructure
Cloud platforms converge on agent sandboxes—but each built them differently
AWS, Google Cloud, Microsoft Azure, and Cloudflare now all offer isolated code execution for AI agents, but their underlying technologies and constraints reveal deep architectural disagreements.
The New Stack
The major cloud providers have collectively settled a critical question for AI agents: where should untrusted code actually execute? All four—Amazon Web Services, Google Cloud, Microsoft Azure, and Cloudflare—now offer native sandbox primitives, even though they took fundamentally different technical paths to get there.
Divergent technical approaches#
The architectural choices reveal how little consensus exists on what "secure execution" actually means:
- AWS Lambda MicroVMs run on Firecracker, providing each session its own dedicated virtual machine with up to eight hours of runtime and the ability to suspend and resume while preserving memory, disk state, and processes.
- Google Cloud split the solution into two tracks: gVisor kernel interception for the GKE Agent Sandbox, and a lightweight isolated execution boundary within existing Cloud Run instances for Cloud Run Sandboxes (now in public preview).
- Microsoft Azure arrived first with Container Apps dynamic sessions running on Hyper-V boundaries since 2024, handling over 400,000 sessions daily just from Copilot usage.
- Cloudflare layered Sandboxes on top of Containers, with each sandbox running in its own VM and controlled through Workers and Durable Objects.
Four different isolation technologies solving the same problem signals that the market hasn't yet converged on a standard approach.
Cloud Run's minimal overhead model#
Google's Cloud Run implementation exemplifies how vendors are lowering friction for developers. The feature works as a simple --sandbox-launcher flag that mounts a sandbox binary inside the container, allowing applications to shell out through a normal subprocess call. The key advantage: Google charges nothing extra because sandboxes borrow CPU and memory already allocated to the running instance. A demonstration showed one Cloud Run service spinning up, executing, and shutting down 1,000 sandboxes in an average of 500 milliseconds each.
This stands in contrast to the traditional choice between sharing kernels (containers) and waiting for machines to boot (traditional VMs). Those gaps created opportunities for specialized third-party microVM vendors, but now all four major clouds have moved to close them.
