AWS, Google Cloud, Microsoft Azure, and Cloudflare now all offer agent sandboxes. None built them the same way.
The New Stack 3 months ago 54
AWS, Google Cloud, Microsoft Azure, and Cloudflare have all launched isolated code execution sandboxes for AI agents within weeks of each other, but implemented them using different underlying technologies: AWS uses Firecracker VMs with up to eight hours of runtime, Google Cloud uses gVisor kernel interception or lightweight boundaries within Cloud Run, Azure uses Hyper-V with 400,000+ daily sessions for Copilot, and Cloudflare uses containerized VMs. Google charges no premium for Cloud Run sandboxes because they reuse allocated CPU and memory, demonstrated with 1,000 sandbox executions averaging 500 milliseconds each. The architectural differences mean vendor-specific limits persist—Lambda MicroVMs cap at eight hours and run only on Graviton in five regions, while Cloud Run sandboxes share the parent instance's resources—keeping governance and orchestration decisions separate from containment boundaries.
