Best sandbox for the Claude Agent SDK in 2027

Q: What does the Claude Agent SDK need from a sandbox?

The SDK starts a claude subprocess that owns a shell, a working directory and its session transcripts on local disk. Anthropic's hosting guide, read on 25 October 2026, suggests 1 GiB of memory, 5 GiB of disk and one CPU per agent as a starting point, and lists the questions to ask a provider:

Q: When might another sandbox fit better?

GPUs. An agent that trains or serves a model on a GPU fits Modal or Daytona.

Which sandbox is best for the Claude Agent SDK?

It depends on how much of each session waits on Claude, and whether the agent needs a GPU. Most sessions mostly wait, and for those Runtime is the cheapest here: $5.42 for the thousand sessions below, against $10.70 on Cloudflare Sandbox and $27.60 on E2B. It bills measured CPU, and a paused hybrid session wakes with its claude process still running. Pick Modal or Daytona if the agent trains or serves a model on a GPU.

What does the Claude Agent SDK need from a sandbox?

The SDK starts a claude subprocess that owns a shell, a working directory and its session transcripts on local disk. Anthropic's hosting guide, read on 25 October 2026, suggests 1 GiB of memory, 5 GiB of disk and one CPU per agent as a starting point, and lists the questions to ask a provider:

Anthropic's question	What it asks
Who runs the sandbox	A service, or software you operate
Cold-start latency	Ephemeral sessions "need sub-second starts"
Persistent storage	Durable volumes, or only ephemeral disk
Pricing model	"Per-second pricing suits bursty ephemeral" work
Networking	Egress rules, outbound proxies, private networks

Which sandbox fits each session pattern?

The guide names four session patterns, and each asks something different of a sandbox:

Ephemeral, one sandbox per task. It should start fast and stop when the task returns, even after an error.
Long-running, an agent that serves traffic for days. It needs a sandbox with no short time limit and a way to reach its port.
Hybrid, a session that sits idle between visits. A sandbox that pauses with its memory kept lets the claude process resume without first reloading a transcript store.
Multi-agent, several SDK processes in one machine. It needs a large sandbox, and a meter that does not charge for vCPUs left idle.

How do the sandboxes compare for Agent SDK sessions?

The workload is a thousand sessions of 2 vCPU and 4 GiB, ten minutes each and busy for 60 CPU-seconds, at each provider's published rates.

Provider	Isolation	CPU billed on	A month of sessions
Runtime Cloud	Firecracker microVM	Measured use	$5.42
E2B	Firecracker microVM	Every vCPU held	$27.60
Daytona	Containers by default	Every vCPU held	$27.60
Modal	gVisor, a shared kernel	The CPU requested	$39.66
Vercel Sandbox	Firecracker microVM	Measured use	$16.27
Cloudflare Sandbox	A container in its own VM	Measured use	$10.70

When might another sandbox fit better?

GPUs. An agent that trains or serves a model on a GPU fits Modal or Daytona.

Runtime Cloud

Runtime addresses each of the five questions Anthropic's hosting guide asks of a sandbox provider. Each sandbox is a Firecracker microVM with its own Linux kernel. It runs on CPUs only.

Anthropic's question	Runtime
Who runs the sandbox	A service: one API call, no cluster
Cold-start latency	A new microVM per create, from a machine started ahead of time for the common shapes; timed each minute on speed
Persistent storage	Volumes, snapshots, and pause that keeps memory while you have credit
Pricing model	Per second, CPU billed on measured use
Networking	Host-enforced allow-lists, secrets proxy, WireGuard tunnels

For the four session patterns:

Ephemeral. await using sbx = await Sandbox.create() starts a sandbox and stops it when the task returns, even after an error.
Long-running. A paid sandbox runs for as long as it works, with no time limit; a preview gives its port an HTTPS address.
Hybrid. A sandbox pauses itself after 300 seconds with nothing happening and wakes on the next call with its memory intact. When the SDK runs inside the sandbox, its claude process is still running on wake.
Multi-agent. Size the sandbox up to 16 vCPUs and 64 GiB; idle vCPUs cost nothing, because CPU is billed on use.

The thousand sessions above cost $5.42 a month on Runtime, 80% less than E2B and 49% less than Cloudflare, at rates checked 25 October 2026. Most of a session's ten minutes are spent waiting on Claude, and Runtime bills that wait at its CPU floor of a twentieth of a vCPU rather than for every vCPU held.

A run on Runtime, recorded 1 October 2026

runtimeMcpServer(sbx) from withruntime/claude-agent-sdk is the in-process MCP server that query() is handed. This is the code an application runs:

TypeScriptimport { query } from "@anthropic-ai/claude-agent-sdk";import { Sandbox } from "withruntime";import { RUNTIME_TOOL_NAMES, runtimeMcpServer } from "withruntime/claude-agent-sdk";await using sbx = await Sandbox.create();for await (const message of query({  prompt: "Write primes.py that lists the primes below 60, run it, and say which kernel ran it.",  options: {    mcpServers: { runtime: runtimeMcpServer(sbx) },    allowedTools: RUNTIME_TOOL_NAMES,    disallowedTools: ["Bash", "Read", "Write", "Edit"],  },})) {  if (message.type === "result" && message.subtype === "success") console.log(message.result);}

We called the same server's tools over MCP against a live sandbox, as the SDK's subprocess would, without a paid model call. What came back:

texttools: runtime_exec, runtime_read_file, runtime_write_file, runtime_list_filesruntime_write_file primes.py  ->  Wrote 68 bytes to /workspace/primes.pyruntime_exec "python3 primes.py && uname -sr"  exitCode 0  [2, 3, 5, 7, 11, 13, 17, 19, 23, 29, 31, 37, 41, 43, 47, 53, 59]  Linux 6.18.44

The kernel line is the sandbox's own: a microVM boots its own Linux, not the host's. The full integration, with the Python SDK and spending caps, is Claude Agent SDK in a sandbox.

Should the whole SDK run inside the sandbox instead?

Both shapes work. Keeping query() in your service and handing it the MCP server means the Anthropic key never enters the sandbox, and the sandbox only sees commands. Running the SDK inside the sandbox, as Anthropic's container pattern does, suits a per-user agent that should own its whole machine: store the key as a Runtime secret, and the sandbox holds only a placeholder that the host swaps for the real key on requests to api.anthropic.com (secrets). Anthropic's own hosted option, Claude Managed Agents, can also be given Runtime sandboxes through the remote MCP server.

Your first sessions are free: run npx withruntime login and start one. An agent built on another provider's sandbox moves with the migration guide.

Sources

Checked 25 October 2026.

Hosting the Agent SDK: the subprocess model, the four session patterns, the provider questions and the 1 GiB, 5 GiB, one CPU starting point
Securely deploying AI agents: the isolation options and the credential proxy pattern
Each provider's published rates, checked 25 October 2026, as the pricing guide lists them
The recorded run: Runtime's TypeScript SDK with @anthropic-ai/claude-agent-sdk 0.3.277, against production on 1 October 2026