Best sandbox for smolagents in 2027

Q: Which executors does smolagents support?

A CodeAgent hands the Python it writes to an executor chosen by executor_type. In smolagents 1.26.0, read from its source on 25 October 2026, the accepted values are: The secure code execution guide says "no local python sandbox can ever be completely secure". It also says that "the only way to run LLM-generated code with truly robust security isolation is to use remote execution options".

Q: When might another sandbox fit better?

A drop-in executor_type. If you want to keep a CodeAgent exactly as it is and change one argument, the built-in e2b, modal and blaxel executors do that. Runtime connects as tools instead.

Which sandbox is best for smolagents?

It depends on whether your agent runs Python snippets or works on software. For an agent that drives a whole machine across steps, Runtime has the lowest cost of the sandboxes priced below: $34.17 for forty thousand runs, compared with $165.60 on E2B and $193.20 on Blaxel. It bills measured CPU and keeps files, packages and servers between steps. Pick the built-in e2b, modal or blaxel executor to keep a CodeAgent as it is and change one argument. Avoid the local and Docker executors for untrusted code.

Which executors does smolagents support?

A CodeAgent hands the Python it writes to an executor chosen by executor_type. In smolagents 1.26.0, read from its source on 25 October 2026, the accepted values are:

`executor_type`	Where the snippet runs	Isolation
`local` (default)	Your process, in smolagents' AST-walking interpreter	No isolation beyond the import allow-list
`docker`	A container on your machine	The host's kernel, shared
`e2b`	An E2B sandbox	Firecracker microVM
`modal`	A Modal sandbox	gVisor, a shared kernel
`blaxel`	A Blaxel sandbox	Lightweight VMs

The secure code execution guide says "no local python sandbox can ever be completely secure". It also says that "the only way to run LLM-generated code with truly robust security isolation is to use remote execution options".

Snippet runner or machine: which does your agent need?

The remote executors run one Python snippet at a time and send back its output. That suits a CodeAgent doing arithmetic and data wrangling. An agent that works on software needs more than that between steps:

State that outlasts a snippet. Files written in step two are there in step nine, and so is a server started in step four.
Other languages and tools. A shell runs npm test, go build or sqlite3 as easily as Python.
Packages on demand. pip install works inside the sandbox, with network access you can narrow to PyPI's hosts.
A time limit you set. Each command, and the sandbox itself, ends at a time limit you set.

What do smolagents runs cost on each executor?

Forty thousand runs a month, each ninety seconds on a 2 vCPU, 4 GiB sandbox and busy for 15 CPU-seconds, at each provider's published rates:

Provider	Isolation	A month of runs	Runtime costs less by
Runtime Cloud	Firecracker microVM	$34.17
E2B	Firecracker microVM	$165.60	79%
Modal	gVisor, a shared kernel	$237.96	86%
Blaxel	Lightweight VMs	$193.20	82%

When might another sandbox fit better?

A drop-in executor_type. If you want to keep a CodeAgent exactly as it is and change one argument, the built-in e2b, modal and blaxel executors do that. Runtime connects as tools instead.

Runtime Cloud

Runtime gives a smolagents agent a Firecracker microVM with its own kernel, pip and sudo. Four functions, which smolagents' @tool wraps as they are, provide access. The agent can install a package in one step, write a module in the next and run the tests in a third. The machine keeps all of it. The same runtime_exec tool runs npm test, go build or sqlite3. Each command takes the timeout you give it. The sandbox stops at the timeout_seconds you set, if you set one.

Runtime suits a ToolCallingAgent driving a machine. For a CodeAgent, the code it writes can call the same tools. The forty thousand runs above cost $34.17 on Runtime, 79% less than E2B and 82% less than Blaxel, at rates checked 25 October 2026.

A run on Runtime, recorded 1 October 2026

Pythonfrom smolagents import InferenceClientModel, ToolCallingAgent, toolfrom withruntime import Sandboxfrom withruntime.tools import sandbox_toolswith Sandbox.create(timeout_seconds=900, on_lease_end="stop") as sbx:    agent = ToolCallingAgent(tools=[tool(f) for f in sandbox_tools(sbx)], model=InferenceClientModel(), max_steps=15)    print(agent.run("How many CPUs and how much memory does the sandbox have?"))

We ran the same ToolCallingAgent loop from smolagents 1.26.0. A scripted Model subclass replaced the inference client, so the tool call was fixed. smolagents ran it against a live sandbox:

textStep 1  Calling tool: 'runtime_exec'  nproc && free -m        Observations: {'exit_code': 0, 'stdout': '2\n3939 MiB\n', ...}Step 2  Calling tool: 'final_answer'  done

The default size is two vCPUs and 4 GiB, minus what the kernel keeps. Testing the tools before paying for a model, and running the whole agent inside the sandbox, are in smolagents in a sandbox.

Once npx withruntime login has run, the agent above works on free usage. Code that calls the E2B or Blaxel SDK itself moves with the migration guide.

Sources

Checked 25 October 2026.

smolagents: Secure code execution: the quotes on local and remote execution
smolagents on PyPI: version 1.26.0, whose CodeAgent source lists the executor_type values
Each provider's published rates, checked 25 October 2026, as the pricing guide lists them
The recorded run: Runtime's Python SDK with smolagents 1.26.0 on Python 3.12, against production on 1 October 2026