The original title is: "Four hyperscaler agent sandboxes, four different isolation primitives"

Short summary

AWS, Google Cloud, Azure, and Cloudflare each shipped managed agent sandboxes but built them on different isolation primitives—containers, microVMs, syscall-filtering runtimes, and JS isolates respectively. This fragmentation creates real trade-offs in startup latency, blast radius, portability, and audit trail across vendors. Teams should treat the sandbox as a first-class architectural choice matched to their trust boundary, and plan for eventual migration since no cross-vendor standard exists.

• •Four hyperscalers built agent sandboxes on four different isolation primitives with no shared blueprint
• •Portability and audit trails diverge significantly across vendor sandboxes
• •Teams should treat sandbox selection as a first-class design decision at the level of runner class or registry

Generated with AI, which can make mistakes.