Best ways to run untrusted or LLM-generated code safely in 2026, ranked
Updated October 24, 2026 .md
Short answer: Run it in a disposable microVM that holds none of your secrets, then throw it away. We rank Sandboxer first for full Linux microVMs with a no-secrets mode, then E2B, Vercel Sandbox and Cloudflare Sandbox. Use OpenAI's Code Interpreter for quick analysis inside the OpenAI API, and microsandbox or Firecracker to run microVMs yourself.
Published by Sandboxer, and we're on this list. We ranked by the criteria below and say where others are the better choice. Every fact about another platform comes from its own docs or pricing page, checked on the date shown; follow each name for the full comparison and sources.
The rules that matter more than the tool#
Whatever you pick, four rules do most of the work:
- A strong boundary. Give the code its own kernel (a VM or microVM), not a container sharing yours. See Container vs microVM.
- Nothing valuable inside. No SSH keys, cloud credentials or production access. Pass only short-lived, narrowly scoped keys the job needs.
- Limit where it can connect. Code that has read a secret can send it out. Filter egress, or assume anything inside can leave.
- Disposable by default. Start fresh, delete afterwards, and review output before it touches anything real.
How to compare the options#
- Isolation: a microVM or VM with its own kernel.
- Enough machine for the code: a full Linux environment if the code installs packages or runs services; a lighter runtime may be enough for short scripts.
- Session length: long enough for the job.
- Price: a published price for the size you need.
We apply criteria 1–4 in this order; later ones break ties. Hosted services are ranked first; tools you run yourself (microsandbox, self-hosted Firecracker) are listed after them. Docker Sandboxes ranks with the hosted services because it also runs in Docker's cloud; its "Docker / full Linux" cell reflects Docker support only, since root isn't documented, so we count it as partly meeting criterion 2.
Comparison table#
| # | Platform | Isolation | Resume keeps running processes | Docker / full Linux | Nested KVM | 4 vCPU / 8 GB, per hour | Checked |
|---|---|---|---|---|---|---|---|
| 1 | Sandboxer | microVM (Cloud Hypervisor, its own kernel) | Yes | Yes | Yes | $0.036 | 2026-10-24 |
| 2 | E2B | microVM | Yes | Partly | No | $0.33 | 2026-10-15 |
| 3 | Vercel Sandbox | microVM | No | Partly | Not documented | $0.68 | 2026-10-15 |
| 4 | Cloudflare Sandbox | microVM per container instance (docs: each instance has its own kernel) | No | Partly | Not documented | $0.36 | 2026-10-24 |
| 5 | Docker Sandboxes | microVM (hypervisor) | Not documented | Yes | Not documented | — | 2026-10-24 |
| 6 | Deno Sandbox | Linux microVM | Not documented | Not documented | Not documented | — | 2026-10-24 |
| 7 | OpenAI Containers (Code Interpreter) | Sandboxed virtual machine (per OpenAI docs) | No | No | Not documented | — | 2026-10-24 |
| 8 | Modal | gVisor or VM | Partly | Partly | Partly | $0.48 | 2026-10-15 |
| 9 | microsandbox | microVM (libkrun) | Yes | Partly | Not documented | — | 2026-10-24 |
| 10 | Self-hosted Firecracker | Firecracker microVM (KVM) | Yes | Partly | Not documented | — | 2026-10-24 |
"Not documented" means the platform's public docs don't say. Prices are list prices for one 4 vCPU, 8 GB machine-hour; a dash means the platform doesn't sell that size by the hour or doesn't publish a price for it.
The options, ranked#
1. Sandboxer#
At a glance (source: our docs and pricing): isolation: microVM (Cloud Hypervisor, its own kernel) · resume keeps processes: Yes · longest session: No limit on paid plans · price: $0.036/hour.
Best for: untrusted code that needs a whole machine, such as agent output, user submissions or packages you don't know. Each sandbox is a Cloud Hypervisor microVM with its own kernel. A --no-env sandbox receives none of your variables, files or credentials and can't act on your account. Sandboxes can't reach each other or our internal networks.
sbx new --no-env # no secrets of yours inside
sbx scp ./untrusted.py sb_k3v9x2mq:/home/user/
sbx exec sb_k3v9x2mq --timeout 300 "python3 untrusted.py"
sbx delete sb_k3v9x2mq --yesWhere others win: outbound internet is open by default, so filter egress yourself if you need to; no GPUs.
2. E2B#
At a glance (source: E2B docs, checked 2026-10-15): isolation: microVM · resume keeps processes: Yes · longest session: see comparison · price: $0.33/hour · full comparison and sources.
Best for: code execution from a TypeScript or Python SDK on Firecracker microVMs, with the option to self-host the open-source stack.
Where it's weaker for this use: sessions are capped per plan.
3. Vercel Sandbox#
At a glance (source: Vercel Sandbox docs, checked 2026-10-15): isolation: microVM · resume keeps processes: No · longest session: see comparison · price: $0.68/hour · full comparison and sources.
Best for: apps on Vercel that need isolated code execution: Firecracker microVMs, a firewall, and Secure Compute with static IPs and VPC peering.
Where it's weaker for this use: it's part of the Vercel platform and bills active CPU.
4. Cloudflare Sandbox#
At a glance (source: Cloudflare Sandbox docs, checked 2026-10-24): isolation: microVM per container instance (docs: each instance has its own kernel) · resume keeps processes: No · longest session: no fixed limit stated · price: $0.36/hour · full comparison and sources.
Best for: short, event-driven execution from Cloudflare Workers; each container instance runs in its own microVM, billed in 10 ms steps of active time.
Where it's weaker for this use: the environment is a container controlled from Workers rather than a general-purpose machine.
5. Docker Sandboxes#
At a glance (source: Docker Sandboxes docs, checked 2026-10-24): isolation: microVM (hypervisor) · resume keeps processes: Not documented · longest session: cloud: 1 hour by default · price: No 4 vCPU / 8 GB list price · full comparison and sources.
Best for: microVM sandboxes that run free on your own machine or in Docker's cloud, with a host-side network proxy that keeps credentials out of the VM.
Where it's weaker for this use: cloud sandboxes expire after one hour by default.
6. Deno Sandbox#
At a glance (source: Deno Sandbox docs, checked 2026-10-24): isolation: Linux microVM · resume keeps processes: Not documented · longest session: 30 minutes per session; extendable · price: No 4 vCPU / 8 GB list price · full comparison and sources.
Best for: short code-execution jobs from JavaScript or Python, in Linux microVMs that Deno says start in under 200 ms.
Where it's weaker for this use: sessions are 30 minutes (extendable).
7. OpenAI Containers (Code Interpreter)#
At a glance (source: OpenAI Containers (Code Interpreter) docs, checked 2026-10-24): isolation: Sandboxed virtual machine (per OpenAI docs) · resume keeps processes: No · longest session: expires after 20 minutes without use · price: No 4 vCPU / 8 GB list price · full comparison and sources.
Best for: agents already on the OpenAI API that need quick data analysis or code runs, with no infrastructure of your own. OpenAI describes each container as a sandboxed virtual machine, with Python, Node.js and other runtimes preinstalled.
Where it's weaker for this use: a container expires after 20 minutes without activity, and there's no root.
8. Modal#
At a glance (source: Modal docs, checked 2026-10-15): isolation: gVisor or VM · resume keeps processes: Partly · longest session: see comparison · price: $0.48/hour · full comparison and sources.
Best for: very large numbers of short executions, and GPUs.
Where it's weaker for this use: the default isolation is gVisor rather than a VM with its own kernel.
9. microsandbox#
At a glance (source: microsandbox docs, checked 2026-10-24): isolation: microVM (libkrun) · resume keeps processes: Yes · longest session: Not documented · price: No 4 vCPU / 8 GB list price · full comparison and sources.
Best for: running microVMs inside your own app or on your own machines: open source, libkrun microVMs.
Where it's weaker for this use: it's beta software, and you run and operate it yourself.
10. Self-hosted Firecracker#
At a glance (source: Self-hosted Firecracker docs, checked 2026-10-24): isolation: Firecracker microVM (KVM) · resume keeps processes: Yes · longest session: no limit · price: No 4 vCPU / 8 GB list price · full comparison and sources.
Best for: full control on your own hardware. Firecracker's docs describe workloads as "considered sacred … and malicious" and require the jailer in production.
Where it's weaker for this use: you build networking, egress filtering ("should be filtered at the host-level", per its docs), images and an API yourself.
What it costs#
For short executions, per-second or per-active-time billing keeps costs small. Sandboxer's default size is $0.036/hour, billed per second, so a 30-second run costs a fraction of a cent. Platforms built for short jobs, such as Deno, Cloudflare and OpenAI's per-session containers, often suit very short, frequent runs; a full VM suits jobs that need installs, services or long runtimes.
How we tested#
We read each platform's own docs and pricing pages, recorded what they state with a date, and had a second reviewer check each claim against its source. Claims about Docker, gVisor and Firecracker come from those projects' own docs. Sandboxer's isolation and secrets behaviour are in our security docs and environment docs; our timings, measured by us on 2026-10-24, are in results and conditions.
Which should you choose?#
- Untrusted code that needs a whole machine, with none of your secrets: Sandboxer.
- SDK-first code execution, or self-hosting: E2B.
- Inside Vercel or Cloudflare: Vercel Sandbox or Cloudflare Sandbox.
- Short JS or Python snippets: Deno Sandbox.
- Inside the OpenAI API: Code Interpreter containers.
- On your own hardware: microsandbox or self-hosted Firecracker.
FAQ#
What is the safest way to run code an LLM wrote?#
In a disposable VM or microVM that holds none of your secrets, with outbound traffic limited where you can, deleted after the run. Review the output before using it anywhere real.
Is Docker safe for running untrusted code?#
A plain container shares the host's kernel, and Docker's own docs say the daemon needs root unless you use rootless mode. For untrusted code, a microVM is a stronger boundary.
Do I need a VM if I use gVisor?#
gVisor adds a strong layer of isolation by intercepting system calls in a user-space kernel with a Linux-like interface. A microVM runs a real Linux kernel of its own behind hardware virtualization.
How do I stop the code from stealing my API keys?#
Don't put them there. Start the sandbox with no secrets (sbx new --no-env on Sandboxer) and pass only a short-lived key for that one job, or use a proxy that injects credentials outside the sandbox (Docker Sandboxes documents one).
Can sandboxes reach each other?#
On Sandboxer, no: VM-to-VM traffic is blocked, and sandboxes can't reach our hosts or internal networks. Connect them over the internet with your own authentication if you need to.
Related#
More guides
For running AI-written code we rank Sandboxer, Freestyle and E2B first: each gives code its own VM with an API or SDK and can pause with memory. Pick Daytona for Windows or GPUs, Modal or Northflank for GPUs at scale, E2B or Northflank to run in your own cloud, and Vercel Sandbox if your app lives on Vercel.
For coding agents we rank Sandboxer first: a full Ubuntu VM with Claude Code and Codex preinstalled, Docker, and stop-and-resume that keeps the agent's session in memory. Freestyle and Amp Orbs also keep memory across pauses. Pick E2B for prebuilt agent templates on open source, Docker Sandboxes for free local runs, and Codespaces if you live in GitHub.
The best Daytona alternatives depend on why you're switching. For a full Linux microVM on every sandbox with memory-saving stop and Docker, we rank Sandboxer first. E2B suits open source and self-hosting, Modal massive short-job fleets, Northflank bring-your-own-cloud with GPUs, and Vercel Sandbox apps on Vercel.
If you're leaving E2B for longer sessions or a fuller machine, we rank Sandboxer first, then Freestyle: both give each sandbox a full Linux VM that keeps memory across pauses, with Docker and no short session cap. Pick Daytona for Windows or GPUs, Northflank for bring-your-own-cloud, and stay on E2B if you need open source.