Daytona vs Modal (2026)

An agent in a Daytona sandbox reaches outside systems through what runs inside it. Git operations clone and push repositories, secrets hold credentials and external storage can be mounted. Firewall allow lists decide which hosts the agent may reach. Daytona has no catalog of connectors, OAuth actions or tool gateway of its own. The tools are the customer's code.

Sourcedaytona.io/docs/llms.txtread 2026-09-22

Code on Modal reaches other systems through what the customer writes. OIDC tokens authenticate functions to external clouds, cloud buckets mount as filesystems, and secrets hold credentials. Slack notifications report on apps (beta), and examples connect Discord, Google Sheets and Tailscale. Modal has no catalog of connectors, OAuth actions or tool gateway of its own, so the tools are the customer's code.

Sourcemodal.com/llms.txtread 2026-09-22

The platform manages sandboxes. It creates and resizes them, applies lifecycle rules and runs warm pools and fleet scaling. It does not sequence, branch, retry or route an agent's steps. In Daytona's guides, agents built in LangGraph, the OpenAI Agents SDK and other frameworks do that, and Daytona has no workflow logic that mixes fixed steps with agent steps.

Sourcedaytona.io/docs/en/sandboxesread 2026-09-22

Retries are first class on Modal. A Retries policy can sit on any function, alongside job queues, fan out with map and spawn, batch and dynamic batching, and gang scheduled clusters. A pipeline that mixes model calls with deterministic steps can be built on these pieces. Sequencing and branching live in the customer's Python. Modal has no multistep workflow primitive that records completed steps and resumes after failure.

Sourcemodal.com/docs/guide/retriesread 2026-09-22

Events go outward. Webhooks notify the customer's endpoint when sandboxes are created or change state and when snapshots and volumes change. Automated lifecycle rules stop, pause, archive or delete idle sandboxes. An agent's work starts only when the customer's code starts it. There is no schedule, and a stopped sandbox does not wake on an inbound request.

Sourcedaytona.io/docs/en/webhooksread 2026-09-22

Scheduled Functions run on a cron expression or a fixed period. Web functions and endpoints boot a container from zero when a request arrives, and job queues hand work to functions as it lands.

Sourcemodal.com/docs/guide/cronread 2026-09-22

The agent's code runs on Daytona, but there is no retrieval structure over the customer's content. Volumes and mounted external storage hold files the agent's code reads, and there is no index to query. The language server in a sandbox serves code intelligence for the files there. Nothing in Daytona indexes, refreshes or sets permissions on the customer's sources.

Sourcedaytona.io/docs/llms.txtread 2026-09-22

Retrieval systems the customer builds can run on Modal, and its examples embed documents with TEI and run a RAG chatbot over PDFs. Modal does not maintain a retrieval structure over the customer's content that an agent queries. Volumes, Dicts and mounted buckets are storage, and the product itself cannot index, refresh or permission sources.

Sourcemodal.com/llms.txtread 2026-09-22

Persistence is on by default at three layers. The filesystem survives stop, start and archive. On VM sandboxes, memory (running processes and loaded state) survives pause and resume and hot snapshots. Volumes and mounted external storage outlive any one sandbox. Sandboxes can also be forked, and the agent's code reads the restored state to carry on. Paused process state belongs to the machine, so the customer can resume or delete it but cannot review or edit it. There is no separate memory layer that sets what an agent keeps or for how long.

Sourcedaytona.io/docs/en/persistenceread 2026-09-22

State carries across runs. Sandbox snapshots save and restore a sandbox's filesystem and memory, memory snapshots speed cold starts, volumes persist files, and Dicts and Queues hold data shared across function calls. The agent's code reads that state to carry on. Restored process state belongs to the machine, and the customer can resume or delete it but cannot review or edit it. Modal has no memory layer for agents.

Sourcemodal.com/docs/guide/sandbox-snapshotsread 2026-09-22

Work in a sandbox has no approval step, consent checkpoint or escalation to a person. VNC, a web terminal and SSH let a person watch a sandbox and step in by hand. A firewall on each sandbox (allow lists or block all, with organization tiers that sandbox settings cannot override) restricts what an agent's code can reach. Nothing holds an agent's action for a person to review.

Sourcedaytona.io/docs/en/network-limitsread 2026-09-22

Work running on Modal has no approval step, consent checkpoint or escalation to a person. Restricted Functions stop untrusted code from touching Modal resources, calling other functions or reaching Modal's APIs. With sandbox networking controls, they give isolation the developer configures, and no person reviews an agent's action.

Sourcemodal.com/docs/guide/restricted-accessread 2026-09-22

Organizations sign in through OpenID Connect providers such as Google Workspace, Microsoft Entra ID and Okta, with provisioning and membership handled at sign in on the Enterprise plan. Collaborative organizations have owner and member roles plus granular assignments by resource, such as SSO Admin and access to the audit log.

API keys carry permissions and scopes, with managed child keys. An audit log covers user and system activity, and each sandbox has firewall allow lists or block all. Daytona says it meets HIPAA, SOC 2 and GDPR standards and has a Trust Center, but it names no report type or auditor.

Sourcedaytona.io/docs/en/ssoread 2026-09-22

A SOC 2 Type II audit report is available through Modal's Security Portal at trust.modal.com, and Modal supports HIPAA and has external penetration testing. Identity runs through SSO with Okta, Microsoft Entra or custom SAML, with SCIM provisioning (beta). Access is managed with role based access control, user groups and service users, and an append only audit log records sensitive actions on Enterprise. Secrets, Restricted Functions that cannot touch Modal resources, and sandbox networking controls round out the controls.

Sourcemodal.com/docs/guide/securityread 2026-09-22

Each step an agent takes in the sandbox is recorded. SDK tracing instruments every Daytona API operation and SDK call from the customer's application, such as each command run, file written or process started. Sandbox telemetry collects traces, logs and metrics from inside the sandbox.

Both export over OpenTelemetry to the customer's own collector, and Daytona keeps sandbox telemetry for three days. A separate audit log records user and system activity with the user, action and time, and logs can be streamed. The model's reasoning runs outside Daytona. Audit export is not available yet, and Daytona says it is coming soon.

Sourcedaytona.io/docs/en/observability/otel-collectionread 2026-09-22

The workload itself is recorded in detail. Modal keeps real time logs and metrics per function and container, GPU metrics, function stats, and an append only audit log of sensitive workspace actions on Enterprise. Audit logs, function logs and container metrics export to any OpenTelemetry provider or Datadog. Audit stays separate from runtime. Prompts, tool calls, retrieved knowledge and outputs can be inspected step by step only as far as the customer's own code logs them. There is no tracing of each call an agent makes.

Sourcemodal.com/docs/guide/otel-integrationread 2026-09-22

Sandboxes run in two shared regions, the United States and Europe, chosen per sandbox. Under Bring Your Own Compute, an organization instead creates custom regions and attaches its own runner nodes, with an optional proxy and snapshot manager for each region, for control over data locality and compliance.

Daytona's control plane manages them, and BYOC is sold on the Enterprise plan. The platform sold today cannot be self hosted from open source. Core development has moved to a private codebase, and the public github.com/daytonaio/daytona repository gets no further updates. Its last release, v0.190.0, stays public under AGPL 3.0.

Sourcedaytona.io/docs/en/bring-your-own-computeread 2026-09-22

Workloads can be pinned to a region. Functions and Sandboxes take a region argument for the container region, dedicated Endpoints set both container and routing regions, and a data residency guide sets out per service what can be pinned and when customer data may leave the region. Region selection carries a price multiplier (1.15x broad, 1.75x narrow). Modal is a managed cloud with no self hosted option, and shared Endpoints do not take a region.

Sourcemodal.com/docs/guide/data-residencyread 2026-09-22

Ready made starting points for running agents include default sandbox snapshots in several sizes, a Declarative Builder for images and an agent skill for coding agents. More than forty guides run coding agents (Claude Code, Codex, Devin, Gemini CLI, OpenClaw, OpenCode), as well as framework agents and reinforcement learning setups, in sandboxes. Developers build from these environments and walkthroughs. There is no browsable catalog of agents a customer can adopt.

Sourcedaytona.io/docs/en/agent-skillsread 2026-09-22

Ready made starting points come as a gallery of runnable examples and a Library of models deployable as Shared or Dedicated Endpoints. The agent examples include Cursor cloud agents, a background coding agent with OpenCode, a coding platform, a Claude Agent SDK Slack bot, a LangGraph agent in a GPU sandbox, a computer use agent over VNC and parallel evals. Developers build from these examples and models, and there is no browsable catalog of agents for a customer to adopt.

Sourcemodal.com/llms.txtread 2026-09-22

The customer chooses the model. Guides run agents on Claude, OpenAI Codex and the Agents SDK, Gemini, Kimi and AWS Kiro, and on open models through OpenCode and other frameworks. GPU sandboxes serve the customer's own LLMs with vLLM or SGLang. Daytona imposes no model, and customers bring their own providers and keys, with guides on setting them up.

Sourcedaytona.io/docs/llms.txtread 2026-09-22

Model choice is the customer's throughout. Modal serves models from its Library on Shared Endpoints billed per token or Dedicated Endpoints with the customer's capacity and region. The customer can deploy any open model on GPUs with vLLM or SGLang, as its examples show for DeepSeek, Nemotron and others.

Sourcemodal.com/docs/guide/shared-endpointsread 2026-09-22

Outside callers reach Daytona through SDKs in five languages (Python, TypeScript, Ruby, Go and Java), a REST API with published OpenAPI specifications, and a CLI. The specifications cover the Daytona API, the Toolbox API inside the sandbox and an Analytics API. An MCP server lets Claude, Cursor and Windsurf manage sandboxes, and an agent skill serves coding agents.

Sourcedaytona.io/docs/llms.txtread 2026-09-22

Official SDKs in Python, JavaScript/TypeScript and Go (the latter two in beta) let outside code call Modal, alongside a full CLI that includes a skills command for coding agents. Web functions and endpoints expose the customer's code as HTTP APIs, and a gRPC API sits behind the open source client.

Sourcemodal.com/llms.txtread 2026-09-22

Evaluations and reinforcement learning run on Daytona, but it does not score them. Its guides run training with HUD, TRL, veRL and OpenEnv in sandboxes, along with a benchmark agent across several languages. The datasets, reward functions and scoring belong to those frameworks. Daytona offers no fixtures, scoring or quality gates for a customer's agent workflows, and no way to compare agent runs.

Sourcedaytona.io/docs/llms.txtread 2026-09-22

Evaluations run on Modal, but scoring them is left to other tools. Its example runs massively parallel evals with Harbor in Modal Sandboxes, and its reinforcement learning examples use verl and TRL, with the datasets, graders and scoring belonging to those frameworks. Modal has no fixtures, scoring, quality gates or comparison of agent runs of its own.

Sourcemodal.com/llms.txtread 2026-09-22

The Computer Use API gives an agent programmatic control of a desktop in the sandbox, from mouse and keyboard to screenshots, screen recording and display operations, on Linux and Windows. VNC lets a person watch or take over. The desktop runs remotely on Daytona's infrastructure. macOS sandboxes are offered separately at use.computer, a different site with its own API.

Sourcedaytona.io/docs/en/computer-useread 2026-09-22

Computer use agents can run on Modal's machines. In one example, a Browser Use agent drives Chromium inside a Modal Sandbox, watched over VNC, with the model served from a Modal Endpoint. VM Sandboxes are in beta. Control of the browser comes from Browser Use, a separate library. Modal has no API for screenshots, clicks or typing, so it supplies the environment but not the control.

Sourcemodal.com/docs/examples/computer_use_vncread 2026-09-22