Daytona vs Northflank (2026)

An agent in a Daytona sandbox reaches outside systems through what runs inside it. Git operations clone and push repositories, secrets hold credentials and external storage can be mounted. Firewall allow lists decide which hosts the agent may reach. Daytona has no catalog of connectors, OAuth actions or tool gateway of its own. The tools are the customer's code.

Sourcedaytona.io/docs/llms.txtread 2026-09-22

Agents reach outside systems through a short, fixed set of built in routes. A cloud harness pushes to Git through a proxy that limits its credentials to the harness branch and refreshes them automatically, workload identity issues short lived tokens for AWS, Google Cloud and Azure, and workflow message steps post to Slack, a webhook or a pull request comment. Any other API key can be added to outbound requests at egress so the agent's code never holds it, but the tools that use it are the customer's own code, and agents get no integration catalog or tool framework.

Sourcenorthflank.com/product/sandboxesread 2026-11-05

The platform manages sandboxes. It creates and resizes them, applies lifecycle rules and runs warm pools and fleet scaling. It does not sequence, branch, retry or route an agent's steps. In Daytona's guides, agents built in LangGraph, the OpenAI Agents SDK and other frameworks do that, and Daytona has no workflow logic that mixes fixed steps with agent steps.

Sourcedaytona.io/docs/en/sandboxesread 2026-09-22

Workflows chain builds, deployments, job runs, backups, conditions, approvals and messages in a visual editor or as JSON, with sequential, parallel and loop control and child workflows that can wait for completion, and the cloud agent loop carries agent built changes through previews, staging and production this way. A job can run an agent and the workflow waits for its result. These steps orchestrate releases and infrastructure around the agents, while the agent's own reasoning steps, hand offs and retries stay inside the customer's harness or code.

Sourcenorthflank.com/docs/v1/application/release/configure-workflowsread 2026-11-05

Events go outward. Webhooks notify the customer's endpoint when sandboxes are created or change state and when snapshots and volumes change. Automated lifecycle rules stop, pause, archive or delete idle sandboxes. An agent's work starts only when the customer's code starts it. There is no schedule, and a stopped sandbox does not wake on an inbound request.

Sourcedaytona.io/docs/en/webhooksread 2026-09-22

Work starts from Git events, schedules and webhooks. Workflows and preview blueprints run on a push, a pull request, a tagged release, a completed check suite, a pull request label, a cron schedule no more often than every 10 minutes, or a GET or POST to a webhook URL, with the branch, commit and pull request passed into the run. Jobs also run on cron schedules or on demand through the API, so an agent job can start on a timer or when another system calls it.

Sourcenorthflank.com/docs/v1/application/release/configure-workflowsread 2026-11-05

The agent's code runs on Daytona, but there is no retrieval structure over the customer's content. Volumes and mounted external storage hold files the agent's code reads, and there is no index to query. The language server in a sandbox serves code intelligence for the files there. Nothing in Daytona indexes, refreshes or sets permissions on the customer's sources.

Sourcedaytona.io/docs/llms.txtread 2026-09-22

No retrieval index or knowledge base over the customer's content is part of the platform. Volumes, S3 buckets mounted through FUSE and managed Postgres, MySQL, MongoDB or Redis hold data that an agent's code can read and write, and any vector store or retrieval layer is something the customer deploys on top of them.

Sourcenorthflank.com/product/sandboxesread 2026-11-05

Persistence is on by default at three layers. The filesystem survives stop, start and archive. On VM sandboxes, memory (running processes and loaded state) survives pause and resume and hot snapshots. Volumes and mounted external storage outlive any one sandbox. Sandboxes can also be forked, and the agent's code reads the restored state to carry on. Paused process state belongs to the machine, so the customer can resume or delete it but cannot review or edit it. There is no separate memory layer that sets what an agent keeps or for how long.

Sourcedaytona.io/docs/en/persistenceread 2026-09-22

State outlives a single run. A cloud harness keeps its home directory on a 5 to 100 GB volume through restarts and pauses, sandboxes keep attached volumes across pause and resume, and S3 buckets mounted through FUSE keep data after a sandbox is deleted. Northflank's stateful agent example gives each agent a managed Postgres database for memory and resumes its session against it. That memory is a database and volume the customer's own agent code writes and reads, with no memory layer of stated scope and lifetime managed by the platform.

Sourcenorthflank.com/product/sandboxesread 2026-11-05

Work in a sandbox has no approval step, consent checkpoint or escalation to a person. VNC, a web terminal and SSH let a person watch a sandbox and step in by hand. A firewall on each sandbox (allow lists or block all, with organization tiers that sandbox settings cannot override) restricts what an agent's code can reach. Nothing holds an agent's action for a person to review.

Sourcedaytona.io/docs/en/network-limitsread 2026-09-22

Release workflows can wait on people. An approval step holds a workflow until the required number of approvals is given from its run page, so an agent built change can be stopped before it reaches staging or production, and cloud harness pushes are confined to the harness's own branch. Nothing holds an agent's direct API, CLI or MCP actions for review, since those run with whatever the token's role permits.

Sourcenorthflank.com/docs/v1/application/release/configure-workflowsread 2026-11-05

Organizations sign in through OpenID Connect providers such as Google Workspace, Microsoft Entra ID and Okta, with provisioning and membership handled at sign in on the Enterprise plan. Collaborative organizations have owner and member roles plus granular assignments by resource, such as SSO Admin and access to the audit log.

API keys carry permissions and scopes, with managed child keys. An audit log covers user and system activity, and each sandbox has firewall allow lists or block all. Daytona says it meets HIPAA, SOC 2 and GDPR standards and has a Trust Center, but it names no report type or auditor.

Sourcedaytona.io/docs/en/ssoread 2026-09-22

Northflank holds SOC 2 Type II and ISO 27001 and supports HIPAA, with reports in its trust center. Fine grained roles grant create, read, update and delete permissions per resource type, can be limited to or excluded from projects, and drive API tokens, which inherit their role's permissions. Owner, admin and default roles come preset, organization roles span teams and can follow directory groups, and Enterprise adds SAML and OIDC single sign on with SCIM and just in time provisioning. Team policies limit which coding agents may run and can keep a harness private to its creator.

Sourcenorthflank.com/docs/v1/application/secure/use-role-based-access-controlread 2026-11-05

Each step an agent takes in the sandbox is recorded. SDK tracing instruments every Daytona API operation and SDK call from the customer's application, such as each command run, file written or process started. Sandbox telemetry collects traces, logs and metrics from inside the sandbox.

Both export over OpenTelemetry to the customer's own collector, and Daytona keeps sandbox telemetry for three days. A separate audit log records user and system activity with the user, action and time, and logs can be streamed. The model's reasoning runs outside Daytona. Audit export is not available yet, and Daytona says it is coming soon.

Sourcedaytona.io/docs/en/observability/otel-collectionread 2026-09-22

Every sandbox, job and harness streams logs and reports CPU, memory and network metrics through the dashboard and API, and workflow, job and template runs keep their run details.

On Enterprise, audit logs record every action from the UI, API and CLI, templates, release flows, Git events and the system, with the acting user, origin, affected resources, a before and after diff and the parent events that caused it, at organization, team, project and resource level, and forward to S3.

Log sinks, alerts and notifications to Slack, email, Teams or webhooks come on paid plans. An agent's prompts and tool calls inside its harness are not traced.

Sourcenorthflank.com/docs/v1/application/observe/audit-logsread 2026-11-05

Sandboxes run in two shared regions, the United States and Europe, chosen per sandbox. Under Bring Your Own Compute, an organization instead creates custom regions and attaches its own runner nodes, with an optional proxy and snapshot manager for each region, for control over data locality and compliance.

Daytona's control plane manages them, and BYOC is sold on the Enterprise plan. The platform sold today cannot be self hosted from open source. Core development has moved to a private codebase, and the public github.com/daytonaio/daytona repository gets no further updates. Its last release, v0.190.0, stays public under AGPL 3.0.

Sourcedaytona.io/docs/en/bring-your-own-computeread 2026-09-22

Projects run in one of more than 17 Northflank Cloud regions, chosen at creation and fixed afterwards, with GPU sandboxes in GPU enabled regions. BYOC runs the same sandboxes and harnesses in the customer's own AWS, Google Cloud, Azure, Oracle, Civo, CoreWeave or Nebius account, with Kata microVM support for harnesses, and Northflank also manages bare metal, OpenShift and VMware clusters. Enterprise can run the control plane itself inside the customer's infrastructure, air gapped if needed, so no platform data leaves the network.

Sourcenorthflank.com/docs/v1/application/sandboxes/sandboxes-on-northflank-cloudread 2026-11-05

Ready made starting points for running agents include default sandbox snapshots in several sizes, a Declarative Builder for images and an agent skill for coding agents. More than forty guides run coding agents (Claude Code, Codex, Devin, Gemini CLI, OpenClaw, OpenCode), as well as framework agents and reinforcement learning setups, in sandboxes, and a reference implementation runs Cursor's Cloud Agents on self hosted Daytona sandboxes. Developers build from these environments and walkthroughs. There is no browsable catalog of agents a customer can adopt.

Sourcedaytona.io/docs/en/agent-skillsread 2026-10-23

Cloud harnesses come preset for Claude Code, Codex, OpenCode, Pi and Cursor, or start empty for other tooling, and a Northflank skill and plugin teach coding agents the platform. Stack templates deploy common applications in one step, and templates and preview blueprints package infrastructure and releases for reuse. These are configured third party agents and building blocks a developer assembles, not prebuilt agents of Northflank's own.

Sourcenorthflank.com/product/cloud-agentsread 2026-11-05

The customer chooses the model. Guides run agents on Claude, OpenAI Codex and the Agents SDK, Gemini, Kimi and AWS Kiro, and on open models through OpenCode and other frameworks. GPU sandboxes serve the customer's own LLMs with vLLM or SGLang. Daytona imposes no model, and customers bring their own providers and keys, with guides on setting them up.

Sourcedaytona.io/docs/llms.txtread 2026-09-22

The customer chooses the agent and the model behind it. A harness runs Claude Code, Codex, OpenCode, Pi or Cursor signed in with the customer's own API key or account, or starts empty for other tooling, and team policies decide which of those agents a team may run. Models can also be self hosted on GPUs from L4 to B200 for inference beside the agents, and Northflank routes no model traffic of its own.

Sourcenorthflank.com/product/cloud-agentsread 2026-11-05

Outside callers reach Daytona through SDKs in five languages (Python, TypeScript, Ruby, Go and Java), a REST API with published OpenAPI specifications, and a CLI. The specifications cover the Daytona API, the Toolbox API inside the sandbox and an Analytics API. An MCP server lets Claude, Cursor and Windsurf manage sandboxes, and an agent skill serves coding agents.

Sourcedaytona.io/docs/llms.txtread 2026-09-22

Every resource is reachable from outside through a REST API, a CLI, and JavaScript and Python clients, with endpoints for sandboxes, harnesses, jobs, workflows, templates, secrets, volumes and audit logs, plus exec, file copy, log tailing and metrics. A hosted MCP server takes a team API token as a bearer header and lets Claude Code, Codex, Cursor or OpenCode deploy services, manage jobs and databases and inspect resources. Templates and GitOps define the same resources as code.

Sourcenorthflank.com/docs/v1/api/introductionread 2026-11-05

Evaluations and reinforcement learning run on Daytona, but it does not score them. Its guides run training with HUD, TRL, veRL and OpenEnv in sandboxes, along with a benchmark agent across several languages. The datasets, reward functions and scoring belong to those frameworks. Daytona offers no fixtures, scoring or quality gates for a customer's agent workflows, and no way to compare agent runs.

Sourcedaytona.io/docs/llms.txtread 2026-09-22

There is no scoring, test case or quality gate for an agent's behavior. Sandboxes run reinforcement learning rollouts and evaluations at more than 50,000 environments in parallel from one image with shared volumes, but the rewards and scores come from the customer's own code.

Sourcenorthflank.com/product/sandboxesread 2026-11-05

The Computer Use API gives an agent programmatic control of a desktop in the sandbox, from mouse and keyboard to screenshots, screen recording and display operations, on Linux and Windows. VNC lets a person watch or take over. The desktop runs remotely on Daytona's infrastructure. macOS sandboxes run on Mac hardware reserved for the customer through use.computer, with their own API key, and the Daytona SDKs, CLI and API do not manage them.

Sourcedaytona.io/docs/en/computer-useread 2026-10-23

Browser agents run on a browser image the customer picks, such as headless Chromium from browserless, with one sandbox per session that the agent drives over the private network through the DevTools protocol, behind egress rules set by domain. Northflank supplies the isolated compute and networking for it, not a browser or desktop of its own.

Sourcenorthflank.com/product/sandboxesread 2026-11-05