E2B vs Unikraft (2026)

An agent in a sandbox reaches other systems through a built in MCP gateway that runs inside the sandbox and exposes more than 200 tools from the Docker MCP Catalog (Airtable, GitHub, Browserbase, Exa and others) or custom MCP servers through one interface. Credentials are passed as secrets that resolve at egress instead of living in the sandbox.

Sourcedocs.e2b.dev/mcp-gatewayread 2026-09-22

Agents' tools run on Unikraft instead of coming from it. MCP servers run as microVMs that wake when an agent calls them, alongside webhook receivers and API gateways, and workloads connect to hyperscaler services such as S3. One customer keeps its credentials outside the VM. Unikraft names no connector catalog, OAuth actions or credential brokering of its own, so the read and write integrations are the customer's code.

Sourceunikraft.com/docs/use-cases/mcp-serversread 2026-09-22

There is no workflow logic in E2B itself. The customer brings its own orchestration framework, and E2B provides the machine an agent's steps run on (commands, background processes, code contexts), not a runtime that sequences, branches, retries or routes those steps. Forking a sandbox copies its state, which is compute, not workflow logic.

Sourcee2b.dev/llms.txtread 2026-09-22

The platform schedules and scales microVMs, with autoscale, load balancing and forking a live VM for parallel sub agents. It does not sequence, branch, retry or route an agent's steps, and that logic lives in the customer's code. Unikraft offers no workflow logic that mixes deterministic nodes with agent steps. Scheduling across metros decides where compute runs, not how a workflow proceeds.

Sourceunikraft.com/llms-full.txtread 2026-09-22

A sandbox can start without the customer's code calling it. With auto resume set, a paused sandbox resumes when activity arrives, so an agent served from a sandbox starts on an inbound request, and E2B's guides deploy agent gateways this way, for example OpenClaw answering Telegram. Sandbox lifecycle events are also pushed to the customer's webhook, signed. There is no scheduler.

Sourcedocs.e2b.dev/sandbox/auto-resumeread 2026-09-22

Incoming connections wake work without the customer's code starting it. An instance scaled to zero consumes nothing until the next connection arrives. The platform then boots or resumes it in milliseconds and answers, so an MCP server wakes when an agent calls it and a webhook receiver wakes on the incoming event. A tutorial walks through scale to zero triggers. Unikraft names no scheduler.

Sourceunikraft.com/docs/features/scale-to-zeroread 2026-09-22

There is no retrieval structure over the customer's content, since E2B runs the agent's code. Files uploaded to a sandbox or volume are storage the agent's code can read, not an index a query returns, and the MCP gateway's tools reach outside knowledge sources owned by others.

Sourcee2b.dev/llms.txtread 2026-09-22

The platform runs the customer's workloads, including databases and MCP servers, but keeps no retrieval structure over the customer's content for an agent to query. Volumes and databases hosted on it are the customer's own storage. There are no sources that Unikraft indexes, refreshes or permissions.

Sourceunikraft.com/llms-full.txtread 2026-09-22

An agent's working state carries across sessions. A paused sandbox resumes exactly as it was, with filesystem and memory, running processes and loaded variables, and is kept until it is killed. Snapshots and forks copy that state, volumes keep files across sandboxes, and code contexts keep interpreter variables between executions, which the agent's code reads to continue its task. This is machine state the developer manages, with no memory layer of stated types or scope that can be reviewed, edited or deleted as memory.

Sourcedocs.e2b.dev/sandbox/persistenceread 2026-09-22

A workload's state carries across sessions. Instances snapshot and resume in milliseconds with their state intact, a live VM and its children fork in about ten milliseconds, managed volumes persist data, and paid plans add snapshot history and rollback. The agent's code reads that restored state to carry on.

Volumes are storage the code reads, and restored process state belongs to the machine. The customer can resume, roll back or delete that state but cannot review or edit what it holds. Unikraft offers no separate memory layer for agents. A browser session ROM keeps its own cookies and profile, much like a saved login.

Sourceunikraft.com/docs/features/snapshotsread 2026-09-22

There is no approval step, consent checkpoint or escalation to a person for work inside an E2B sandbox. Egress control (allow and deny lists for each sandbox, a proxy the customer runs that fails closed, and access tokens on public URLs) limits what an agent's code can reach, but that is isolation the developer configures, not a point where a person reviews the agent's action.

Sourcee2b.dev/enterpriseread 2026-09-22

Unikraft names no approval step, consent checkpoint or escalation to a person for the work it runs, and no place to insert one. The network shield and relay, an Enterprise feature, routes an instance's traffic through a relay VM, and delete locks stop instances being removed. The developer configures both for isolation and protection, and neither has a person review an agent's action.

Sourceunikraft.com/docs/features/network-shieldread 2026-09-22

SOC 2 Type II compliance is stated, with the report under NDA and a current bridge letter in the Trust Center at trust.e2b.dev, a penetration test report and DPA on request, and HIPAA Business Associate Agreements on Enterprise plans. Controls for customers sit beside it.

Every sandbox is its own Firecracker microVM with its own kernel, egress can be allowed or denied for each sandbox by IP, CIDR or domain, secrets resolve at egress so no response, log or sandbox holds them, and public sandbox URLs can require an access token for each sandbox. There is no SSO for the console, and workload identity is in private beta.

Sourcee2b.dev/securityread 2026-09-22

The company holds SOC 2 Type II against the Security criteria and is HIPAA compliant, with BAAs available. An independent penetration test by DEFION Security found no exploitable cross VM, hypervisor, filesystem or host agent issues. Alongside these, every workload is its own Firecracker based microVM with per tenant filesystem boundaries, delete locks protect instances from removal, and on Enterprise a network shield and relay route an instance's traffic through a relay VM.

Unikraft names no SSO, roles or identity provider support.

Sourceunikraft.com/llms-full.txtread 2026-09-22

The record covers the sandbox, not the agent. Every lifecycle event is available through an events API and delivered as a signed webhook, sandbox metrics report CPU and memory use, template builds keep logs, and on Enterprise OpenTelemetry metrics and logs export to the customer's OTLP endpoint. Prompts, tool calls, retrieved knowledge and outputs cannot be inspected step by step in E2B, since the agent's reasoning runs outside the sandbox, and there is no audit log of user actions apart from the runtime.

Sourcee2b.dev/enterpriseread 2026-09-22

Logs and metrics follow the instance, not the agent. Every user gets full stdout and stderr logs, paying customers get Prometheus metrics, and a metrics API reports CPU time, memory, network I/O, connection counts and scale to zero wake latency per instance. The metrics export to monitoring systems. Inspecting prompts, tool calls, retrieved knowledge and outputs step by step is left to the customer's own code. Unikraft names no audit log separate from the runtime logs and no retention by plan.

Sourceunikraft.com/docs/platform/metricsread 2026-09-22

Three deployment modes share the same SDK, CLI and API. E2B Cloud runs on Google Cloud in US, EU and APAC regions, with the regions available varying by plan. With BYOC on AWS or Google Cloud, the data plane runs in the customer's VPC, and sandbox traffic, template sources, snapshots and logs never reach E2B Cloud. Self hosting is possible because the runtime, control plane and Firecracker layer are Apache-2.0, with Terraform deployment. Azure is not yet supported.

Sourcee2b.dev/enterpriseread 2026-09-22

Customers choose the named metros where Unikraft Cloud runs. Dallas, Frankfurt, San Francisco, Singapore and Washington DC are the defaults, and the list is set per account. Deployment can be hosted, dedicated hosted, on premises or BYOC, on bare metal or on AWS EC2, GCP Compute Engine or Azure VMs. A Kubernetes integration adds Unikraft Cloud as a node in EKS, GKE, AKS or the customer's own cluster.

Sourceunikraft.com/docs/platform/metrosread 2026-09-22

Starting points ship with the platform, including sandbox templates for Claude Code, a desktop, Docker and web app stacks, a cookbook of examples ready to run, setup guides for more than thirty agents and frameworks, and open source reference apps, Surf, a computer use agent, and Fragments, a builder that turns a prompt into an app. These are environments and examples a developer builds from, not a browsable catalog of agents a customer adopts.

Sourcedocs.e2b.dev/llms.txtread 2026-09-22

Templates here are snapshots of the customer's own warmed up workload that new instances boot from, not ready made starting points from Unikraft. Unikraft covers patterns for sandboxes, headless browsers, MCP servers and remote desktops, but ships no working agents, production ready templates or role specific agents for a customer to adopt.

Sourceunikraft.com/docs/features/on-demand-templatesread 2026-09-22

Compute is what E2B provides for agents, with the customer bringing its own model and orchestration framework. Sandboxes connect to any LLM and to agents and frameworks such as Claude Code, Codex, the OpenAI Agents SDK, the Vercel AI SDK, LangChain, CrewAI, Mastra and Google ADK. E2B imposes no model, so model choice stays with the customer.

Sourcee2b.dev/llms.txtread 2026-09-22

Any Dockerfile workload runs here, and nothing in the platform is specific to language models. There is no model selection, routing, provider keys or guidance for connecting the customer's own models. GPUs appear only for rendering in headful browsers. The platform imposes no model of its own either.

Sourceunikraft.com/llms-full.txtread 2026-09-22

Outside systems can call E2B through Python and JavaScript/TypeScript SDKs, a CLI, a REST API described by a published OpenAPI 3.1 specification, and custom sandbox templates the customer builds, tags and versions. A public MCP server serves E2B's documentation to agents.

Sourcee2b.dev/llms.txtread 2026-09-22

From outside, a platform REST API drives Unikraft Cloud, covering instances, templates, volumes, services and metrics. The unikraft CLI adds a raw API passthrough, and a Kraftfile specification and Kubernetes and Karpenter integrations round it out. Unikraft names no SDK or MCP server of its own. Some newer features, such as plugins and the network shield, are available only through the API for now.

Sourceunikraft.com/docs/llms.txtread 2026-09-22

There are no fixtures, scoring, quality gates or comparison of agent runs. E2B is where evaluations and reinforcement learning run, not how they are scored. It lists reinforcement learning among its workloads and runs NVIDIA NeMo Gym environments in sandboxes, but the datasets, reward functions and scoring belong to the customer's framework.

Sourcee2b.dev/llms.txtread 2026-09-22

Tests get somewhere to run, but Unikraft does not test agents. Forking and the build and test environments pattern give the customer disposable, parallel VMs. The platform has no fixtures, scoring, quality gates or comparison of agent runs.

Sourceunikraft.com/docs/llms.txtread 2026-09-22

Agents control real desktops hosted by E2B. E2B Desktop sandboxes are Ubuntu machines with an XFCE desktop and preinstalled applications, and the Desktop SDK gives the agent screenshots, mouse, keyboard and scroll, with a live VNC stream so a person can watch. A cloud browser can also run in a sandbox, and Surf is E2B's open source computer use agent built on it.

Sourcedocs.e2b.dev/use-cases/computer-useread 2026-09-22

Browser and desktop agents get their machines here. Every browser session can run in its own disposable headless or headful microVM with GPU rendering, booted from a snapshotted template, and whole desktop sessions snapshot after login and resume on connect. Browser agent companies run on it. The platform works with any browser, so the customer brings the browser and drives it with its own tooling. Unikraft offers no API of its own for screenshots, clicks or typing. It supplies the environment for operating web interfaces and desktops, and the customer supplies the control.

Sourceunikraft.com/docs/use-cases/headless-browsersread 2026-09-22