Daytona

An agent in a Daytona sandbox reaches outside systems through what runs inside it: Git operations clone and push repositories, secrets hold credentials and external storage can be mounted, while firewall allow lists decide which hosts it may reach. Daytona has no catalog of connectors, OAuth actions or tool gateway of its own; the tools are the customer's code.

Sourcedaytona.io/docs/llms.txtread 2026-09-22

Daytona manages sandboxes: it creates and resizes them, applies lifecycle rules and runs warm pools and fleet scaling, but it does not sequence, branch, retry or route an agent's steps. Its guides show agents built in LangGraph, the OpenAI Agents SDK and other frameworks doing that, and no workflow logic mixing fixed steps with agent steps is a Daytona mechanism.

Sourcedaytona.io/docs/en/sandboxesread 2026-09-22

Daytona runs the agent's code but keeps no retrieval structure over the customer's content. Volumes and mounted external storage are storage the agent's code reads, not an index a query returns, and the language server in a sandbox serves code intelligence for the files there rather than company knowledge. Nothing Daytona provides indexes, refreshes or permissions the customer's sources.

Sourcedaytona.io/docs/llms.txtread 2026-09-22

No approval step, consent checkpoint or escalation to a person is documented for work in a sandbox. VNC, a web terminal and SSH let a person watch a sandbox and step in by hand, and a firewall on each sandbox (allow lists or block all, with organization tiers that sandbox settings cannot override) restricts what an agent's code can reach. The first is access and the second is isolation; neither holds an agent's action for review.

Sourcedaytona.io/docs/en/network-limitsread 2026-09-22

Identity and access controls are named. Organizations sign in through OpenID Connect providers such as Google Workspace, Microsoft Entra ID and Okta, with provisioning and membership handled at sign in (Enterprise).

Collaborative organizations have owner and member roles plus granular assignments by resource, such as SSO Admin and access to the audit log, and API keys carry permissions and scopes, with managed child keys. An audit log covers user and system activity, and each sandbox has firewall allow lists or block all. The homepage says Daytona meets HIPAA, SOC 2 and GDPR standards and links a Trust Center, but no report type or auditor is given.

Sourcedaytona.io/docs/en/ssoread 2026-09-22

What the agent did in the sandbox is recorded step by step. SDK tracing instruments every Daytona API operation and SDK call from the customer's application, such as each command run, file written or process started, and sandbox telemetry collects traces, logs and metrics from inside the sandbox.

Both export over OpenTelemetry to the customer's own collector, and Daytona keeps sandbox telemetry for three days. A separate audit log records user and system activity with the user, action and time, and logs can be streamed. The model's reasoning runs outside Daytona, and audit export is marked coming soon.

Sourcedaytona.io/docs/en/observability/otel-collectionread 2026-09-22

Persistence is on by default at three layers. The filesystem survives stop, start and archive; memory, meaning running processes and loaded state, survives pause and resume and hot snapshots on VM sandboxes; and volumes and mounted external storage outlive any one sandbox. Sandboxes can also be forked, and the agent's code reads the restored state to carry on. Volumes are storage the code reads, though, and paused process state belongs to the machine: the buyer can resume or delete it but not review or edit it as memory, and no memory layer with a stated scope and lifetime is documented.

Sourcedaytona.io/docs/en/persistenceread 2026-09-22

Sandboxes run in two shared regions, the United States and Europe, chosen per sandbox, or under Bring Your Own Compute, where an organization creates custom regions and attaches its own runner nodes, with an optional proxy and snapshot manager for each region, for control over data locality and compliance.

Daytona's control plane manages them, and BYOC is sold on the Enterprise plan. The platform sold today is not open source to self host: the public github.com/daytonaio/daytona repository says core development moved to a private codebase in June 2026 and it receives no further updates, with its last release, v0.190.0, left public under AGPL 3.0.

Sourcedaytona.io/docs/en/bring-your-own-computeread 2026-09-22

Ready made starting points for running agents include default sandbox snapshots in several sizes, a Declarative Builder for images and an agent skill for coding agents. More than forty guides run coding agents (Claude Code, Codex, Devin, Gemini CLI, OpenClaw, OpenCode), as well as framework agents and reinforcement learning setups, in sandboxes. These are environments and walkthroughs a developer builds from, not a browsable catalog of agents a buyer adopts.

Sourcedaytona.io/docs/en/agent-skillsread 2026-09-22

Events go outward: webhooks notify the customer's endpoint when sandboxes are created or change state and when snapshots and volumes change, and automated lifecycle rules stop, pause, archive or delete idle sandboxes. Nothing starts an agent's work without the customer's code, though: there is no schedule, and a stopped sandbox does not wake on an inbound request.

Sourcedaytona.io/docs/en/webhooksread 2026-09-22

The customer chooses the model. Daytona's guides run agents on Claude, OpenAI Codex and the Agents SDK, Gemini, Kimi and AWS Kiro, and on open models through OpenCode and other frameworks, and GPU sandboxes serve the customer's own LLMs with vLLM or SGLang. Daytona imposes no model, and buyers bring their own providers and keys with documented guidance.

Sourcedaytona.io/docs/llms.txtread 2026-09-22

Outside callers reach Daytona through SDKs in five languages (Python, TypeScript, Ruby, Go and Java), a REST API with published OpenAPI specifications, and a CLI. The specifications cover the Daytona API, the Toolbox API inside the sandbox and an Analytics API, an MCP server lets Claude, Cursor and Windsurf manage sandboxes, and an agent skill serves coding agents.

Sourcedaytona.io/docs/llms.txtread 2026-09-22

Evaluations and reinforcement learning run on Daytona, but it does not score them: its guides run training with HUD, TRL, veRL and OpenEnv, and a benchmark agent across several languages, in sandboxes, and the datasets, reward functions and scoring belong to those frameworks. Daytona offers no fixtures, scoring or quality gates for a customer's agent workflows, and no comparison of agent runs.

Sourcedaytona.io/docs/llms.txtread 2026-09-22

The Computer Use API gives an agent programmatic control of a desktop in the sandbox, from mouse and keyboard to screenshots, screen recording and display operations, on Linux and Windows, with VNC so a person can watch or take over. That is control of a real interface, run remotely on Daytona's infrastructure. macOS sandboxes are offered separately at use.computer, a different site with its own API.

Sourcedaytona.io/docs/en/computer-useread 2026-09-22