LangChain Sandbox for Deep Agents: Setup and Real Costs

Do not index

A LangChain sandbox is the isolated machine where a LangChain Deep Agent runs its shell commands and file edits. You pass it to create_deep_agent as the backend. Your application keeps the agent loop and the model calls, and every execute, write_file, and grep the agent makes runs on that remote machine, away from your laptop and servers.

With langchain-agent37, that machine is an Agent37 sandbox: 2 vCPU and 4 GB of RAM for $0.0065 an hour. E2B and Daytona list the same size at $0.166. This guide covers which "LangChain sandbox" you need, what each provider costs, a tested setup, and five problems to avoid.

We ran every example below on October 26, 2026. A GPT-5.5 Deep Agent wrote a Python file in a fresh sandbox, ran it, and returned the right output in 7.4 seconds.

Which LangChain sandbox do you need?

Three different things share the name:

ㅤ	What it is	Status
`langchain-sandbox`	A package that ran untrusted Python in Pyodide and Deno	Archived on GitHub
Deep Agents sandbox backends	A remote Linux machine with a shell and a filesystem, plugged into `create_deep_agent`	Current, with 20 providers in LangChain's docs
LangSmith Sandboxes	LangChain's own managed sandboxes, one of those backends	Current

If you searched for the old package, start with a Deep Agents backend. Pyodide could only run Python inside WebAssembly. A backend gives the agent a full Linux shell, so it can install packages, run tests, and use any language or CLI it needs. The rest of this guide covers backends.

You may not need a sandbox at all. If your agent only reads and writes files, Deep Agents' State and Filesystem backends handle that without one. Add a sandbox when the agent has to run code, install packages, or execute tests.

How a Deep Agents sandbox works

In Deep Agents, a sandbox is a backend. Pass one to create_deep_agent, and the agent gets an execute tool for shell commands plus its usual file tools: ls, read_file, write_file, edit_file, glob, and grep. Each tool call travels from your application to the sandbox and comes back with the output.

A provider only has to implement one method, execute(). Deep Agents' BaseSandbox builds every file tool on top of it by running small scripts inside the sandbox. Your application also gets a direct path for files: upload_files() to seed a project before the agent starts, and download_files() to collect what it built.

LangChain calls this the sandbox-as-tool pattern. Its biggest benefit is security: your model key and other credentials stay in your application, and the sandbox only sees the commands the agent sends.

The alternative is to run the whole agent inside the sandbox and talk to it over the network. LangChain lists the costs of that pattern: your API keys have to live inside the sandbox, every agent change means rebuilding an image, and you need your own HTTP or WebSocket layer to reach it. Unless you have a reason to run the agent remotely, keep it in your application and send only the tool calls.

What a LangChain sandbox costs

Every provider on LangChain's list bills for the time a sandbox runs. Here is the list price for 2 vCPU and 4 GB of RAM, and what 1,000 agent sessions of ten minutes each would cost:

Provider	Per hour	1,000 ten-minute sessions
Agent37	$0.0065	$1.09
E2B	$0.166	$27.60
Daytona	$0.166	$27.60
Modal	$0.238	$39.66
Runloop	$0.317	$52.80
Vercel Sandbox	$0.341	$56.80

Rates come from each provider's pricing page, checked October 26, 2026. Agent37's figure includes 4 GB of disk. The others are compute only, before plan fees and free allowances. E2B needs its $150 a month Pro plan to choose a sandbox's CPU and RAM. Vercel bills active CPU, so an agent that waits on its model costs less there than the table shows.

Two caveats. Standard Agent37 compute shares host resources, which suits agents that spend most of their time waiting on a model. If your agent needs Docker or its own kernel, a full VM costs $0.0156 an hour at the same size. And these are list prices, so measure your own workload before you choose on price alone. Model calls bill separately on every provider. Our sandbox price comparison covers more providers and sizes.

Set up a LangChain sandbox on Agent37

You need Python 3.11 or newer, an Agent37 API key, and a model key. This example uses OpenAI:

pip install langchain-agent37 langchain-openai
export AGENT37_API_KEY=sk_live_...
export OPENAI_API_KEY=...

The package installs Deep Agents with it.

Run a Deep Agent in a sandbox

from deepagents import create_deep_agent
from langchain_agent37 import Agent37Sandbox

with Agent37Sandbox() as sandbox:
    agent = create_deep_agent(model="openai:gpt-5.5", backend=sandbox)
    result = agent.invoke({
        "messages": [{
            "role": "user",
            "content": "Write /workspace/primes.py that prints the first 10 prime numbers, run it, and tell me its exact output.",
        }]
    })
    print(result["messages"][-1].content)

The context manager creates a sandbox and deletes it when the block exits, even if your code raises an exception. In our run, the agent called write_file, then execute, and answered with 2 3 5 7 11 13 17 19 23 29. Across five creates, a new sandbox was ready in 0.56 to 1.03 seconds, and a command took a median of 0.31 seconds round trip from our laptop.

Commands run as root in /workspace. The default sandbox comes with Python, Node.js, git, and common build tools, so the agent can install packages and run tests the way it would on a developer's machine.

Keep one sandbox per conversation

LangChain's docs default to one sandbox per conversation thread, reused on every follow-up turn. Store the instance id with the thread, and attach to it on the next turn:

sandbox = Agent37Sandbox(create_options={"auto_sleep": True, "idle_timeout_seconds": 900})
sandboxes[thread_id] = sandbox.id
sandbox.close()  # closes the connection, keeps the sandbox and its files

with Agent37Sandbox(instance_id=sandboxes[thread_id]) as sandbox:
    agent = create_deep_agent(model="openai:gpt-5.5", backend=sandbox)

With auto-sleep on, a sandbox sleeps after 15 idle minutes and wakes on the agent's next command. While it sleeps, it bills disk alone: $0.36 a month for 4 GB. In our test, a file the agent wrote was still there after we closed the connection and attached again by id. Call sandbox.destroy() when the thread ends.

Block the network

A sandbox protects your machine from the agent. It can't stop an agent that read a malicious instruction from sending data out over the internet. If your agent doesn't need the internet, turn it off:

with Agent37Sandbox(create_options={"network": "deny-all"}) as sandbox:
    agent = create_deep_agent(model="openai:gpt-5.5", backend=sandbox)

In our test, curl and pip inside that sandbox both failed to reach the internet, while commands and file writes through the backend kept working. To allow specific services, pass {"allow": [...]} with up to 100 IPv4 addresses or ranges. The network docs cover the details.

Use it from Deep Agents Code

Deep Agents Code, LangChain's terminal coding agent, can run its tools in an Agent37 sandbox too. It needs Python 3.14:

uv tool install --python 3.14 --with langchain-agent37 deepagents-code
export AGENT37_API_KEY=sk_live_...
dcode --sandbox agent37

Add --sandbox-id <instance-id> to reconnect to a sandbox you already have.

Five problems to avoid

Each command gets a fresh shell. Files persist between commands, but cd and exported variables don't carry over. Chain steps in one command, such as cd app && npm test, or set workdir on the sandbox.

Set a timeout for long jobs. A command stops after 120 seconds by default and returns exit code 124. Raise it per call, up to 840 seconds: sandbox.execute("pytest", timeout=600). The package never retries a command, so after a network error, check whether it's still running before you send it again.

Keep secrets out of the sandbox. LangChain's own guidance: an agent that reads a malicious instruction can read anything inside its sandbox. Keep authenticated calls in tools that run in your application, and only put values in the sandbox's env that you could afford to leak.

Delete what you create. The context manager deletes a sandbox it created. A sandbox you attached to stays put when the block exits, and close() never deletes anything. Call destroy() when you're done.

Custom images need three things. The file tools run as small scripts, so a custom template needs Python 3, a POSIX shell, and GNU coreutils. The default agent37-base template has all three.

FAQ

Is langchain-sandbox still maintained?

No. LangChain archived the langchain-sandbox repository, which ran Python in Pyodide. New projects should use a Deep Agents sandbox backend, which gives the agent a full Linux shell.

Does the agent run inside the sandbox?

No. The agent loop and the model calls stay in your application, and only tool calls run in the sandbox. Your model key never enters it.

Can the agent use Docker?

Yes, on a full VM. Pass template="agent37-ubuntu" and create_options={"type": "vm"}. In our test, docker run hello-world worked inside the VM a few seconds after it was created, once the Docker daemon had started. A standard sandbox can't run Docker.

How long can a sandbox run?

As long as you keep it. Agent37 has no session limit: a sandbox runs until you stop or delete it, and bills by the minute while it runs.

Does it work with async agents?

Yes. Use await agent.ainvoke(...). The async command and file methods come from Deep Agents and run in worker threads.

Which models work?

Any model Deep Agents supports. The sandbox never calls a model, so model usage bills through your model provider.

Give your Deep Agent a sandbox

Install the package, pass the sandbox to create_deep_agent, and your agent's commands run on a machine that costs $0.0065 an hour. The setup guide and the package README cover every option.

Create your API key. New Cloud accounts get $5 of starter credit after adding a card, enough for more than 700 hours of a 2 vCPU sandbox. Building on the Claude Agent SDK instead? Read our Claude Agent SDK sandbox guide.

LangChain Sandbox: How to Run Deep Agents Code in a Cloud Sandbox