🌏 中文版
What This Post Is
This post is the "cloud deep dive" post (order 14) of the Sandbox Series, focusing on Azure Container Apps Sandboxes — Microsoft Azure's cloud-native sandbox service. As part of the Azure cloud ecosystem, it's a natural choice for Azure enterprise users, alongside AWS Bedrock AgentCore and Alibaba OpenSandbox.
This post covers:
- Azure Container Apps Sandboxes architecture — Control plane, execution plane, isolation technology
- Snapshot and State Management — Snapshots, state retention, pause/resume
- Lifecycle Policy — Lifecycle strategy, auto-destroy, idle handling
- Security Boundary — Network policy, identity authentication, credential management
- Trade-offs with other providers — E2B, Daytona, Modal, Bedrock AgentCore comparison
- Azure ecosystem integration advantages — Azure AI, AKS, Key Vault integration
Azure Container Apps Sandboxes Architecture
Azure Container Apps Sandboxes uses a cloud-native architecture built on the Azure Container Apps platform, using microVM isolation:
┌─────────────────────────────────────┐
│ Azure Control Plane │
│ - Container Apps environment config │
│ - Sandbox lifecycle policy │
│ - Snapshot and state management │
└─────────────────────────────────────┘
│
┌─────────────────────────────────────┐
│ Execution Plane │
│ - microVM isolation │
│ - Container execution environment │
│ - Network policy │
└─────────────────────────────────────┘Isolation Technology
Azure Container Apps Sandboxes uses microVM isolation, with each sandbox running in its own virtual machine, providing stronger isolation guarantees than containers. This is similar to AWS Bedrock AgentCore's Firecracker microVM, but integrated within the Azure Container Apps ecosystem.
Sandbox Lifecycle
Azure Container Apps Sandboxes supports full lifecycle management:
- Create: Create sandbox from container image
- Execute: Send commands via SDK or CLI
- Pause: Release compute resources, retain state
- Resume: Automatically resume on incoming network connection
- Snapshot: Create sandbox state checkpoint
- Create from snapshot: Create new sandbox from snapshot
- Auto-destroy: Automatically clean up idle sandboxes based on lifecycle policy
Snapshot and State Management
Azure Container Apps Sandboxes provides two state retention mechanisms:
Snapshot
Snapshot is a point-in-time copy of the sandbox state, used for:
- Creating new sandboxes (restore from snapshot)
- Backup and restore
- Cross-sandbox state sharing
Snapshot vs. Resume difference:
- Resume: Continues on existing sandbox, preserves memory and process state
- Snapshot: Creates new sandbox, starts from captured point-in-time state
State Management
Azure Container Apps Sandboxes supports persistent storage, files can survive restarts. However, memory state is only preserved during pause/resume; snapshots do not preserve memory state.
Lifecycle Policy
Azure Container Apps Sandboxes supports lifecycle policy as default safety net:
| Policy | Description | Applicable Scenario |
|---|---|---|
| Auto-pause | Sandbox auto-pauses after idle | Save compute costs |
| Auto-destroy | Sandbox auto-destroys after max lifetime | Prevent resource leaks |
| Idle timeout | Auto-pause on no network activity | Interactive agent workflows |
When to use:
- Use lifecycle policy for routine automatic cleanup
- Use snapshots for explicit checkpoints or reproducible startups
Security Boundary
Network Policy
Azure Container Apps Sandboxes supports network policy, controlling outbound and inbound traffic. By default, sandbox network access is restricted, requiring explicit allowlist configuration.
Identity Authentication
Integrated with Azure Active Directory (Entra ID), supporting authentication of sandbox access via Azure identity, avoiding long-term keys passed into sandbox.
Credential Management
Integrated with Azure Key Vault, credentials managed by Key Vault, sandbox accesses on demand, avoiding long-term keys landing in sandbox.
Trade-offs with Other Providers
| Provider | Isolation Tech | Cold Start | Pricing Model | Best For |
|---|---|---|---|---|
| Azure Container Apps Sandboxes | microVM | ~1–2 s | wall-clock | Azure ecosystem integration |
| AWS Bedrock AgentCore | Firecracker microVM | ~1–2 s | wall-clock | AWS ecosystem integration |
| Alibaba OpenSandbox | gVisor | ~200 ms | wall-clock | Alibaba Cloud ecosystem |
| E2B | Firecracker microVM | ~150 ms | wall-clock | Coding agent, long tasks |
| Modal | gVisor / microVM | sub-second | wall-clock (no idle) | GPU workloads, high concurrency |
Choose Azure Container Apps Sandboxes when:
- Deeply bound to Azure ecosystem
- Need integration with Azure AI, AKS, Key Vault
- Data must stay within Azure regions
Azure Ecosystem Integration Advantages
Integration with Azure AI
Azure Container Apps Sandboxes integrates seamlessly with Azure AI services (Azure OpenAI, Azure AI Search, etc.), allowing agents to securely call Azure AI APIs from within the sandbox.
Integration with AKS
For scenarios requiring Kubernetes orchestration, Azure Container Apps Sandboxes can integrate with Azure Kubernetes Service (AKS), supporting large-scale sandbox deployment.
Integration with Key Vault
Credentials and keys managed via Azure Key Vault, sandbox accesses on demand, avoiding long-term keys landing in sandbox environment.
What You Should Understand After Reading
- Azure Container Apps Sandboxes architecture and isolation technology (microVM).
- Snapshot vs. Resume difference, and State Management scope.
- Lifecycle Policy configuration and usage scenarios.
- Security boundary: network policy, Entra ID identity authentication, Key Vault credential management.
- Trade-offs with AWS Bedrock AgentCore, Alibaba OpenSandbox, E2B, Daytona, Modal.
- Azure ecosystem integration advantages: Azure AI, AKS, Key Vault.