Cloudflare rebuilds Containers for on-demand agent sandboxes
Cloudflare announced a rearchitected Containers offering aimed at agent workloads that need isolation without keeping sandboxes deployed in advance. According to its blog, agents can create a sandbox on demand for each task, expect it to be ready immediately, and pause or resume execution as work shifts. The post frames programmable containers as the layer that meets those lifecycle requirements after a platform rethink. Related coverage in the same packet describes NVIDIA’s Open Agent Safety Platform, which pairs OpenShell with Sentry on BlueField-4 DPUs so safety enforcement sits outside the agent. Together they sketch two builder-facing threads: faster ephemeral sandboxes at the edge versus hardware-out-of-band quarantine. Treat both as vendor-positioned announcements; the Cloudflare excerpt cuts off mid-sentence and the MarkTechPost material is excerpt-only, so detailed SLAs, benchmarks, and independent validation are not established here.
Cloudflare rebuilds Containers for on-demand agent sandboxes
Cloudflare says Cloudflare Containers are now more programmable and tuned for agent workloads, with sandboxes created per task rather than pre-deployed. The post states agents can create sandboxes on demand, expect them ready immediately, and pause and resume them.
Key takeaway
Cloudflare is positioning on-demand, per-task container sandboxes with pause and resume as its agent execution model, not pre-deployed sandbox fleets.
What happened
Cloudflare states in a September 30, 2026 blog post that Cloudflare Containers are now more programmable and optimized for agent workloads, with sandboxes created per task rather than pre-deployed ahead of time.
The same attributed materials say agents can create sandboxes on demand, expect them ready immediately, and pause and resume them after Containers were rearchitected; related MarkTechPost coverage reports NVIDIA launched the Open Agent Safety Platform pairing OpenShell with Sentry on BlueField-4 DPUs.
Evidence
Cloudflare rearchitected Containers for on-demand agent sandboxes with pause and resume.
Cloudflare AI · attributed
Agents don't deploy sandboxes ahead of time. They create sandboxes on demand, for each task, expect them to be ready immediately, and be able to pause and resume.
Cloudflare describes Containers as more programmable and tuned for agent workloads.
Cloudflare AI · attributed
Cloudflare says Cloudflare Containers are now more programmable and tuned for agent workloads, with sandboxes created per task rather than pre-deployed.
NVIDIA launched the Open Agent Safety Platform with OpenShell and Sentry on BlueField-4 DPUs.
MarkTechPost · attributed
NVIDIA has launched the NVIDIA Open Agent Safety Platform , an open software platform and reference system design for AI agent security. It pairs the OpenShell secure runtime with NVIDIA Sentry, an out-of-band watchdog on BlueField-4 DPUs.
NVIDIA frames safety controls as living outside the agent being controlled.
MarkTechPost · attributed
The core idea is simple. Safety controls should not live inside the agent they are meant to control.
Why it matters
Teams shipping agents must compare ephemeral sandbox provisioning on Cloudflare with out-of-band enforcement designs like NVIDIA’s, while neither source in this packet documents independent proof of safety or startup latency at scale.
Limits and uncertainties
The Cloudflare blog excerpt in the packet ends mid-sentence after describing programmable container choices, so full API, pricing, and performance claims are incomplete.
MarkTechPost coverage is excerpt-only; the packet notes OpenShell is alpha in its repo and does not establish independent validation of Sentry quarantine in production.
Practical implications
If you run tool agents on Cloudflare, evaluate whether per-task sandbox create, immediate readiness, and pause or resume match your orchestration model instead of pre-warmed pools.
If you evaluate NVIDIA’s stack, treat Open Agent Safety Platform as a reference design with Apache 2.0 OpenShell on supported hosts until mature enforcement evidence is available.
What to watch
Cloudflare publishing complete Containers documentation on cold-start latency, limits, and pricing after the truncated announcement text.
NVIDIA or partners publishing validated Sentry quarantine benchmarks and moving OpenShell beyond alpha labeling.
