May 14, 2026 · 1h 5m · mad
The Agent Harness: Building Secure Sandboxes for Autonomous AI Workloads
0:00 / 0:00
▶ Watch on YouTube →
gold bands on the timeline = statements, start to end. Hover to read, click to jump. CC turns on captions
In this episode of The MAD Podcast, host Matt Turck interviews Ivan Burazin, CEO of Daytona, about why autonomous AI agents require dedicated, secure cloud computer sandboxes. The conversation covers the architectural and security fundamentals of agent sandboxing, technical infrastructure deep dives, the evolving AI agent stack, and strategic insights for developer tool founders.
How this conversation actually went
Every chapter scored 0–10 on four independent dynamics. Hover any point for the reasoning behind the score. Matt holds 12.9% of the talking time here. How this is scored →
Matt as informed peer 3.4 Guest teaching 4.7 Guest disagreement 1.2 Matt pushing back 0.9
speaking balance: gold is Matt, purple is the guest (3 minute bins)
Sharpest disagreement ▶ 3:36 Rejecting local bank access execution thesis
Ivan forcefully rejects running agents directly on local host hardware due to severe security risks like raw bank credentials, explaining how it broke his thesis for local agent execution.
Hardest push from Matt ▶ 18:46 Pushing back on Markdown files for agent memoryMatt explicitly challenges the premise that simple Markdown files are sufficient for long-term agent memory compared to the robustness offered by structured databases.
Biggest teaching moment ▶ 52:00 Explaining why Kubernetes fails for sandboxesIvan educates Matt on why off-the-shelf schedulers like Kubernetes fail for stateful, low-latency sandboxes, requiring a custom bare-metal scheduler.
Matt holds his own ▶ 1:01:05 Citing Dylan Patel on impending CPU shortageMatt demonstrates sharp industry knowledge by citing Dylan Patel's research on CPU bottlenecks before Ivan expands on the technical details.
the scores for every segment, with the reasoning behind each
| Chapter | Topic | Matt as informed peer | Guest teaching | Guest disagreement | Matt pushing back | Why |
|---|---|---|---|---|---|---|
| Episode Agenda: The Agent Stack and GTM Strategy | 3 | 4 | 1 | 1 | Matt introduces the episode and uses analogies like OpenClaw on a Mac Mini to ground the sandbox concept. Ivan clarifies how sandboxes differ from physical hardware, citing security risks like bank credential leaks during agent execution. | |
| Stateful vs. Stateless Architecture and Sandbox History | 3 | 5 | 2 | 1 | Matt prompts Ivan to explain stateful vs stateless architectures and the origin of sandboxes. Ivan provides historical context on Code Sandbox and microVMs, explaining why developer localhost mindsets are changing due to AI. | |
| Concurrency and Limitations of Local Execution | 3 | 5 | 2 | 1 | Matt asks if all agents need sandboxes or only specific subcategories. Ivan argues that any agent performing knowledge work requires a sandbox computer, contrasting simple chat interfaces with action-oriented tool calls. | |
| Deconstructing the Emerging AI Agent Stack | 4 | 5 | 1 | 2 | Matt brings up specific memory storage approaches like Markdown files versus structured databases. Ivan breaks down the overall agent stack and points out that current LLMs do not genuinely learn from previous tasks. | |
| Agent Harnesses, Managed Services, and OpenAI | 4 | 4 | 1 | 1 | Matt cites recent industry developments including OpenAI Agent SDK and Anthropic Managed Agents. Ivan delineates fully managed agent stacks from modular SDK and sandbox infrastructure integrations. | |
| Founder Journey: Lessons from CodeAnywhere to Daytona | 4 | 3 | 1 | 1 | Matt asks Ivan about lessons learned from his prior company CodeAnywhere and references his tweets on developer tools. Ivan shares insights on distinguishing individual free users from paying enterprise accounts. | |
| Event Marketing and Distribution for Technical Founders | 3 | 3 | 0 | 0 | Matt commends Ivan on developer marketing and distribution capabilities. Ivan recounts how stepping in as a conference host helped him overcome stage fright and master event mechanics. | |
| Three Levers of Product Adoption and Brand Perception | 3 | 4 | 1 | 1 | Matt comments on Daytona's recent Chase Center conference. Ivan outlines the three primary drivers of product adoption borrowed from Sentry: awareness, preference, and deterministic requirements. | |
| Organic Twitter Growth and Navigating Hype Cycles | 3 | 3 | 2 | 1 | Matt brings up Ivan's viral Twitter post regarding working through holidays. Ivan defends his view on capitalising on AI super-cycles and explains how online visibility translates into customer acquisition. | |
| Customer Support as a Growth Advantage | 2 | 4 | 0 | 0 | Matt asks about other components of Daytona's GTM strategy. Ivan explains how his background as a sysadmin shaped Daytona's rapid support SLA framework to remove user anxiety. | |
| Sandbox Architecture: Speed, Density, and Economics | 3 | 6 | 1 | 1 | Matt pivots to technical architecture, asking why startup speed and concurrency matter. Ivan explains the economic trade-offs between idle CPU sandboxes and expensive GPU utilization in RL training runs. | |
| Comparing MicroVMs, Containers, and Runtimes | 4 | 6 | 2 | 1 | Matt asks about technical distinctions across microVMs, containers, and runtimes, mentioning Firecracker specifically. Ivan explains where Firecracker excels and where alternative hypervisors like QEMU are needed for Android or GPU workloads. | |
| Snapshotting, Pausing, and Compute Cost Optimization | 4 | 6 | 2 | 1 | Matt asks why snapshotting matters and why Daytona wrote its own scheduler. Ivan explains compute cost optimization through pausing idle sandboxes and why standard orchestrators like Kubernetes fail for fast stateful sandboxes. | |
| Technical Differences Between Ephemeral and Long-Running Sandboxes | 3 | 6 | 1 | 1 | Matt asks how long-running 24-hour agent tasks alter technical requirements compared to ephemeral ones. Ivan explains live migration complexities and server maintenance without terminating active workloads. | |
| The Hidden Complexity of Building Custom Sandboxes and Storage Performance | 3 | 6 | 1 | 1 | Matt observes that building a custom sandbox in-house is far harder than team founders anticipate. Ivan compares local disk IOPS against network-attached storage performance bottlenecks. | |
| The Impending CPU Shortage for AI Workloads | 5 | 5 | 1 | 1 | Matt cites Dylan Patel and SemiAnalysis regarding an upcoming transition from GPU to CPU shortages. Ivan agrees, detailing how RL and agent scale drive massive CPU demand before Matt wraps up the episode. |
Statements from this episode (22)
Burazin: AI agents are digital knowledge workers needing dedicated computers
“Well, when I think about agents, I think of them as digital knowledge workers and to do anything as a knowledge worker, you do need a computer or I should say anything sophisticated. So you and I can be in a conversation. We can get something done. But we usua…”
Burazin: Running local AI agents on personal PCs poses severe security risks
“The way people usually run these things and cloud code or open claw is usually on their own computer because it helps them, you know, organize emails, you know, search whatever documents they have and whatnot. There there's a one, there's a high security risk …”
Burazin: AI agents make local host development obsolete
“Now that agents are here, local hosts no longer actually, one, you don't want that for a number of reasons.”
Burazin: Personal laptops cannot handle high AI agent concurrency due to compute limits
“The other thing is you can't do concurrency. So you can do multiple to the amount of compute that you have in your laptop, which will be quite limited. And so you might want to spin up 10 or 20 or 50 or a hundred or a 100,000, whatever that number might be. An…”
Burazin: Every AI agent will require at least one sandbox
“My argument is that every agent will need at least one sandbox, sometimes more”
Burazin: All software tools will eventually become headless
“I firmly believe that in due time, all the tools will be headless.”
Burazin: Most knowledge work remains locked in legacy Windows apps
“Most of knowledge work is still locked into legacy apps inside of windows for the vast majority, like the absolute vast majority.”
Burazin: Current AI models do not learn from on-the-job execution
“Models actually don't learn right now. So you use a model and if you solve memory, it has memory of things. So it has context of these things. And so it can, oh, here's the context, and so it can have a better answer because it has the context, but it doesn't …”
Burazin: Anthropic Managed Agents bundles model, harness, and sandbox together
“The Anthropic Managed Agents, it is a managed service where you essentially have the model, the harness, and the sandbox all wrapped into one, basically.”
Burazin: Individual developers will not pay for single-developer tools
“The code anywhere product had no enterprise use case value. It was all single developer value and single developers do not want to pay for these things.”
Burazin: Tech conferences are entertainment first and foremost
“A conference is it's entertainment first and foremost.”
Burazin: Customers outraged by controversial social posts will still buy
“We have found that people that even are completely opposed to The posts end up being customers, assuming that they need the product”
Burazin: Client requested 5 million concurrent AI agent sandboxes
“But we have a request today for five million concurrent look. So five million at one point in time, right?”
Burazin: Most AI sandbox providers use Firecracker microVMs
“So all, most sandbox providers are firecracker VM, micro VMs.”
Burazin: Firecracker microVMs cannot run sandboxes with GPUs
“Now it can't run a sandbox with a GPU. It just doesn't work so that you can't have a firecracker.”
Burazin: CPU is the most expensive AI sandbox compute resource
“The most expensive thing is the CPU. Second, the RAM. This is almost free. It's very inexpensive.”
Borzin: Base10 and Fireworks AI run on over a dozen compute providers
“Both of them run on more than a dozen compute providers, depending on what you want to call them.”
Burazin: Long-running AI sandboxes require live migration between physical servers
“To have something that can run forever, you have to be able to live migrate the sandboxes itself between the machines so that you can reboot and manage these machines.”
Burazin: Sandboxes running over 24 hours represent 2.5% of volume, 20% of revenue
“Two and a half percent of our sandboxes run longer than 24 hours, but it's a large percentage, like twenty-ish percent of revenue.”
Burazin: Local storage achieves tens of millions of IOPS over network drives
“The IOPS, the speed, which with which you can move data to the hard disk in which the CPU and RAM, RAM interacts with from a network drive, just to give people like numbers, Is in the hundreds of thousands. If it's a local drive, it's in the tens of millions.”