Business objective

Disposable, build-to-order workspaces that vanish when you are done — nothing sticky to compromise. Ephemeral environments provide zone-scoped, reproducible, short-lived compute: a dev box, sandbox, or runtime that is spun up from declarative config, scoped to exactly one trust zone, used for a task, and then destroyed. The security value is that there is no long-lived, drifted, credential-laden machine sitting around for an attacker (or a runaway agent) to find and pivot from. For agentic AI workloads, this is the practical substrate of trust-zone-segmentation: an agent runs in a fresh, network-constrained sandbox with only the access its zone permits.

When you need it

Day-2 — for dev and agentic workloads. A hedge fund does not need ephemeral compute to run an enterprise chatbot. It becomes relevant when the firm starts (a) letting developers or quants use AI coding agents at scale, or (b) running autonomous/agentic workloads that execute code or call tools. At that point, giving each agent or dev task a disposable, zone-scoped environment is how you stop a compromised or prompt-injected agent from establishing persistence or reaching across zones. For a CTO, this is the infrastructure that makes the red/yellow/green zone design enforceable rather than aspirational — you adopt it alongside, not before, agentic AI.

Security role

Preventive isolation: constrains outbound data flows and data reach per zone. Ephemeral environments are how trust zones are physically realized: a red-zone agent gets internet but no internal data; a yellow-zone agent gets data-warehouse access but no internet to exfiltrate to. Because the environment is short-lived and rebuilt from config, there is no accumulated sensitive state to leak. It underpins trust-zone-segmentation directly and spans the red and yellow zones by design.

Vendors

These are general-purpose compute/dev-environment platforms used for zone-scoped ephemeral workloads, not AI-security products per se:

• github-codespaces — on-demand, container-based cloud dev environments defined in-repo.
• azure-dev-boxes — managed, policy-governed cloud developer workstations on Azure.
• terraform-cloud — declarative infrastructure provisioning/teardown; cross-listed with policy-as-code (Sentinel) for governing what gets built.
• cloudflare-workers — edge serverless compute; short-lived, isolated execution for sandboxed/red-zone tasks.
• coder — self-hosted (any cloud, on-prem, air-gapped) cloud dev environments for developers and coding agents; Premium adds AI Gateway (LLM proxy with per-user prompt/tool-call audit) and Agent Firewall (per-agent HTTP egress allowlist with central logs). KKR and QRT are named customers and investors ($90M Series C, 2026-04-01). Cross-listed to ai-gateway and agent-runtime-security. (added 2026-10-26)
• google-cloud-workstations — Google Cloud’s managed dev workstations; VMs run in your own GCP project/VPC, private clusters inside VPC Service Controls perimeters, rebuilt on each start. The 2026 agent mode adds suspend/keep-alive for long-running coding agents but no agent-specific egress control. (added 2026-10-26)
• ona — formerly Gitpod; agent-first dev environments in Ona’s cloud or the customer’s AWS VPC. Acquired by OpenAI (announced 2026-06-11, closed 2026-08-10 per Ona) and being absorbed into Codex; hosted Ona Cloud shuts 2026-10-31. Not a new-evaluation candidate. (added 2026-10-26)
• Not given a page: DevPod (vCluster Labs, formerly Loft Labs) — open-source client-only devcontainer tool, unmaintained since 2025 (no release since 2025-06). (noted 2026-10-26)

Agent code sandboxes (added 2026-10-16). A different product from the four above: those give a human a disposable workstation; these give an agent a disposable, API-created box per task in which to run code nobody has reviewed. The buying questions are isolation strength (container vs gVisor vs microVM), default egress, and whether the sandbox can run in your own cloud.

• modal — serverless AI compute whose Sandboxes run untrusted agent-generated code on gVisor or a per-sandbox VM runtime; hosted only; outbound network open by default. $750M Series D at $15.75B (2026-10-14).
• daytona — API-driven, sub-second, stateful agent sandboxes (Sysbox-hardened containers, not microVMs); pivoted from human dev environments in 2025; open-source repo archived, BYOC is Enterprise-only.
• docker-sandboxes — Docker Sandboxes (sbx) runs off-the-shelf coding agents (Claude Code, Codex, Copilot, Gemini CLI…) in local per-session microVMs with their own kernel, a host-side egress proxy (deny by default) and placeholder-credential injection; the paid Docker AI Governance add-on gives central policy and audit. Proprietary CLI, free locally. (added 2026-10-20)
• nvidia-openshell — NVIDIA’s open-source, self-hosted sandbox runtime for long-running agents (Docker/Podman/Kubernetes; microVM driver in prerelease); provides policy and containment, not compute. Primary is agent-runtime-security. (added 2026-10-20)
• Also in this space, no pages: E2B (Firecracker microVM sandboxes), and the browser-agent sandboxes Browserbase and Anchor Browser — hosted headless browsers in which an agent can be confined.

Consolidation / M&A dynamics

Not an AI-security M&A market — these are platform offerings from major cloud/dev incumbents (Microsoft/GitHub, Azure, HashiCorp/IBM, Cloudflare). The HashiCorp → IBM acquisition (per seed flags elsewhere; unverified — to confirm in research) is the only relevant ownership note, affecting Terraform Cloud’s stewardship. The trend to watch is platforms adding agent-sandbox primitives (isolated, ephemeral runtimes purpose-built for AI agents executing code).

Adjacent categories

• trust-zone-segmentation — the design pattern ephemeral environments physically enforce.
• policy-as-code — governs what may be provisioned and how zones are configured (Terraform Cloud / Sentinel).
• agent-runtime-security — runtime protection for the agents that run inside these environments.
• mcp-gateway — controls the tools/egress an agent in a zone is allowed to reach.

Survey

Question. Which platforms does your firm use to provide ephemeral, zone-scoped compute for developers or AI/agentic workloads?

Answer options. GitHub Codespaces; Azure Dev Boxes; Terraform Cloud; Cloudflare Workers; Modal Sandboxes; Daytona; Coder; Google Cloud Workstations; Other (Please Specify).

Response scale. multi-select; Interested; Considering/evaluating; Pilot/implementing; In production; Would recommend; Would not recommend.

Notes for survey design. This is a niche/Day-2 question and will only resonate with firms running AI coding agents or agentic workloads — consider gating on that. Respondents will likely pick whatever matches their existing cloud (GitHub/Azure shops pick Codespaces/Dev Boxes by default), so selections reflect incumbency more than a deliberate security choice. The more meaningful signal may be a follow-up: “do you scope AI/agent workloads into short-lived, network-constrained environments?” rather than the specific product. Gitpod/Ona is deliberately not an option: OpenAI bought it and its hosted service closes 2026-10-31; respondents still naming it are on a migration path.

Open taxonomy questions

• This category is doc-only (no CSV question) and product selection is largely determined by incumbency — it may read better as a practice note under trust-zone-segmentation than as a vendor shortlist. Keep as-is for now.
• Overlap with policy-as-code via Terraform Cloud / Sentinel; cross-listed.