Compare
How PAL Runtime compares.
Google Agent Compute Engine, E2B and Modal are managed sandboxes: compute you rent to run agent code. PAL Runtime is an open-source agent runtime you host yourself, and its sandbox is one part of it. So the comparison has two halves.
The sandbox
This is ACE’s whole product, and on isolation it is ahead of PAL Runtime by default: its sandbox never holds a credential and all egress leaves through a proxy on the host, backed by Google’s hardware root of trust. PAL Runtime comes closest only in its opt-in broker mode on Firecracker: injected credentials stay on the host, but vended secrets still enter the guest, there is no hardware root of trust, and it is validated on nested KVM, not at Google’s scale.
| Capability | PAL Runtime | Google Agent Compute Engine | E2B | Modal |
|---|---|---|---|---|
| Hardware-isolated microVM per sandbox | ✓Yes: Firecracker / Kata (needs KVM) | ✓Yes | ✓Yes | –Partly: gVisor or VM runtime |
| Platform runs the agent loop for you | ✓Yes | –Partly: your harness (“each team writes and trusts its own harness”) | ✕No: you host the loop | ✕No: you host the loop |
| Credentials never enter the sandbox | –Partly: injected headers only; opt-in broker mode, Firecracker | ✓Yes: by default | –Partly: header injection (beta) | –Partly: experimental |
| Egress allowlist enforced outside the guest | –Partly: broker mode, opt-in | ✓Yes: by default | –Partly: CIDR + domain on HTTP/TLS, at E2B’s firewall | –Partly: CIDR; domain allowlist in beta |
| No network interface in the sandbox by default | –Partly: broker mode only; guest mode attaches a TAP NIC | ✓Yes: by default | not documented | not documented |
| Data-loss-prevention policy on egress | ✕No | ✓Yes: per Google | not documented | not documented |
| Idle auto-suspend, resume on demand | ✓Yes: Firecracker only, opt-in per VM | ✓Yes | ✓Yes: opt-in | –Partly |
| Snapshot and fork | ✓Yes: Firecracker only; shared-memory fork | ✓Yes | ✓Yes | –Partly |
| Fork fan-out per call | up to 1,000 (default 100); validated with 3 forks on Lima | thousands, memory-deduplicated (per Google) | up to 20 | no fork |
| Hardware root of trust / attestation | –Partly: measurement recorded, not verified | ✓Yes: Titan | ✕No | ✕No |
| Proven at scale | Lima nested-KVM + CI only | The infrastructure behind Gemini’s agents (per Google) | Production | Production |
The platform around it
These are agent-runtime features. ACE is a compute layer, so “out of scope” means it isn’t trying to do them, not that it fails at them; on Google Cloud they come from other products.
| Capability | PAL Runtime | Google Agent Compute Engine | E2B | Modal |
|---|---|---|---|---|
| Durable agent runs with crash-resume | ✓Yes | out of scope | ✕No | ✕No |
| Budgets enforced before the model call | –Partly: cost, tokens and runs per day, tenant daily cost, per-run cap mid-workflow, per-tool limits in workflows; per-run cap on single-call runs not enforced; a mid-workflow breach fails the step | out of scope | ✕No | –Partly |
| Multi-provider model routing with failover | ✓Yes | out of scope | ✕No | ✕No |
| Signed, offline-verifiable run receipts | –Partly: only with a signing key configured | out of scope | ✕No | ✕No |
| Self-host in your VPC or on-prem | ✓Yes: Apache-2.0 | ✕No: Google Cloud only | –Partly | ✕No |
| Availability | Open source today | Preview “in the coming months” | Generally available | Generally available |
When to pick which
Pick Google ACE if you want a managed sandbox on Google Cloud with the strongest isolation defaults.
Pick E2B or Modal if you want hosted sandboxes today.
Pick PAL Runtime if you need to run agents in your own cloud or on-prem, with the sandbox, durable execution, spend limits and audit trail in one stack you control.
Competitor columns reflect each vendor’s public docs and announcements as of 2026-10-28; the Google column follows Google’sAgent Compute Engine deep dive (Oct 22, 2026). E2B: egress and secrets, auto-resume, fork. Modal: sandbox networking, Sandbox reference. A cross means not offered or not announced; “not documented” means the docs we read don’t say. If a cell is out of date, open an issue.
Back to PAL Runtime