---
type: "post"
id: "sidecars-a-low-latency-trust-boundary-for-sandboxes-7732a1"
slug: "sidecars-a-low-latency-trust-boundary-for-sandboxes-7732a1"
title: "Sidecars: A low-latency trust boundary for Sandboxes"
description: "Modal’s Sidecars put a trust boundary next to the workload rather than across a remote service hop."
retrieval_nugget: "Modal’s Sidecars put a trust boundary next to the workload rather than across a remote service hop."
published_at: "2026-10-01"
updated_at: "2026-10-01"
record_date: "2026-10-01"
date_kind: "published_at"
topics: []
source_urls: ["https://modal.com/blog/introducing-sandbox-sidecars-trust-boundary"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:sidecars-a-low-latency-trust-boundary-for-sandboxes-7732a1"
status: "published"
visuals: []
editorial_provenance: {"schema_version":"newruntime-editorial-copy-v1","content_status":"source_grounded_final","final_copy_sha256":"sha256:94c5a0218a8b13d0db770d144ad5e09ec1e243aff6072626348e1f6d792c76a8","reviewed_at":"2026-10-01T20:05:19.305Z","source_evidence_count":1,"verified_claim_count":4,"site_analysis_schema_version":"newruntime-site-analysis-v1","site_object_kind":"field_note","observed_fact_count":4,"implication_count":2,"watch_condition_count":2,"related_record_count":0}
analysis: {"schema_version":"newruntime-site-analysis-v1","object_kind":"field_note","thesis":"Modal’s Sidecars put a trust boundary next to the workload rather than across a remote service hop.","observed_facts":[{"text":"Modal announced Sidecars as a beta feature on October 1, 2026.","source_urls":["https://modal.com/blog/introducing-sandbox-sidecars-trust-boundary"]},{"text":"Sidecars are isolated containers running alongside a main Sandbox on the same host; Modal says they use the same isolation boundary as separate Sandboxes, via gVisor or VMs depending on runtime.","source_urls":["https://modal.com/blog/introducing-sandbox-sidecars-trust-boundary"]},{"text":"Modal’s internal benchmark reports 0.58 ms p50 and 1.4 ms p99 communication with a Sidecar, versus 2.6 ms p50 and 44 ms p99 between separate Sandboxes in the same region.","source_urls":["https://modal.com/blog/introducing-sandbox-sidecars-trust-boundary"]},{"text":"Modal cites Ramp as having built a custom egress proxy alongside its Inspect coding-agent Sandboxes.","source_urls":["https://modal.com/blog/introducing-sandbox-sidecars-trust-boundary"]}],"mechanism":"The mechanism is local adjacency under isolation. Sidecars and the Sandbox communicate over an internal bridge network, which can avoid repeated remote round trips in operation-heavy agent loops.","why_now":"Why now: Modal frames the release as a response to agent systems combining access to private data, exposure to untrusted content, and outbound network capability, while remote separation can add latency and fixed egress controls may not fit every service.","implications":["The first implication is that teams can prototype custom credential and egress controls adjacent to agent execution while preserving a separate container boundary.","A programmable local enforcement point could give teams more flexibility than fixed egress features, though practical assurance depends on implementation and threat model."],"evidence_boundary":"The evidence boundary is that this is a vendor announcement about a beta, with vendor benchmarks and a customer example rather than independent evaluation.","watch_conditions":["The first watch condition is whether beta documentation and independent deployment evidence show that outbound traffic can be reliably forced through a Sidecar without bypass paths or unacceptable workload-specific overhead.","Further evidence on operational limits, lifecycle behavior, and independent latency measurements would clarify whether the design generalizes beyond Modal’s reported example."],"related_records":[],"new_branch_reason":"No prior New Runtime record was supplied, so this announcement starts a distinct analytical record on colocated isolated sidecars as an agent-infrastructure trust boundary."}
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/sidecars-a-low-latency-trust-boundary-for-sandboxes-7732a1/","markdown":"https://newruntime.com/posts/sidecars-a-low-latency-trust-boundary-for-sandboxes-7732a1.md","json":"https://newruntime.com/posts/sidecars-a-low-latency-trust-boundary-for-sandboxes-7732a1.json"}
---

# Sidecars: A low-latency trust boundary for Sandboxes

## Retrieval answer

Modal’s Sidecars put a trust boundary next to the workload rather than across a remote service hop.

Modal’s Sidecars put a trust boundary next to the workload rather than across a remote service hop. This thesis is grounded in its October 1 announcement: the company describes isolated containers running alongside the main Sandbox on the same host, with isolation matching separate Sandboxes through gVisor or VMs. That design aims to let trusted components handle credentials, proxying, or harness logic while agent-generated code remains untrusted.

The mechanism is local adjacency under isolation. Sidecars and the Sandbox communicate over an internal bridge network, which can avoid repeated remote round trips in operation-heavy agent loops. Modal’s internal benchmark reports p50 communication of 0.58 ms with a Sidecar versus 2.6 ms with a separate Sandbox in the same region, and p99 of 1.4 ms versus 44 ms. These figures are company-reported and do not independently establish either general performance or security efficacy. The announcement also describes Ramp building a custom egress proxy alongside its Inspect agent Sandboxes.

Why now: Modal frames the release as a response to agent systems combining access to private data, exposure to untrusted content, and outbound network capability, while remote separation can add latency and fixed egress controls may not fit every service. The implication is that teams may gain a programmable local enforcement point without placing trusted logic in the same execution container as generated code. The evidence boundary is that this is a vendor announcement about a beta, with vendor benchmarks and a customer example rather than independent evaluation.

The first implication is that teams can prototype custom credential and egress controls adjacent to agent execution while preserving a separate container boundary. The first watch condition is whether beta documentation and independent deployment evidence show that outbound traffic can be reliably forced through a Sidecar without bypass paths or unacceptable workload-specific overhead. Modal says one Sandbox can run up to 250 Sidecars, but the announcement alone does not show how broadly this pattern performs in production.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)