On November 11 Google AI Studio announced that Managed Agents on the Gemini API can now use your own sandbox. Until now, managed agents such as Antigravity ran their tools only in a Google-hosted Linux sandbox. Now the agent loop and model calls stay with Google, while tool calls such as shell commands and file reads and writes can run in your own container, VM or microVM. To connect, call POST /v1beta/environments with {"mode":"self_hosted"} to get an environment id and an environment_key that is returned only once, then run environments connect from the open-source gemini-api CLI inside your sandbox. All traffic is outbound HTTPS, so no inbound ports need to be opened.
Key Takeaways
- ✓Split: the agent loop, model and interaction stream stay with Google, while 7 built-in tools (execute_bash, file read/write/edit, list_dir, grep_search, find_by_name) run in your environment
- ✓Network: 100% outbound HTTPS, no inbound ports; the worker holds only an environment-scoped environment_key, so the project-wide GEMINI_API_KEY stays out of the sandbox
- ✓Two modes: environments connect runs one long-lived worker; environments poll + serve starts a fresh sandbox per interaction that holds only a short-lived lease token and zero API keys
- ✓Official examples cover 8 targets: Cloud Run, Agent Substrate, Cloudflare Sandbox, Daytona, E2B, Fly.io, Modal and Vercel Sandbox, plus Docker and rootless Podman recipes
- ✓Limits: sources, network, env and /files snapshots apply only to Google-hosted environments; self-hosted ones return 400 INVALID_ARGUMENT. Separate pricing has not been announced
Key Decision Metrics at a Glance
Not enough VRAM? Compare cloud API and self-hosting costs
Compare 40 dev plans & simulate token costs vs $20/mo subscriptions
Project Links & Resources
Direct AccessIn-Depth Technical Analysis
Background and the problem it solves
Google launched Managed Agents on the Gemini API in September: one call to the Antigravity agent provisions a temporary Google-hosted Linux sandbox where the agent writes code and runs commands. Many companies, however, cannot let code, private packages or data leave their own network, and they want to control egress themselves, so the hosted sandbox was a barrier. Anthropic, Mistral and others also offer managed agents, and where the execution layer lives has become a key point of competition.
Architecture and how it works
Self-hosted environments split out the execution layer. Google still runs the agent loop, model calls and interaction stream; your worker pulls work through the leaseInteractions endpoint, runs tools inside --root-dir, and returns results and heartbeats. File tools are confined to the root directory, blocking .. traversal and symlink escapes. For production Google recommends poll + serve: the control plane holds the key, and each interaction gets a fresh sandbox that receives only a short-lived lease token and is destroyed afterwards.
Benchmarks and measured results
This is an infrastructure feature, and Google has published no performance or cost benchmarks. Daytona notes that a fresh sandbox per interaction adds a few seconds of start-up, while a long-lived worker avoids that wait and keeps files between interactions.
Getting started
Install the open-source gemini-api CLI (Go, Apache 2.0), create a self_hosted environment with POST /v1beta/environments using your API key, and save the environment_key right away. Inside the sandbox, run gemini-api environments connect --environment-key ... --root-dir /workspace, then pass the environment id to interactions.create. Google warns that local mode runs bash directly on your machine and is for throwaway testing only; real workloads belong in a container or VM, running as non-root with cloud metadata addresses blocked.
Benchmark side-by-side against alternatives, or calculate monthly token cost vs subscription break-even.
Discussion & Comments
0Sign in to join the discussion
Connect with AI developers to exchange benchmark insights.