AutoGen code executor alternative run agent code in a microVM

On Runtime, the agent gets a disposable Linux machine without Docker on your host. AutoGen's recommended isolation, DockerCommandLineCodeExecutor, needs a Docker daemon wherever the agent runs. A Runtime sandbox needs only the withruntime package. It is a microVM with its own kernel, on servers that Runtime operates. It bills the CPU the code uses. A 2 vCPU, 4 GiB sandbox costs $0.03125 an hour while AutoGen waits on the model. autogen-agentchat 0.7.5 was the current PyPI release on 25 October 2026.

AutoGen's own executors

AutoGen 0.7 runs model-written code through a CodeExecutor. The experimental CodeExecutorAgent uses one, and so does PythonCodeExecutionTool on an AssistantAgent. These ship in autogen-ext 0.7.5:

The executors run code blocks that the model writes in its reply. The Runtime tools work the other way. The model calls runtime_exec with a shell command. That suits agents that install packages, run tests and edit files.

Wire it up

AssistantAgent turns plain Python functions into tools by itself. It reads their type hints and docstrings. sandbox_tools bound to an AsyncSandbox returns coroutines, which fit AutoGen's async runtime.

Terminalpip install -U "autogen-agentchat" "autogen-ext[openai]" withruntime

Pythonfrom autogen_agentchat.agents import AssistantAgentfrom autogen_core.models import ChatCompletionClientfrom withruntime import AsyncRuntimefrom withruntime.tools import sandbox_toolsasync def solve(model_client: ChatCompletionClient, task: str) -> str:    async with AsyncRuntime() as runtime:        async with await runtime.sandboxes.create(timeout_seconds=900, on_lease_end="stop") as sbx:            agent = AssistantAgent(                "engineer",                model_client=model_client,                tools=sandbox_tools(sbx),                max_tool_iterations=12,                system_message="Work in the Linux sandbox. Check exit codes. Reply TERMINATE when done.",            )            result = await agent.run(task=task)            return str(result.messages[-1].content)

The max_tool_iterations setting matters. Its default is 1. That lets the agent make one round of tool calls and then answer. Raise it so the agent can run a command, read the error and try again. Any AutoGen model client works. One example is OpenAIChatCompletionClient(model=...) from autogen_ext.models.openai.

The four tools are the same in every framework:

A team that shares one machine

In a RoundRobinGroupChat or SelectorGroupChat, give the coder and the tester the tools from the same sandbox. The tester then runs the files the coder wrote, with no copying between containers. Give a reviewer agent no tools at all. It can then read results but never run anything. Each team run can use its own sandbox. A paid account runs 100 at the same time.

Contain what the agent can reach

Set limits when you create the sandbox. Do not rely on the prompt:

Pythonfrom withruntime import AsyncRuntimefrom withruntime.tools import sandbox_toolsasync def analyst_tools(runtime: AsyncRuntime):    sbx = await runtime.sandboxes.create(        network={"internet": True, "allow": ["pypi.org", "*.pythonhosted.org"]},        timeout_seconds=600,        on_lease_end="stop",        max_total_cost_micros=50_000,    )    await sbx.exec("pip install pandas", check=True, timeout_ms=180_000)    await sbx.network.set(internet=False)  # nothing leaves while the agent works    return sbx, sandbox_tools(sbx)

Call await sbx.stop() when the team finishes. The time limit stops the sandbox anyway after 600 seconds.

• The network rules, CPU, memory and cost are enforced on the host. Root inside the sandbox cannot change them (security).
• max_total_cost_micros=50_000 stops the sandbox once it has cost more than five cents.
• Tokens that the agent's code needs, such as a GitHub token for a private clone, go in as secrets. The sandbox holds a placeholder. The host adds the real value only on requests to the hosts you name.
• The application's Runtime key can carry a daily spending limit that no key can raise. Past that limit, creates fail with spending_limit_reached.

AutoGen's status

AutoGen's README says the project "has been archived and is no longer actively maintained by Microsoft". It also says "new users should start with Microsoft Agent Framework". AgentChat 0.7.5 stays on PyPI for projects already built on it. The Runtime tools are ordinary typed functions, not an AutoGen plugin. They therefore move with you to any framework that takes Python functions as tools (any other framework).

When to choose which

• Local executor: your own code, on your own laptop, in a demo.
• Docker executor: a single trusted host where Docker is already running.
• Azure dynamic sessions: an Azure shop that wants Python cells only.
• Runtime: agents open to untrusted input, many agents in parallel, or hosts with no Docker, such as serverless functions.

More on the isolation question is in Docker vs a virtual machine and local Docker vs a cloud sandbox. More on the workload is in a coding agent sandbox. A new account gets 100 free hours of a 1 GB machine in its first 30 days. No card is needed:

Terminalprintf '%s\n' 'print(sum([125, 250, 375]))' > invoice.pynpx withruntime sandboxes run -- python3 - < invoice.py

Sources

• AutoGen README, archive notice and install line, read 25 October 2026
• AutoGen: Command line code executors, read 25 October 2026
• AutoGen AgentChat: Agents, read 25 October 2026
• autogen-agentchat on PyPI and autogen-ext, version 0.7.5. The executor classes and the max_tool_iterations default were read from that release's source on 25 October 2026

Facts on this page were checked on 25 October 2026.