Skip to main content
Compute is isolated per agent; state is isolated per instance. An agent’s instances, one per conversation, run inside containers of the agent’s code. Each instance lives in exactly one of them at a time: it is placed on first touch, may be relocated, and is addressed by name, never by location. Which instances share a container is the platform’s choice, so no instance can rely on being alone and none can rely on company. Within a container, everything is shared by the instances in it:
  • CPU, memory and the filesystem, including the writable working directory and /tmp.
  • Environment variables, secrets and bindings.
  • The code, and any module-level variable in it.
  • The outbound network identity.
What each instance owns, and no other instance can see:
  • Its storage and its SQL database.
  • Its message log, event log and scheduled tasks.
  • Its in-flight run, pending approvals and WebSocket connections.
  • Its turn: one call at a time per instance, while different instances run in parallel.
There is no virtual machine per conversation. A conversation’s isolation is logical, its own state and its own serialized calls, not a separate compute environment. Anything that executes in a container, a shell command, a file written to /tmp, a module-level cache, is visible to whichever other conversations of that agent share it, and gone when the instance moves; per-conversation compute is what the sandbox on the Tools roadmap is for.