Matt Turk: Hi, I'm Matt Turk. Welcome to the Matt podcast. My guest today is Ivan Borisin, CEO of Daytona, one of the most talked about startups in agent infrastructure. If you've been hearing the word sandbox in every AI agent conversation and quietly wondering what it actually means and why it suddenly matters, this episode is for you. We go from first principles, why does an agent need a computer at all? All the way to the deep technical end, why Daytona had to throw out Kubernetes and write their own scheduleuler, and why a global CPU shortage might be coming faster than people think. Ivan also unpacked the full agent stack as he sees it, models, sandboxes, tools, MCP, memory, orchestration, and where each piece is heading. Along the way, Ivan shares some really interesting lessons on go to market and distribution for technical founders that he has learned through 16 years building developer tools startups. Please enjoy this great conversation with Ivan from Daytona. Hey Ian, welcome.

Ivan Burazin: Great to be here.

Matt Turk: So you have said that every agent needs its own computer. What's the simplest way of explaining that idea?

Ivan Burazin: Well, when I think about agents, I think of them as digital knowledge workers. And to do anything as a knowledge worker, you do need a computer or I should say anything sophisticated. So, you and I can be on a conversation and we can get something done, but we usually need some sort of tools in our world is usually a computer to get higher productivity um and to be able to do things. And so, I think of that in the same lens. So, for me, agents are literally just digital knowledge workers.

Matt Turk: Great. And so it's on computer. That's the the whole concept of of sandbox. So as an introduction to this whole conversation, what is a sandbox?

Ivan Burazin: Absolutely. So sandbox is although they the term sandox first comes from isolation. So making sure that there's a secure place for in this case an agent to run and do things. But on the other side it is essentially a computer. It's a full-on computer that an agent has ability to install tools, access the web, um, run scripts, run code, whatever it needs to get its job done. So, the shortest answer is a sandbox is essentially we call them composable computers for AI agents.

Matt Turk: Yeah. And is in some ways like this whole open claw and Mac mini like a good analogy for what a sandbox is like the Mac Mini sort of being the sandbox.

Ivan Burazin: Exactly. So I think the openclaw Mac mini thing helped a lot of people understand what we actually do. It's like oh I get it now. I get it right. So it needs a computer in this case was a Mac Mini to be able to do different things. So yes that helped a lot with awareness for sure.

Matt Turk: Yeah because uh again to unpack it like the uh open claw as as a as a frameworking system to help an agent do all sorts of things on your computer. basically you want to be able to kill it if it goes rogue and therefore you can unplug the Mac Mini the way you could sort of kill a sandbox. Is that is that kind of

Ivan Burazin: so there's there's a couple things that I personally thought about and so my open claw runs on a not a physical Mac mini essentially but a sandboxed um virtual Mac mini and the reason why I didn't so the way people usually run these things and cloud code or openclaw is usually on their own computer because it helps them you know organize emails you know search whatever documents they have and whatnot there there's a one there's a high security risk there because at one point we were doing our board meeting presentation and I would ask claw can you go fetch the data from our bank and then it was like oh yeah just log in and give me access and I'm like log in give me no I will not give you access right um and so right away fundamentally for me that was like broke the entire thesis of it so you give it its own machine I personally gave it its own like Daytona account it gave it its own phone number and the reason I have give it own phone number is because it has to do 2FA to get into the bank. Like there's no other way except for a 2FA with a phone number for this particular bank. And so it has to have all these things like a employee like a digital employee to be able to go and access these things. And so the risk now that now that it has its own computer, it has its own account. These accounts have the limitations. So it can only it can only look at the data from my bank. It can't spend the money from my bank. And so except for the credit card that we did give it which has you know you know $100 a day or whatever it may be. And so the only risk you essentially have at that point if it's in a sandbox is will it take this data and now leak it somewhere and that's something we can talk about later but essentially the worst thing can happen is that and to your point you can kill the whole machine if you need to kill machine.

Matt Turk: Yeah. And there is a a fundamental concept of um stateful versus uh stateless. Uh can you can you unpack that for us?

Ivan Burazin: So that basically comes when we talk to people about what we are building they're like oh doesn't this already exist in any of the hyperscalers right? And so the answer is no. And the answer is no is is because everything that they were built for which was deploying apps they were they were stateless. Like if you have let's let's pick any of your websites or whatever you want web apps you do not want that to change on the fly. You if you if you are the company will pick like eBay because they're in this building so they're they came to mind. And so if you're eBay and you're an engineer there and you're like, "Oh, you have this new, you know, update. A button is here or it does this thing." You want that state that you you don't want that to be changed on the fly, right? The database might change, information might change, but you don't want the app to change, right? And so with those things in mind, that is how people had built the hyperscalers. Like that is the fundamental architecture you came into and built on top of that. And the simplest analogy I give people is let's say you're building a truck, right? You are a factory for a truck. There's like the the weight, the type of the engine, the chassis, um all of that is made to very slowly but surely securely transport some sort of goods, right? On the other hand, you can have a sports car which is still, you know, it has four wheels, it has an engine, whatever, but it's made for different things. It's made to go very fast. So the way the chassis is built, the way the, you know, um engine, the the weight balances is completely different. And so you can do you can do a lot of things with both, but they're not fundamentally the same thing. And as a company trying to build out both of those, they're separate platforms completely, right?

Matt Turk: Mhm. So sandboxes are a fundamentally new primitive. Is that is that correct? Is is it like a history of sandbox or did sandbox exist before?

Ivan Burazin: So I I would argue I would say that that the the person that could have nudged although he said he did and someone else did but anyway there was a company called code sandbox way back in the day when we used to compete with our company code anywhere which also was in the in the realm of like replet it's all these cloud-based IDs and so they called it code sandbox cuz I I I believe it it sounded cute it's like a box where your code you for ID um lived and they were actually one of the firsts so the team there that actually used microVM M did snapshotting, forking, all these things that we do use today. And so that is sort of and this is maybe a decade ago, but the utilization or the usage from or the value that it was giving human developers was not there. There's this whole article about like the end of local hosts and people have been talking about this for I've been talking about this for 20 years. Um and basically developers would say like you'll take my local host like out of my cold dead body. But now that agents are here, local hosts no longer actually one, you don't want that for a number of reasons. And so we're finally getting to that. So that technology and that thesis around sandboxes originally now seems to be coming to fruition.

Matt Turk: Mhm. And the big acceleration around sandboxes is is agents, right? That's

Ivan Burazin: thing. Absolutely. When we think about agents, so one, if you even if you do run an agent on your computer, like you want to do that, up to you. Go ahead and do that. There's a bunch of problems. One is let's hear in your laptop. There's this whole thing on Twitter now where people are holding their laptops open. Well, that's because I always hold my laptop open. That's just like my vibe without that. Um but been doing that for a long time. But people do that because they want clawed or open claw to finish. Cuz if you close it, it's is you terminate. Yeah. It's or pause or stop or whatever. Um so like the problem is like the continued the ability to work non-stop is not there as long as your laptop. So that's one thing. The other thing is you can't do concurrency. So you can do multiple to the amount of compute that you have in your laptop which will be quite limited. And so you might want to spin up 10 or 20 or 50 or 100 or 100,000 whatever that number might be. And so that's very hard. So ideally you actually really want to remove it somewhere remotely. So you can start on your laptop, you continue on your phone. It's the same computer and same agent that is doing their thing, right? And so that is a takeoff of we have now decided that it's absolutely okay that is no longer on our local host but again it is still a local host to that agent. So it's still a computer to that agent what a laptop is to us.

Matt Turk: Do all agents need a sandbox or is that a specific category?

Ivan Burazin: My my argument is that every agent will need at least one sandbox sometimes more and we can get to that again. there are places where you don't need and I analogize agents with humans for the most part and again we can have we can do productive work without computers and so there is and that was the original sort of like chatbot where basically you would just talk to an agent and it would inference so we just think and give you value so I don't know you a lot of people use it for like emotional support or whatever for the most part it doesn't need a computer it has enough data from you going back and forth and then it can sort of understand and give you feedback but that's a smaller subset. If we think of where all productivity gains are among the biggest verticals, healthcare, financial services, whatever, most of that is done via a computer. And so if you want agents to do all these things, then agents will need these computers to do.

Matt Turk: So if you do uh tool calls, coding, like any of those actions, then you need a sandbox. If you just chat,

Ivan Burazin: you probably don't need it. Yeah. So like even if if you have a chat we can get it to deal but if you chat and it has to search the web it still has to open a browser or it has to use something like you know parallel or exa or whatever to get to that that would be a tool call. So it depends on the use case but the thing that's quite interesting about the world that we live in is one let's take a step back one I firmly believe that in due time all the tools will be headless now will it be inside a sandbox or outside that's another thing all of them will be um and that's the most efficient way for an agent to work but most of knowledge work is still locked into legacy apps inside of inside of Windows for the vast majority, like the absolute vast majority. Um, so if you want an agent today to do a job end to end, you literally have to give it a computer. And so an example of this is again the board report, which is like, oh, can you pull out this report and our bank has an API and it can pull it out, but it only has spend on the API. It doesn't have um incoming revenue on the API. It's just not exposed or through the MCP tool actually. It's not exposed. And I'm like, then the agent was like, "Oh, I can't get to it." I'm like, "Dude, log in, download it." And okay, I'll go to it. And then you can see it opens up a browser, it goes download whatever. Same thing with, I don't know, with any other data source that we have. If it can pull it from the headless, it'll do it headless. If it cannot, then it sort of logs in and do that. And so, if we want to give them power today and get value, we have to enable them to have these tools.

Matt Turk: help us understand uh where sandboxes fit in the overall picture of this emerging uh agent stack that uh I think everybody's trying to figure out at the same time.

Ivan Burazin: I I try to think about everything. To me, it's actually quite interesting where and we'll get this a bit later as well. It's like a lot of this all exists in real life today. And so people are like overthinking this. I'm not saying that there there's not going to be new products and solutions and technology to solve it, but it's like it's not a new fundamental way of work. And so when you think about the agent stack itself, it's like okay, you first have the models and the models are essentially the brain that that is what it is of equivalent to what a human's brain is sort of. So you tell it something, it replies, it understands and whatnot. And then under that is like oh what are the tools it can do to get things done, right? And so that can be anything from like any of the MCP or or tool calls can do. It could be the sandbox, the computer, like whatever we as humans, we also have a bunch of tools that we use. Everything from a hammer to a computer and everything around that, right? Um, so all of those things exist as well. Then there is memory that exists. Can can an agent remember these things? Similar to like do you remember these things that are there? People talk about orchestration of agents. It is like management. Do you manage people? I manage people. Managing agents is similar is not dissimilar to managing humans. Now what tools will you use to manage them? Will you manage them in the same way just send a slack message and or you do linear or whatever it is we will see or it's going to be a net new app we'll figure that out but it is of that and of course it's like observability can you see what your teammate or colleague has done and verify that that job is good right and so there's tech that's sort of how I think about that on a very sort of higher level and then you can break down to different types of solutions people are creating for this

Matt Turk: where do sandboxes fit long term? Do do you think a lot of this gets eventually built into the sandbox or does the sandbox remain the the the execution layer for it all?

Ivan Burazin: Two two things. So if you look there's like the sandbox itself and again restating I'm saying it so many times in in this conversation but if we take like an average worker in Goldman for example right you have the you have the worker the person which let's call it the model in this way you have the computer which it logs in into um and the harness is a set of the way it shapes that model that it can and cannot do things interact things so it's almost like hands sort of to speak um of that bit bit deeper but basically the sandbox does support it and so if you think of a computer again I'll pick on I'll pick on go Goldman for example I've never worked at Goldman but it's my just assumption I worked at bigger company so my assumption is that when you log into that computer there is so much software in that computer that logs what you do restricts what you do make sure that you don't leak data and do these things again no prior knowledge of Goldman just assumptions on these things and so those are the types of things that we as a sandbox provider will most certainly incorporate into that. But that harness still has its function in that which it guides the model like oh I now know how to interact with this machine. Oh, I know how to do a tool call. Oh, I know how to this is how I work with memory. This is how I change with a model. And so there's a there is value in that. And so we don't take on the harness. That is something we pretty sure that we never do. But there's things that we do in the sandbox that does help or support that entire system.

Matt Turk: let's talk about um your story and uh Daytona's um story. So you this is not your uh first venture. Talk about the the the prior thing that you did.

Ivan Burazin: Yeah. So we started the cloud IDE space basically in 2009 both me and co-founder and so in 2009 for those of you that were around there was like no Docker, no Kubernetes, no VS code and so we had to build the entire stack which was something that we learned how how to do and something that we applied today. So like it was actually very very very early. The only I say that we started it because the company that started before us was Heroku which became Heroku and killed the ID which we probably should have done sooner um as well. So but we were the only one that sort of like started and finished finished in that in that sense. Later on you had other ones like code sandbox like replet and like others that that had had joined and um stack blitz which now bolt and whatnot. And so Replet also now changed and bolt into their other directions and Replet is doing really well. We decided to go in a completely different direction when we decided to do their next company. So um we had learned a lot of things on how to build this entire stack. But when we decided to kick off Daytona V1, which is different than it is today, we decided not to go app layer but just be infrastructure probably like on the teachings of Heroku which definitely went in into that direction. It's like oh we learned how to do all these things on the orchestration level underneath that seems to be very very valuable. So let's push on that and that is how we kicked that off.

Matt Turk: You're also pretty amazing at just distribution in general and and then building a brand and then developers uh which is fascinating, right?

Ivan Burazin: Thank you. But all of it all the entire GTM that we have we have no other things that we do like Twitter is a go to market um we don't have we have zero sales people and whatnot but it is definitely so the way I think about this and I stole this from or paraphrasing it from David from century which is like there's basically three ways that people pick your product and one is awareness do they even know you exist like if that doesn't happen there's no way they can pick you two is preference which is you know the the pricing the brand, the person, the different features, whatever like it's it's preference. And the third thing is like is there a deterministic thing that you offer that no one else has? So the easiest example for the third one is like do you have fed ramp right? Do you have that certificate? If you have like I can only the customer can only use you and no one else. But the two above are are quite interesting which is like how to make sure that everyone knows who you are and then you work on the um then you work on the preference. And so for me the all I don't it's not all I think about a large part of I think about is if all things were equal. So if our product is equal to everyone else's product what is the differentiator to that? And so like one can more people know about you than others like is the branding there is the the the um the experience there. uh experience is a nuance which p some people don't think about, some people do think about, but it's like do you prefer the feel of this product versus that product? And these are all things that have nothing to do with the actual technical capabilities of the product. And so my co-founder Verran, our CTO, like his job is mostly to make sure the product is better than anything else in the market. And my mandate is to make sure that even if his if our product is equal that we can supersede that and so that's how I think about the go to market in general.

Matt Turk: Now let's switch back to the the more technical uh stuff. So we talked about the concept of sandboxes. Uh just walk us through what a sandbox is technically.

Ivan Burazin: Yeah, there's a lot of things there's a lot of things there we can talk about. The way I think about uh sandbox is the ergonomics of consumption of compute. And so because there's a lot of different layers on that I basically put it into three different layers which is the infrastructure the primitive and the tooling those three things together. And what I mean by infrastructure is like is does it spin up very very fast? Can you spin so like we spin up in 60 milliseconds? Can you spin up a lot of them at once so the the rate of creating them. And so we can spin up 50,000 in 70 seconds. Um so little less than a minute and a half. And then once they're up, how many can you keep running? Like we can have we have customers that have billions a day. Um so those are like the infrastructure parts that are non-trivial.

Matt Turk: Why does it matter uh how quickly you can initialize a new sandbox and how many

Ivan Burazin: again it depends on the user and the use case. So if you're like a long running background agent again everyone prefers it to be fast like no one wants to wait. Like you don't want to wait for a reply. Like everyone wants to be fast to be very clear. So the faster the better, but generally there's an actual reason why you want it very very very fast. And that is especially if you so for I was going to say if for a background agent a background agent might work for like 10 minutes or an hour or whatever. So the incremental millisecond might not matter. But I still believe that from a user perspective even a second of waiting is kind of uncomfortable. You don't want that. And so is 60 or 90 maybe less so. But there you want that one two seconds for sure under that. But the interesting the more interesting part where that is really really important is for the researchers where when you're doing reinforcement learning you basically have a lotment of GPUs and you want the GPU is more expensive than the CPU. So the vast majority of sandboxes are CPU boxes to be clear. So they're the computers that we all work on. There might be a graphics card in there but basically it's the compute the RAM the CPU um and the hard disk that's in there. And they are cheaper or less expensive and easier to to get at least for now. We'll see for how long that lasts. Then GPUs, which means you want your GPUs always to be at maximum utilization and the CPUs can then idle if need to be idled, but you want them, you don't want the GPUs to idle.

Matt Turk: remind people what firecracker is

Ivan Burazin: firecracker it's an isolation priv so it is essentially a type of VM or virtual machine that's very stripped down it was made by the uh AWS team it's used inside of Lambda and so the idea which are like functions um and so the idea was to have something very very fast um that can spin up and stateless that that that was the entire time and they were very very ephemeral and so they were used for you know when your website has a large um if it's Black Friday a bunch of people hitting your website you can spin up a lot of these very very fast like handle the load and enable all these humans to to look at the website and buy whatever they were buying, right? And so that technology is there and it's a very stripped down version of a full-on VM. So it has less features there, but the things that it does, it does very very very very well. So it can spin them up fast. It does that because it can sort of lazy load things in into memory. You can do point in time snapshots. You can do all these nice things. The things that it can't do is it can't run a let's call it sandbox now. It can't run a sandbox with a GPU. It just doesn't work. So that you can't have a firecracker. So if you want a GPU, you have to do something which is a cloud hypervisor or a Kimu spelled Q E M U which are two different types. Q Kimu is almost a full VM. So it has all these different things in inside of there. Um so you can't do that.

Matt Turk: Why are snapshots and ors important? You mentioned uh uh performance and speed um and in connection with that you said that you had to rebuild your own scheduleuler.

Ivan Burazin: There's a lot of reasons. Let's get into the the commercial one, which is probably the the one that people most think about, which is pausing a sandbox. So if you are an app layer company and you have 10 million users and your 10 million users spin up let's just say 10 million sandboxes just to make the math easier. These things cost right cuz they're running they're using CPU RAM and hard disk the entire time. The most expensive thing is the CPU second their RAM disc is almost free. It's very inexpensive and the user sends the agent to do something. The agent does something and now it's waiting for reply. It could be waiting for the human or it could be waiting from a service depending on what it's trying to do. You ideally don't want that sandbox to run idle because you are now pay regardless if you're a customer of Daytona or running your own but like there is a cost to running these things. And so what you want to do is pause that and wait for a reply either from a service or for a human and then resume and the feeling and experience is that it never turned off. So you feel like it never turned off but it actually did um turn off. And so that one is from a from a compute management perspective if not from a cost perspective is probably the first reason.

Matt Turk: we have been in a very well doumented GPU shortage. Uh but it uh seems that we might be heading towards a CPU shortage.

Ivan Burazin: Yeah, it might be happening. So one of your former guests and was at our conference Dylan Patel like semi analysis they wrote the report and I believe it's somewhere like October we have no more CPUs and people hadn't thought about it like it's it's all GPUs all GPU intensive then memory but basically now now that agents need all these computers like it is very much needed now that RL is the way that we've gotten most of the progress in models over the last 18 20 months hunts you need all the CPU machines to do this. Now that the GPUs are more powerful, they can do in parallel more of these CPUs, CPU boxes. And then you see this, there was a tweet that I put a while back and it's like you should definitely invest, not financial advice, you should invest in Intel and look at their stock price, right? And so like there's definitely need for that

Matt Turk: Okay. Well, Ivan, that was fabulous. Thank you so much for spending time with us today.

Ivan Burazin: Thank you for having me. We're great.