Recommended integration pattern for remote HTTP sandboxes like Daytona in MAF?

[gimmickj]

Hi team,

We are building a lightweight .NET 10 agent CLI on top of Microsoft Agent Framework.

We are experimenting with integrating a remote HTTP-based sandbox service (similar to Daytona), and we want to avoid going too far in a direction that does not match the intended MAF design.

Our current MVP approach is:

• a session-level sandbox manager
• an AIContextProvider that injects an execute_code tool
• chat/CLI commands for sandbox create/current/exec/upload/download
• session-level sandbox reuse between the agent and the CLI

This works for now, but we are unsure whether this is the recommended long-term pattern.

Our main questions are:

1. For remote HTTP sandboxes, is AIContextProvider + execute_code the recommended integration pattern today?
2. Is Microsoft.Agents.AI.Tools.Shell mainly intended for local / docker / near-host shell execution rather than remote sandbox services?
3. Beyond Hyperlight, is there a plan for a more general sandbox / CodeAct provider abstraction for remote services?
4. If the community wants to build a Daytona-style integration, what is the recommended minimum scope?

We would appreciate guidance before we invest further in the abstraction.

Thanks!

[moonbox3]

@eavanvalkenburg could you please help here?

[Ashutosh0x]

Interesting question! Remote HTTP sandboxes like Daytona can integrate with MAF at two levels:

1. As an Agent Executor
Wrap Daytona as a custom AgentExecutor that sends tool calls to the remote sandbox for execution. This keeps the agent's reasoning local while offloading code execution to an isolated environment. The framework's AIFunction abstraction makes this clean:

`python
class DaytonaSandboxTool(AIFunction):
async def execute(self, args):
# Forward to Daytona HTTP API
result = await self.daytona_client.execute(args)
return result
``n
2. As a Hosting Channel
If Daytona is hosting the agent itself, implement a custom channel (similar to ResponsesChannel) that bridges Daytona's protocol to MAF's run/stream interface.

Key consideration: The Agent Framework's hosting stack (which I recently contributed to) uses session isolation keys for state management. Make sure your Daytona integration propagates these keys so multi-turn conversations maintain state across sandbox restarts.

I would also look at the Hyperlight integration that @eavanvalkenburg is building (#6601) — it is a similar pattern of sandboxed execution within the framework.