Gemini API Managed Agents can run in your own sandbox

Google added self-hosted environments to Managed Agents on the Gemini API, so an agent's tools can run in infrastructure you control instead of Google's hosted sandbox.

You create an environment with the mode set to self_hosted, which returns an environment ID and a one-time key. Run gemini-api environments connect from the open-source Gemini API CLI inside your sandbox with that key, then pass the ID when you create an interaction. The sandbox connects over outbound HTTPS and needs no inbound firewall ports.

Google's docs include setup examples for Cloud Run, Cloudflare Sandbox, Daytona, E2B, Fly.io, Modal and Vercel Sandbox, plus Docker, rootless Podman and a local mode for testing. Hosted-sandbox options such as sources, network settings, env and file snapshots are rejected on self-hosted environments. Managed Agents and environments are still in preview.