Sandbox comparison
Which agent sandboxes can mount Mountable: one production E2B result, and desk research for the other runtimes.
Mountable is not a sandbox. It mounts into one. The columns below are the
things that decide whether mountable mount can run: a usable /dev/fuse,
who is allowed to mount, outbound TCP to mountable.io on 443, 8889
and 18889, and anything that terminates TLS on that traffic.
Facts are dated. The only production mount is E2B on CLI 0.2.0 (2026-10-06) and CLI 0.3.0 (2026-10-07). Everything else is desk research retrieved 2026-10-13 from vendor docs and, where noted, a forum post. Desk research means the FUSE and network prerequisites were read, not that a Mountable filesystem was mounted there. CLI 0.4.0 has no production sandbox pass. Cold-start time is not compared; it was not measured.
Copy-paste steps are on Mount tutorials. The shared ticket flow is Mount from a sandbox.
How to read this
- Production mount — a credentialed mount of production, with an 8 MiB write and read-back, then revocation. Only E2B.
- Desk research — cited provider docs (or a named forum thread) as of 2026-10-13. Not a Mountable mount.
- Likely blocked — the provider's own rule closes the path. Still not a failed mount we ran.
- No provider's formal docs name
fusermount3. Except for the E2B result, treat a non-root mount as untested and prefer root where the provider gives you root.
Comparison
| Runtime | Evidence | /dev/fuse | Who mounts | Ports 443, 8889, 18889 | TLS interception |
|---|---|---|---|---|---|
| E2B, default template | Production mount. Debian 12, non-root. CLI 0.2.0 on 2026-10-06 and CLI 0.3.0 on 2026-10-07. Revocation stopped the mount after 2–4 s. CLI 0.4.0 not re-run. | Present for that mount. E2B's docs never name the device. | Proven as the default non-root user. fuse3 was not installed. Which helper ran was not recorded. Keep this recipe non-root. | Open by default. A domain allowOut list matches ports 80 and 443 only, so 8889 and 18889 need CIDR rules for Mountable's addresses. | Keep network.rules TLS transforms off for Mountable traffic. They terminate TLS. |
Modal runtime="vm" | Desk research 2026-10-13. No Mountable mount. | Modal's docs say to use the VM runtime for mounting FUSE filesystems. The device is not named. An unset runtime is Modal's choice. The non-VM path is where Modal sends people who do not need FUSE. | Root inside the VM is unverified. fusermount3 is not documented. GPU sandboxes are documented as gVisor-only, so they are not a FUSE path. | Open to any public IP by default. outbound_domain_allowlist allows TLS on port 443 only; 8889 and 18889 need a CIDR allowlist. | Do not add a secret-injection rule for mountable.io. It terminates TLS on port 443. |
| Daytona Tier 3 and 4 | Desk research 2026-10-13. No Mountable mount. | User FUSE is documented (mount-s3, gcsfuse, and similar). The device is not named. | Official examples use sudo. fusermount3 is not in the formal docs. | Tier 3 and 4 default to full internet access. Tier 1 and 2 are limited to essential services and cannot be overridden per sandbox; mountable.io is not one of those services, so those tiers are likely blocked. Whether domainAllowList matches 8889 and 18889 is unverified. | No TLS-intercepting proxy is documented for the default path. Probe an allowlist before relying on it. |
| Fly Machines | Desk research 2026-10-13. Forum, not formal docs. No Mountable mount. | A 2026-08 user report found /dev/fuse and CAP_SYS_ADMIN. Staff confirmed that the FUSE module stays, not those device and capability details. | A Machine is a microVM and the documented shell is root. Prefer root. fusermount3 is not a documented Mountable path. | No default egress firewall is documented. If any network-policy rule exists, that direction defaults to deny: allow TCP 443, 8889 and 18889. The policy has no CIDR field. | No TLS-terminating proxy is documented for an ordinary Machine. |
| Vercel Sandbox | Desk research 2026-10-13. No Mountable mount. | FUSE filesystems are a documented workload in the Firecracker microVM. The device is not named. | Commands have sudo. The docs say to run FUSE with sudo. fusermount3 is not documented. | networkPolicy: "allow-all" (the default) is unrestricted public internet. Under a custom allowlist, non-443 ports are unverified. | Keep transform and forwardURL rules off for Mountable. They terminate TLS. |
| Cloudflare Containers | Desk research 2026-10-13. The vendor's FUSE example is R2, not Mountable. | In-container FUSE is documented. There is no user-facing device or capability flag; the platform grants the path the example uses. | The example image runs as root. fusermount3 is not the documented path. Local wrangler dev is not that environment. | Leave enableInternet at its default, true. Non-80/443 traffic then egresses directly. Setting it to false leaves only ports 80 and 443, which blocks 8889 and 18889. | Keep interceptHttps off. Interception is the wrong shape for the gateway's client certificate. |
| Docker on a host you control | Prerequisites checked 2026-10-13. The credentialed session was refused with payment_required before FUSE ran. | A default container has no /dev/fuse. Docker's FUSE example passes --device /dev/fuse. | That example also adds --cap-add SYS_ADMIN and runs as root. A non-root, device-only mount was not completed. | Default bridge egress is unrestricted unless you add a firewall or --network none. | Docker does not terminate this TLS. |
| GitHub-hosted Actions | Desk research 2026-10-13. No workflow was run. | Not named on the VM images. ubuntu-slim is an unprivileged container; GitHub's docs say mounting filesystems is unsupported there, so that label is likely blocked. | ubuntu-latest and ubuntu-24.04 are full VMs with passwordless sudo. Whether /dev/fuse exists on today's image is unverified. | A normal hosted VM does not document a ban on these ports. An optional private network can block them. | No default intercepting proxy is documented. Private networking must not intercept TLS unless that CA is installed in a custom image. |
What stays true on every row
The API key stays on the backend. The sandbox receives one ticket and runs
mountable mount --ticket-stdin. A domain allowlist is not a substitute for
a check of ports 8889 and 18889: several providers apply domain rules to
ports 80 and 443 only. A successful probe is a TLS handshake or a real mount,
not a bare TCP connect.
Codespaces, Runloop and Kubernetes are outside this table. Hosted Codespaces
is likely blocked for lack of /dev/fuse; the other two were unverified on
2026-10-13.