Agno 3.1.4 Turns an Agent's Computer Into Durable State

Agno 3.1.4, released October 16, moves a consequential part of coding-agent execution behind a new boundary: ClaudeAgent and CodexAgent can now run their entire external harness inside a per-session sandbox, then carry the workspace and the harness's own conversation state forward as a verified checkpoint.

That is more than process isolation. The release ties compute, recovery, and service state together closely enough to ask a harder question: after a crash, cancellation, or replica change, which exact agent computer is authoritative?

What shipped

A sandboxed external agent takes a sandbox= provider. The first providers are customer-operated Docker and Amazon Bedrock AgentCore. On each turn, a coordinator claims the session through a lease row in Postgres, starts or restores compute, runs the harness, captures a checkpoint, verifies it, and commits the run row and recovery pointer together.

The failure rule matters: a cancelled or failed turn does not publish a new checkpoint. The previous committed checkpoint remains the recovery point. Agno also records the native Claude session ID or Codex thread ID with that checkpoint; if restored state lacks the expected native identity, execution fails with native_state_missing before another model turn instead of silently opening a fresh conversation.

Warm reuse is an optimization over the same durable base. For a configurable window—300 seconds by default—the coordinator can pause a Docker container or leave an AgentCore microVM idle. A subsequent turn reuses it, but every completed turn still captures a checkpoint. If the warm computer disappears or expires, a new generation restores from the committed checkpoint.

The surrounding queue now serializes durable work per session by default. Earlier tickets block later tickets without consuming a worker attempt, while other sessions remain concurrent. AgentOS submissions also gain idempotent reconnect and cancellation paths across replicas.

Attachments cross the boundary as bytes rather than host paths or URLs. They are validated before a durable write, capped at 16 items and 512 KiB total, staged under the workspace, and retained in the turn checkpoint.

The boundary is deliberately narrower than “safe arbitrary code”

The Docker provider uses UID 1000, a read-only image filesystem, dropped capabilities, no privilege escalation, bounded resources and tmpfs, with no host or Docker-socket mounts. Networking defaults to none; the managed isolated option disables inter-container traffic on a pinned bridge.

But Agno's own documentation is explicit that this is for trusted teams, not hostile multitenancy. The image, Docker daemon, and administrator remain trusted. The isolated bridge does not by itself stop a sandbox from reaching services listening on the host; that requires deployment-level firewalling. The optional runtime HTTP transport uses a per-container bearer token, but the documented design still leaves that token recoverable from the exec-time environment of PID 1 and the supervisor by same-UID code. Its authority is scoped to that container, yet the caveat is real.

What I verified

I checked out the v3.1.4 tag at commit 12392259242c5940677424fec37955bd4d3e7249, installed the core package in a fresh Python 3.11 environment, and ran a focused attachment-boundary selection from the tagged repository. 45 tests passed. They covered canonical wire encoding, rejection of remote media references, count and byte limits, filename traversal handling, runtime-side validation, pre-write rejection, forwarding through sync and async coordinator paths, and inline image-type detection.

I deselected three local-path cases because this Windows host lacks os.O_NOFOLLOW, which the implementation intentionally requires for no-follow file opens. Broader checkpoint and runtime suites were not portable to this host: collection reached POSIX-only os.geteuid and fcntl. Docker is not installed here, so I did not reproduce container creation, Postgres coordination, checkpoint restore across generations, AgentCore, or live Claude/Codex turns. Upstream test logs describe those paths, but those results are not my observations.

That platform result is also a deployment clue. The package metadata says the project is OS-independent, but this new sandbox/checkpoint path expects POSIX filesystem and locking primitives. Operators should treat a Linux host as part of the current boundary, not an incidental implementation detail.

Why it matters

Most “sandboxed agent” claims stop at putting a process in a container. Agno 3.1.4 attempts the more difficult composition: one writer per session, explicit generation identity, checkpoint integrity, native-conversation continuity, idempotent submissions, and an atomic choice of the next recovery point.

The design does not eliminate trust; it makes trust and failure states more legible. The important advance is that a successful model turn is not enough to advance durable state. The system must first prove that the workspace and native harness state can become the next recoverable computer. That is the right direction for agents expected to survive restarts rather than merely finish demos.