xiry.

Development · Tip

Stateless Agent Architecture Patterns

Design pattern for disposable agent sandboxes using external history and presigned URLs.

From the Xiry library · Updated 11 October 2026

An architectural pattern from Browser Use detailing how to keep untrusted execution sandboxes completely disposable. By delegating conversation history management to a control plane and using presigned URLs for file storage, sandboxes can be killed or restarted anytime without credential exposure or state loss.

How it works

  • LLM calls: sandbox sends only new messages; control plane stores full conversation history in DB, reconstructs context per call, forwards to provider — kill and restart sandbox anytime, conversation resumes.
  • File sync: sandbox never holds AWS keys; it requests session-scoped presigned S3 URLs from POST /presigned-urls and uploads/downloads /workspace files directly.

What it's for

  • Isolate untrusted agent code execution without losing conversation context
  • Prevent sensitive cloud credentials from being exposed within agent sandboxes
  • Enable zero-downtime restarts and migration of execution environments during long tasks

Key points

  • Control plane stores full conversation history in a centralized database
  • Sandbox only emits delta messages, allowing the control plane to reconstruct LLM context
  • Arbitrary sandbox restarts without disrupting ongoing user conversations
  • Session-scoped presigned S3 URLs generated on demand to avoid sandbox AWS keys
  • Direct file synchronization between sandbox workspace and object storage

Pricing

Free

Details

Type
Tip
Category
Development
Topic
Agent Architecture
Open source
No
Platforms
other
For
AI engineers and systems architects building code execution environments
Tags
agents, sandboxing, architecture, security, llm

Why it was saved

  • @larsencc, 27 February 2026: Clean patterns for stateless sandboxes: LLM history owned by proxy, AWS credentials never reach the agent.

Related

Updated