Modal vs semantic
Modal Sandboxes run on gVisor by default, or optionally as VMs with a full Linux kernel; GPU sandboxes use gVisor. [1] They run in Modal's cloud.
Modal can block all egress or allow CIDRs and domains [2], and an outbound policy proxy injects secrets into HTTPS requests so they never appear in the sandbox environment. [3] Semantic adds per-path, per-repo and per-host permissions and a tamper-evident agent log, on hosts you run.
| Modalmanaged cloud | Semantic (smx)microVM + policy on your machines | |
|---|---|---|
| Isolation | gVisor by default; optional VMs [1] | One microVM per agent, own kernel |
| Where it runs | Modal cloud [1]; self-hosting — | Managed private beta; on-prem for enterprise (contact us) |
| Egress rules | Block-all, CIDR allowlist, domain allowlist (beta) [2] | Security profiles enforced by host firewall; metadata and link-local always closed |
| Credentials kept out | Outbound proxy injects headers into HTTPS requests [3] | Git tokens, SSH keys and model sign-ins stay on the host |
| File, Git, SSH permissions | not documented | Per path, repo, branch and SSH host; deny beats allow; enforced on the host |
| Tamper-evident agent log | not documented | Hash-chained log of runs, events and refusals; read with smx agent logs |
| Snapshots, pause/resume | Filesystem, directory and memory (experimental) snapshots [4] | Snapshot, pause and resume with memory, disk and running processes |
| Local hosts (Linux / WSL2 / macOS) | not documented | Linux (KVM) and Windows via WSL2; macOS planned |
| License | not documented | Proprietary (private beta) |
Which one fits
When Modal fits better
- Your agents need GPUs in the sandbox. [1]
- You want filesystem, directory and memory snapshots in a managed cloud. [4]
When Semantic fits better
- Code, data and credentials must stay in your environment; on-prem is available for enterprise (contact us).
- Agents work on your repos and you need branch-level Git and per-path file permissions enforced outside the agent.
- You need a tamper-evident log of what the agent did inside the sandbox, including refusals.
Isolation models
Modal's default gVisor runtime intercepts system calls in user space; its VM option gives a full kernel for Docker, FUSE and nested cgroups. [1] Semantic gives every agent its own microVM and kernel.
Questions
Can Modal Sandboxes run on my hardware?
Modal's docs describe its managed cloud only. [1] Semantic is a managed private beta, with on-prem for enterprise (contact us).
Does Modal keep secrets out of the sandbox?
Yes, with secret injection through an outbound proxy. [3] Plain environment-variable secrets are also available.
Sources
- Modal Sandboxes guide · last verified 2026-10-27
- Modal sandbox networking · last verified 2026-10-27
- Modal sandbox secret injection · last verified 2026-10-27
- Modal sandbox snapshots · last verified 2026-10-27