The agent-first cloud: why we built Managed Agents

The agent-first cloud: why we built Managed Agents | DigitalOcean

© 2026 DigitalOcean, LLC. Sitemap .

AI/ML

The agent-first cloud: why we built Managed Agents

By VInay Kumar

CPTO, Digital Ocean

Updated: September 25, 2026 9 min read

<- Back to blog home

Compute (EC2) opened the front door to the first generation cloud. Agents need something different: compute, inference, and data working as one. We built the cloud that delivers all three as one simple, intuitive developer experience for AI-natives.

Every era of the cloud has its own unit of work.

For the last twenty years, that unit was the virtual machine hour. Customers came for the compute, paid by the hour whether it was working or waiting, and every service that followed existed to drive more of it. Fourteen years ago our answer was a $5 Droplet, and a generation built on it because it was simple, and well-packaged.

Agents require that same simplicity, with a workload that no longer fits inside a VM.

An AI agent doesn’t run like a web server:

It thinks in tokens and acts in short bursts of compute. Then it waits—on reasoning from a model, a response from a tool, or approval from a human.

It might need four copies of itself this afternoon and none overnight. By tomorrow morning, it might need its working state back—on a different device, picked up by a different person, or another agent.

Its natural units are tokens consumed, microVM-seconds of real execution, and state that outlives the session.

Trading VM-hours for tokens and microVM-seconds sounds like a small shift. It isn’t. It changes how you architect a cloud, how you secure it, and how you bill for it.

This week, DigitalOcean Managed Agents entered public preview: sandbox, inference, and data as one runtime, built for tokens and bursty compute, on top of the Droplets, databases, and networking that already work.

Why now: the workload changed faster than the infrastructure

That gap didn’t open on its own. Three trends pulled the workload ahead of the infrastructure built to run it, and drove our decision to invest in this platform:

Tokens represent thought. An agentic task burns 5 to 30x the tokens of a chat interaction, and one ticket can fan out into a dozen model calls, a web search, a database query, and a pull request. Software economics are shifting from requests served to work completed, and completed work is paid for in tokens.

Builders are choosing open intelligence. Open-weight models now carry the majority of agent token load. Once a product finds its market, the team moves to open weights both to control unit costs and to actually own their intelligence (instead of renting it).

Teams building and running agents are drowning in complexity. After talking to dozens of founders and CTOs, I hear the same stack described differently: a harness on a laptop, sandboxes from one startup, inference from two more, storage at a hyperscaler, search from a sixth vendor—all held together with glue code. Nobody can accurately pinpoint the cost of a single run, how to secure it, or how to operate it at scale.

Managed Agents: everything an agent needs, tightly integrated

Managed Agents isn’t a sandbox product with add-ons. It’s where the three things an agent is made of finally live together:

The sandbox gives it hands: an isolated machine to execute code, drive a browser, and produce artifacts.

Inference gives it a brain: open-weight and frontier models served right next to the sandbox.

The data layer gives it memory: workspace state, checkpoints, databases, and retrieval that outlive the session.

Every handoff between sandbox, inference, and data is a function call, not a WAN hop.

Managed Agents: bring your agent and your spec; DigitalOcean runs the sandbox, the tools, the models, and the telemetry.

Three factors make that real:

DigitalOcean Harness Runtime is durable execution

Every session gets its own Firecracker microVM: its own kernel, hardware-level isolation, sub-second starts, and ~300ms resumes.

Sessions outlive your laptop. Close the lid, and the agent finishes in the cloud. Reattach from your phone or hand the live session to a teammate. Checkpoint a warmed-up session, fork it four ways, and keep the winner.

Bring Claude Code, Codex CLI, OpenCode, Hermes, LangGraph, or package your own authorized agent as a standard OCI image.

Action Gateway is governed action

One managed MCP endpoint to 16,000+ tools across 500+ providers, from GitHub and Stripe to your own MCP servers. This replaces the credential, retry, and permission plumbing you’d otherwise own.

It finds the right tool for your agent’s intent instead of dumping a catalog into the context window, repairs malformed calls, handles rate limits, and gates sensitive actions on human approval.

Importantly, credentials are brokered at execution time and never reach the model, the prompt, or the sandbox. The agent never sees the key .

Agent pricing finally matches the workload

Agents are bursty: a compile here, a test run there, with long waits on tokens and approvals in between. Most offerings provision a VM and bill it from boot to shutdown. DigitalOcean bills CPU per second of actual use at $0.044 per vCPU-hour and memory at $0.0095 per GB-hour, with snapshots at $0.05 per GiB-month.

How it’s different: one platform instead of six vendors

With no other choice, teams settled with stitching five or six vendors together. Six vendors means fifteen seams: each one is an integration you build, a credential you store, and a place where a trace dies. As a result, securing and operating that mesh becomes your team’s second job. Point solutions are excellent but partial, because most sandbox companies don’t run inference, and model companies don’t manage agent memory or observability. Hyperscalers offer everything, but it’s metered as a dozen line items with enterprise-grade complexity to match.

Fifteen seams to secure and operate, or six capabilities pre-wired around your agent.

Agents are the first workload that exercises every layer of a cloud in a single loop: they think, they act on real systems, they remember, and they improve. A cohesive platform designs for the loop itself—one architecture, not a stack of bundled parts.

Here’s what a cohesive architecture results in:

Accelerated development. Primitives arrive pre-integrated: the sandbox reaches the model router, the gateway reaches your tools, the workspace syncs to persistent storage. Your first session is one CLI...