Sidecars: A low-latency trust boundary for Sandboxes | Modal Blog

Introduced Sidecars, a new isolation primitive that runs alongside a main Sandbox on the same host. Sidecars provide a security boundary between trusted and untrusted code, enabling 3x faster communication (0.58ms p50, 1.4ms p99) compared to separate Sandboxes (2.6ms p50, 44ms p99). This allows for scenarios like injecting credentials, proxying traffic, redacting data, or running harness logic without requiring every operation to cross a remote service boundary. Sidecars are created dynamically via the SDK, share CPU/memory resources with the main Sandbox (up to 250 Sidecars per Sandbox), and have independent outbound network policies. A customer example from Ramp demonstrates using Sidecars to build a custom egress proxy for monitoring and controlling agent outbound traffic.