Rivet open-sources actor runtime that keeps AI agents out of sandboxes

Rivet is an open-source project (rivet-dev/rivet, Apache 2.0) built around Rivet Actors: long-lived processes with in-memory state, a SQLite database, WebSockets and scheduling. The README says you can create one Actor for each agent, user, session or tenant. Rivet describes itself as a general actor platform at its core, with nothing specific to agents, though it ships an optional agent library that runs Pi Durable, a ready-made agent, on Actors.

The pitch is a different place to run the agent loop. According to the README, most of an agent's time goes to waiting on inference, so an agent loop inside a sandbox pays for a whole VM that sits mostly idle at low CPU usage. Rivet instead runs the loop outside the sandbox, which the README says is often called "separating the head from the hands." The agent's state, memory and context live in the Actor, and it reaches a sandbox through tools only when it needs to run code. The README says this uses a fraction of the memory and limits the blast radius and trust boundary of the code the agent runs.

The headline figures are the project's own. Actors share a node process instead of each booting a sandbox, which the README says lets one server hold hundreds of thousands of them. It claims 72 KB of RAM per Actor and a 4.99 ms p99 cold start, with no image pull and no VM boot. All data lives in S3, so a cluster, it says, scales to billions of Actors. Idle Actors hibernate, cost nothing and wake on the next request with nothing lost. SQLite backed by S3 is quoted at 1.07 ms durable writes and 1.36 ms reads at p99, for about 10.4× less than replicated SSD storage. In the README's sandbox comparison, a Rivet Actor takes 72 KB and 4.99 ms p99 to start, versus 512 MiB and 1.70 s for a sandbox.

The benchmark notes explain where the numbers come from. Rivet's figures come from its published Rivet Actors vs Cloudflare Durable Objects benchmark, run on Rivet 3.0.3, with raw samples and reproduction scripts in that repository. The sandbox figures are for E2B: 512 MiB is its default memory allocation per E2B's billing documentation as of November 4, 2026, and 1.70 s is the p99 cold start from ComputeSDK's October 30, 2026 sandbox benchmark. The storage cost compares S3 Standard with three Amazon EBS gp3 copies at AWS list prices.

The README argues agents often do not need a sandbox at all, only to run code they write. It lists three patterns. Agents with tools only: many agents, such as customer support or personal agents, need just tool calls, MCP and APIs. Agents with a lightweight sandbox: agentOS offers Linux-compatible sandboxing for JS and Python using V8 and WebAssembly, with full POSIX filesystems, networking stacks and process trees, and the README says it covers most workloads such as data analysis, file processing, evals and code mode. Agents with a full sandbox: keep your existing provider and expose its shell and filesystem as tools, with the Actor reattaching to it across sleeps and restarts.

The README also positions Rivet against Cloudflare Durable Objects, calling it an open-source alternative that is easy to self-host. It says Rivet has no 128 MB memory cap, offers bottomless storage instead of a 10 GB SQLite limit, does not randomly evict Actors, and runs on vanilla Node.js or Bun rather than a custom runtime. It adds built-in connection handling, event broadcasting, durable scheduling and cron, Vitest support, lifecycle hooks for draining and control over Actor upgrades. Against Erlang, Akka and Orleans, it says it implements the virtual actor pattern, closest to Orleans, with SQLite persistence instead of simple JSON stores.

On operations, an object storage bucket is the only dependency: no Postgres, FoundationDB or NATS. It works with Amazon S3, Google Cloud Storage, Azure Blob Storage and S3-compatible stores such as MinIO, Cloudflare R2 or Hetzner Object Storage, and a local filesystem backend exists for trying it on one machine. Nodes can be deployed on Docker Compose, Kubernetes, VMs and bare metal, Hetzner, AWS ECS, Railway or Render. Rivet Cloud offers fully managed, dedicated clusters on AWS or GCP in any region, and BYOC is available, including air-gapped environments. Other listed features include fault tolerance (Actors move to another node with state intact), scoped JWTs, Actor-to-Actor calls, end-to-end type safety, OpenTelemetry, and libraries for workflows and Dynamic Apps (preview). The README includes a minimal TypeScript agent: one Actor per agent with its own SQLite message table, in-memory presence state, and WebSocket streaming of model tokens to every connected client.

Key facts

Rivet Actors are long-lived processes with in-memory state, SQLite, WebSockets and scheduling, one per agent, user, session or tenant; the project is Apache 2.0 and self-hostable.
The README claims 4.99 ms p99 cold starts and 72 KB of RAM per Actor, versus 512 MiB (E2B default memory) and 1.70 s p99 (ComputeSDK benchmark) for a sandbox.
All data lives in S3 and an object storage bucket is the only dependency; SQLite on S3 is quoted at 1.07 ms writes and 1.36 ms reads at p99, about 10.4× cheaper than replicated SSD at list prices.
The agent loop runs outside the sandbox and calls into one through tools only to run code; agentOS offers a lighter V8 and WebAssembly sandbox for most workloads.
The benchmark figures are Rivet's own, run on Rivet 3.0.3, and the README frames Rivet as an open-source alternative to Cloudflare Durable Objects.

Why it matters

Many agent platforms give each agent its own sandbox VM, even though, as the README puts it, agents spend most of their time waiting on inference. Rivet's answer is to hold the agent's state in a cheap, durable process and reach for a sandbox only when code must run. If the quoted figures hold, that moves the unit of an agent from a 512 MiB VM that starts in about 1.70 s to a 72 KB Actor that starts in 4.99 ms at p99. Putting all state in S3 also means no database or message bus to operate.

Who it affects

Developers building agents that must keep memory across restarts or serve many users at once, including multiplayer setups where several clients watch one agent live. It also speaks to teams that want an open-source, self-hostable alternative to Cloudflare Durable Objects, or that want to keep their existing sandbox provider and call it as a tool. Because Rivet is a general actor platform, collaborative editing and workflow use cases are covered too.

How to use it

Rivet is open source under Apache 2.0 and fully self-hostable. The control plane runs anywhere a container runs, with guides for Docker Compose, Kubernetes, VMs and bare metal, Hetzner, Railway, Render and AWS ECS, and it needs only an object storage bucket. You write Actors in TypeScript with the rivetkit package and call them from a typed client. The README suggests pasting a prompt into Claude Code, Cursor, Codex or another coding agent: run npx skills add rivet-dev/skills, then ask what to build. For a ready-made agent, use Pi Durable. Rivet Cloud is the managed option and BYOC is offered; no Rivet Cloud pricing is given.

How solid is it

The source is the project's own README, so the claims are vendor claims. The benchmark figures for Rivet are the project's own, and the source does not mention independent verification of them. It says the raw samples and reproduction scripts are published. The sandbox comparison uses a single provider (E2B) and does not say these figures hold for other providers. The 10.4× storage figure is a list-price calculation (S3 Standard vs three EBS gp3 copies), not a measured bill. The source does not say how many production users or customers Rivet has.

Risks and caveats

The source does not state the number of Actors per server beyond "hundreds of thousands" and "billions" per cluster, and no test of billions of Actors is described. The Cloudflare comparison is the vendor's framing, and the Durable Objects benchmark numbers themselves are not given in the source. Running the loop outside the sandbox still leaves the question of where untrusted code runs: for that the README points to agentOS or an existing sandbox provider. Dynamic Apps is a preview feature.

“separating the head from the hands”

— Rivet README, on what running the agent loop outside the sandbox is often called