Devin AI Cloud: Sandbox Architecture, Dedicated VPCs, and Outposts

How the Cloud Brain Directs Execution

The brain serves as Devin's central intelligence layer and resides permanently within Cognition's cloud. Architecturally, the brain is a stateless, compound AI system coordinating reasoning models, planning heuristics, and tool-dispatch algorithms. When an engineer provides a prompt or assigns an issue, the brain analyzes the repository structure, generates an execution plan, and decides which commands to run.

Because the brain is stateless, it does not permanently store the contents of your codebase. Instead, the brain communicates with the remote execution environment over an encrypted cross-tenant connection. When a session starts, the execution runtime establishes an outbound secure WebSocket connection over HTTPS on port 443 to an isolated container in Cognition's cloud tenant. All subsequent instructions, terminal inputs, file modifications, and diagnostic outputs travel exclusively across this authenticated channel. This design ensures that cognitive decision-making remains centralized while sensitive code execution stays confined to the designated runtime.

Inside the Devbox Virtual Environment

The Devbox is the virtual environment where Devin performs real software engineering work. Rather than operating in a limited container with mock interfaces, each Devbox provides a full virtual machine containing four primary components:

• A Linux shell for running compilers, package managers, custom test runners, and background daemons.
• A headless Chromium browser for testing front-end web applications, verifying UI flows, and inspecting DOM structures.
• A code editor environment for reading source trees, creating new files, and applying granular diffs.
• A Git execution client for cloning branches, committing progress, and managing pull requests.

Every Devin session provisions an isolated Devbox instance. This ensures that memory, temporary disk files, and background processes from one task cannot bleed into another. When a task finishes or the user terminates the session, the Devbox VM is recycled. While this complete session isolation guarantees strong security, it also means the Devbox filesystem is ephemeral. Any data, build outputs, or documentation not explicitly committed to Git or pushed to external storage will disappear when the VM shuts down.

Multi-Tenant Enterprise Cloud

The Enterprise Cloud model is the default configuration for most development teams. In this tier, both the reasoning brain and the execution Devboxes run inside Cognition's cloud infrastructure. Customer data remains encrypted in transit and at rest, and each session executes on an isolated virtual machine.

This model is ideal when your source code repositories reside on public cloud services like GitHub.com, GitLab.com, or Azure DevOps Cloud. If your internal build tools support IP allowlisting, Cognition provides static egress IP addresses that your firewalls can permit. Enterprise Cloud requires zero infrastructure provisioning, allowing developers to start working with Devin in minutes.

Customer Dedicated Deployments

Strategic enterprise organizations often maintain strict policies against connecting development tooling across the public internet. Customer Dedicated Deployments solve this by hosting Devin's execution environment in an auto-scaling, single-tenant VPC managed by Cognition.

In this architecture, Devin Customer Dedicated Deployments isolate execution within a single-tenant VPC that connects to internal customer networks via AWS PrivateLink or IPSec tunnels. This private connection allows Devin's Devbox to interact directly with internal code repositories (such as GitHub Enterprise Server or GitLab self-hosted), private package registries (such as JFrog Artifactory or AWS CodeArtifact), and internal testing databases without exposing network traffic to the public internet.

Self-Hosted Devin Outposts

For organizations that require absolute control over where code executes, Devin Outposts moves the entire Devbox runtime onto customer-managed infrastructure. While the reasoning brain continues to run in Cognition's cloud, command execution, file modifications, and test runs take place entirely on machines you operate.

Outposts allow teams to run Devin on internal Kubernetes clusters, cloud virtual machines in your own cloud accounts, or specialized on-premises hardware. This configuration provides total control over local network boundaries and hardware profiles while maintaining access to Devin's cloud intelligence.

AWS PrivateLink and Cross-Tenant Peering

AWS PrivateLink is the preferred connectivity mechanism for Customer Dedicated Deployments. Rather than routing traffic over public internet routes, PrivateLink establishes private, unidirectional endpoint connections between your Amazon VPC and Cognition's dedicated tenant VPC.

By utilizing PrivateLink, traffic between Devin's Devboxes and your internal infrastructure remains contained within the AWS network backbone. PrivateLink eliminates the need for internet gateways, public IP addresses, or complex firewall traversal rules on your internal resources. For environments running on alternative cloud providers or on-premises data centers, Cognition also supports site-to-site IPSec VPN tunnels.

Connecting through PrivateLink also ensures that internal DNS resolution works as expected. Devin's Devboxes can resolve internal hostnames for code repositories, staging APIs, and internal artifact registries seamlessly, allowing the agent to function exactly like an engineer connected to the corporate intranet.

Outbound Egress and Workstation Connectivity

Autonomous agents require broad internet access to perform routine development tasks, including fetching open-source libraries from npm, PyPI, or Maven Central. Security architects must balance this requirement against data exfiltration risks.

In a Dedicated VPC deployment, outbound internet egress is managed through enterprise NAT gateways and proxy servers. This setup allows security teams to inspect outbound network traffic, enforce domain allowlists, and log every external connection initiated during an agent run.

In addition to backend VPC routing, IT teams must ensure proper connectivity for end-user workstations. Developers interacting with Devin sessions load the interactive IDE (a VS Code web frontend) and Desktop browser viewer via iframes embedded in the web application. These tools stream data directly from *.devinapps.com over HTTPS on port 443. Corporate firewalls and SSL-inspecting proxies must allow traffic to this wildcard domain; otherwise, developers will see blank frames when attempting to inspect Devin's terminal and desktop sessions.

Outbound-Only Worker Architecture

The operational model of Devin Outposts relies on named session queues. An organization creates an outpost queue in the Devin web console, assigning it an identifier such as ml-gpu-workers or internal-dev-cluster. Private machines register to this queue by running the Devin worker service via the CLI:

devin worker start --outpost=<outpost_name>

A critical security benefit of this architecture is network directionality. Devin Outposts require only outbound HTTPS connections without inbound ports or VPN tunnels. The worker machine polls Devin Cloud over HTTPS port 443, listening for pending tasks in its assigned queue. When a user assigns a task to the outpost, the worker claims the job and executes all tool calls locally.

Because execution occurs directly on the host machine, the host must have necessary system dependencies installed:

• Git must be installed and accessible on PATH for repository operations.
• FFmpeg enables Devin to capture screen recordings of browser interactions and test executions.
• Google Chrome or Chromium enables browser automation; administrators can point to custom binary locations using the DEVIN_CHROME_PATH environment variable.
• A display server, such as an active X session or Xvfb on Linux, is required if the agent uses mouse and keyboard computer-use features.
• Passwordless sudo can be granted to allow Devin to install missing system packages, but this should only be configured on disposable machines recycled after each run.

Managing Outposts at Scale with Kubernetes

Running individual worker processes on static virtual machines is straightforward for small teams, but large organizations require automated scaling. Managing dozens of static machines leads to resource underutilization and potential environment drift between sessions.

To automate fleet operations, engineering teams deploy orchestrators that watch the Outpost queue and provision worker instances dynamically. Cognition maintains an open-source Kubernetes operator, devin-outpost-k8s, designed specifically for this workflow. The operator monitors the outpost queue, detects pending sessions, spins up an isolated worker pod on a Kubernetes cluster, executes the task, and tears down the pod upon session completion.

This dynamic lifecycle provides clean, immutable environments for every run. Pod-level isolation guarantees that temporary files, residual dependencies, and intermediate build artifacts do not carry over between tasks, delivering enterprise-grade isolation on your own infrastructure.

Evaluating Storage Alternatives for Agentic Workflows

Engineering teams typically consider three storage strategies for retaining artifacts across autonomous coding runs:

• Ephemeral Local Disks: Relying on the Devbox or worker filesystem is fast during execution but results in complete data loss once the container terminates. It cannot support multi-session development workflows.
• Standard Object Storage (AWS S3 or Google Cloud Storage): Cloud object stores provide durability for raw binary files, but they lack human-friendly interfaces. Object stores do not offer native document preview, real-time collaboration, or automated semantic search. Furthermore, writing custom S3 upload scripts inside agent prompts requires managing access keys and increases prompt token overhead.
• Intelligent Cloud Workspaces: Fast.io provides a purpose-built workspace platform designed for collaboration between human engineers and autonomous agents. It combines persistent file storage with automatic semantic indexing and Model Context Protocol (MCP) tooling.

Shared Workspaces and MCP Coordination for Devin Workflows

Fast.io functions as the persistent workspace layer that bridges ephemeral Devin sessions with human development teams. By connecting Devin to Fast.io via the Model Context Protocol, agents can store, retrieve, and organize files across sessions without cluttering Git repositories. Teams can explore setup details on the Fast.io storage for agents hub, review agent onboarding documentation at fast.io/llms.txt, or inspect developer tooling in the /storage-for-agents/ overview.

Fast.io provides distinct architectural advantages for agentic development workflows:

• MCP-Native Access: Fast.io exposes an action-based MCP toolset accessible via Streamable HTTP at https://mcp.fast.io/mcp or legacy SSE at https://mcp.fast.io/sse. Devin sessions authenticating with an API key can connect to https://mcp.fast.io/mcp/key using standard Bearer token authorization, as detailed in the storage for agents guide.
• Per-File Version History: Every artifact, documentation draft, or configuration file saved to Fast.io maintains complete version history. If an agent modifies a file during an iterative refactor, developers can inspect prior versions and restore earlier states instantly.
• Append-Only Audit Log: Every file creation, read, download, and modification is recorded in an immutable audit log, providing enterprise compliance teams with full traceability of agent actions.
• Granular Permissions: Permissions can be scoped at the organization, workspace, folder, or file level. This allows administrators to grant Devin write access to an output directory while restricting its access to sensitive production documents.
• Metadata Views: Fast.io includes Metadata Views, which automatically extract typed structured schemas (such as text, integers, dates, and JSON) from generated reports, test summaries, and log files into a sortable spreadsheet view without manual OCR rules.
• Intelligence Mode: Fast.io automatically indexes uploaded workspace files for semantic search and Retrieval-Augmented Generation (RAG). Devin can query workspace knowledge bases, retrieve relevant context with citations, and answer architectural questions grounded in verified documentation.
• Collaborative Notes: Human developers and Devin can collaborate in real time within Collaborative Notes, drafting specifications and review summaries in a shared document.
• Ownership Transfer: An autonomous agent can initialize a complete project workspace, upload all compiled assets and documentation, and transfer ownership to a human team lead while retaining administrative access to continue future work.

Every organization starts with a 14-day free trial, which requires a credit card. Paid subscription plans, detailed on the pricing page, include Starter at $29/mo, Business at $99/mo, and Growth at $299/mo. To ensure reliable operations, Fastio runs on cloud infrastructure partners, including Google Cloud Platform and Cloudflare, that are certified to industry-leading security standards.