{ "generated_from": "data/sandboxes.yaml", "count": 97, "presets": [ { "name": "RL training", "description": "Fast resets, GPU + parallel scale, self-hosted orchestration, HPC/Slurm", "entries": [ "Firecracker", "Zeroboot", "mitos", "CubeSandbox", "Modal", "openkruise/agents", "OpenSandbox", "agent_sandbox" ] }, { "name": "Capability evaluation", "description": "Syscall observability, credential isolation, audit trails, intervention, reproducibility", "entries": [ "gVisor", "nono", "cleanroom", "sandcat", "CubeSandbox", "sevorix-lite", "loop", "agent-glovebox", "Firecracker", "Fly Sprites", "gondolin" ] }, { "name": "Adversarial red-teaming", "description": "Hardware VM containment, escape detection, network monitoring", "entries": [ "Firecracker", "Kata Containers", "cleanroom", "brood-box", "CubeSandbox", "gVisor", "sevorix-lite", "nono", "code-on-incus", "agent-glovebox", "sandcat", "Anthropic sandbox-runtime (srt)" ] } ], "entries": [ { "name": "E2B", "category": "cloud-managed", "maintainer": "E2B", "open_source": true, "license": "Apache-2.0", "url": "https://e2b.dev", "repo_url": "https://github.com/e2b-dev/E2B", "description": "Cloud sandbox platform for AI agents using Firecracker microVMs via API/SDK.", "isolation_type": [ "microvm" ], "capabilities": [ "Firecracker microVM isolation", "~150ms startup", "Filesystem isolation", "Network control", "Python/JS/TS SDKs", "Custom templates" ], "requirements": [ "Cloud-hosted managed service", "Free tier available" ], "limitations": [ "24-hour session limit", "Cloud-only", "Ephemeral by default", "No GPU support" ], "notes": "One of the earliest and most widely adopted agent sandbox platforms. Docker MCP Catalog partnership.", "isolation_tier": "microvm", "adoption_effort": "sign-up", "deployment_model": "cloud" }, { "name": "Daytona", "category": "cloud-managed", "maintainer": "Daytona", "open_source": true, "license": "Apache-2.0", "url": "https://www.daytona.io", "repo_url": "https://github.com/daytonaio/daytona", "description": "Docker/OCI container-based cloud sandboxes with native state management.", "isolation_type": [ "container" ], "capabilities": [ "Docker container isolation", "<60ms provisioning", "Configurable resources", "State management (stop/resume/archive)", "Python/JS/TS SDKs" ], "requirements": [ "Cloud-hosted managed service", "Usage-based pricing" ], "limitations": [ "Container-based (shared kernel, weaker isolation than microVMs)", "Newer platform" ], "notes": "Pivoted from CDE space (Feb 2025). $31M Series A (Feb 2026). State management (pause/resume) is a key differentiator vs. ephemeral-only platforms.", "isolation_tier": "container", "adoption_effort": "sign-up", "deployment_model": "cloud" }, { "name": "Modal", "category": "cloud-managed", "maintainer": "Modal Labs", "open_source": false, "license": null, "url": "https://modal.com/products/sandboxes", "repo_url": null, "description": "Serverless cloud platform with sandbox product and best-in-class GPU support.", "isolation_type": [ "microvm" ], "capabilities": [ "Sub-second starts", "GPU workloads", "Network tunnels", "Per-sandbox egress policies", "50k+ concurrent sessions" ], "requirements": [ "Cloud-hosted", "Python SDK", "Usage-based pricing" ], "limitations": [ "Closed source", "Cloud-only", "Python-centric SDK" ], "notes": "Only major sandbox platform with GPU support — unique differentiator for ML/AI workloads that need compute.", "isolation_tier": "microvm", "adoption_effort": "sign-up", "deployment_model": "cloud" }, { "name": "Runloop", "category": "cloud-managed", "maintainer": "Runloop", "open_source": false, "license": null, "url": "https://runloop.ai", "repo_url": null, "description": "Enterprise-grade sandbox infrastructure (Devboxes) with SOC 2 compliance and 10k+ parallel instances.", "isolation_type": [ "microvm" ], "capabilities": [ "Blueprints and Snapshots", "Isolated cloud dev environments", "SOC 2 compliance", "High concurrency (10k+ parallel)" ], "requirements": [ "Cloud-hosted", "Enterprise pricing" ], "limitations": [ "Closed source", "Enterprise-focused" ], "notes": "Enterprise compliance focus (SOC 2) differentiates from developer-oriented alternatives. GA May 2025.", "isolation_tier": "microvm", "adoption_effort": "sign-up", "deployment_model": "cloud" }, { "name": "Northflank", "category": "cloud-managed", "maintainer": "Northflank", "open_source": false, "license": null, "url": "https://northflank.com", "repo_url": null, "description": "Production-grade sandbox infrastructure using Kata Containers and gVisor at 2M+ isolated workloads/month.", "isolation_type": [ "kata", "gvisor" ], "capabilities": [ "MicroVM via Kata + gVisor", "Unlimited session duration", "Any OCI image", "BYOC (bring your own cloud) deployment", "Resource limits", "Network controls" ], "requirements": [ "Cloud-hosted or BYOC", "Paid platform" ], "limitations": [ "Closed source", "More complex setup than simpler platforms" ], "notes": "BYOC option is unusual in this space — most cloud sandboxes are single-provider. Production-proven at scale (2M+ workloads/month).", "isolation_tier": "microvm", "adoption_effort": "sign-up", "deployment_model": "cloud" }, { "name": "Fly Sprites", "category": "cloud-managed", "maintainer": "Fly.io", "open_source": false, "license": null, "url": "https://sprites.dev", "repo_url": null, "description": "Persistent Firecracker microVMs for AI agent sessions with 100GB NVMe per sprite.", "isolation_type": [ "microvm" ], "capabilities": [ "Firecracker microVM isolation", "Persistent 100GB NVMe storage", "Checkpoint/restore (~300ms warm)", "Stateful across sessions", "~$0.07/CPU-hour" ], "requirements": [ "Cloud-hosted", "API access", "1-12s cold start" ], "limitations": [ "Cold starts slower than E2B", "Newer product (Jan 2026)" ], "notes": "Persistence is the key differentiator — most sandboxes are ephemeral. Checkpoint/restore enables warm resumption of long-running agent sessions.", "isolation_tier": "microvm", "adoption_effort": "sign-up", "deployment_model": "cloud" }, { "name": "CodeSandbox SDK", "category": "cloud-managed", "maintainer": "CodeSandbox", "open_source": false, "license": null, "url": "https://codesandbox.io/sdk", "repo_url": null, "description": "SDK for giving agents sandboxed MicroVM environments with parallel execution support.", "isolation_type": [ "microvm" ], "capabilities": [ "MicroVM isolation", "Parallel agent execution", "Web-dev environments", "File operations", "Port forwarding" ], "requirements": [ "Cloud-hosted", "SDK integration" ], "limitations": [ "Primarily web-dev focused" ], "notes": "Well-established brand from the browser IDE space, expanding to agent use.", "isolation_tier": "microvm", "adoption_effort": "sign-up", "deployment_model": "cloud" }, { "name": "Bunnyshell AI Sandboxes", "category": "cloud-managed", "maintainer": "Bunnyshell", "open_source": false, "license": null, "url": "https://www.bunnyshell.com/ai-sandbox-environments/", "repo_url": null, "description": "Firecracker sandboxes with ~100ms cold starts and MCP Server integration for Claude Code/Cursor/Windsurf.", "isolation_type": [ "microvm" ], "capabilities": [ "Firecracker isolation", "~100ms cold starts", "Multi-language support", "MCP server integration", "Snapshots", "SDK" ], "requirements": [ "Cloud-hosted", "Paid tiers" ], "limitations": [ "AI sandbox is a newer product line" ], "notes": "MCP server integration is notable — direct plugin for Claude Code, Cursor, and Windsurf.", "isolation_tier": "microvm", "adoption_effort": "sign-up", "deployment_model": "cloud" }, { "name": "Vercel Sandbox", "category": "cloud-managed", "maintainer": "Vercel", "open_source": false, "license": null, "url": "https://vercel.com", "repo_url": "https://github.com/vercel/sandbox", "description": "Firecracker microVM sandboxes for untrusted code, powering v0's code generation runtime.", "isolation_type": [ "microvm" ], "capabilities": [ "Firecracker microVMs", "Node.js + Python support", "Up to 45min execution", "Up to 8 vCPUs / 2GB per vCPU" ], "requirements": [ "Vercel account", "Cloud-hosted" ], "limitations": [ "Node.js and Python only", "45-minute maximum execution", "Tightly coupled to Vercel ecosystem" ], "notes": "Tightly integrated with Vercel deployment pipeline and v0.", "isolation_tier": "microvm", "adoption_effort": "sign-up", "deployment_model": "cloud" }, { "name": "Superserve", "category": "cloud-managed", "maintainer": "superserve-ai", "open_source": true, "license": "Apache-2.0", "url": "https://github.com/superserve-ai/superserve", "repo_url": "https://github.com/superserve-ai/superserve", "description": "Cloud sandbox platform using Firecracker microVMs with TypeScript and Python SDKs.", "isolation_type": [ "microvm" ], "capabilities": [ "Firecracker microVM isolation", "TypeScript and Python SDKs", "Managed cloud service" ], "requirements": [ "Cloud-hosted (superserve.ai sign-up)" ], "limitations": [ "Beta", "SDK is open source but sandbox backend is private" ], "notes": "Firecracker-based like E2B. SDK is open source (Apache-2.0) but the sandbox backend infrastructure is in a separate private repo. Beta — evaluate maturity before committing to production use.", "isolation_tier": "microvm", "adoption_effort": "sign-up", "deployment_model": "cloud" }, { "name": "Koyeb", "category": "dev-environment", "maintainer": "Koyeb", "open_source": false, "license": null, "url": "https://www.koyeb.com", "repo_url": null, "description": "Serverless platform with container-based sandbox capabilities and auto-scaling.", "isolation_type": [ "container" ], "capabilities": [ "Container isolation", "Auto-scaling", "CI/CD integration" ], "requirements": [ "Cloud-hosted", "Usage-based pricing" ], "limitations": [ "Not agent-specific", "General-purpose serverless platform" ], "notes": "General-purpose serverless platform, not purpose-built for agents, but usable for agent isolation out of the box with standard container workflows.", "isolation_tier": "container", "adoption_effort": "sign-up", "deployment_model": "cloud" }, { "name": "Cloudflare Dynamic Workers", "category": "cloud-managed", "maintainer": "Cloudflare", "open_source": false, "license": null, "url": "https://developers.cloudflare.com/sandbox/", "repo_url": null, "description": "V8 isolate-based sandboxing at the edge, claiming 100x faster and more memory-efficient than containers.", "isolation_type": [ "v8-isolate" ], "capabilities": [ "V8 isolate isolation", "Millisecond startup", "MB-level memory per isolate", "globalOutbound for HTTP interception", "Credential injection without agent visibility" ], "requirements": [ "Cloudflare Workers paid plan", "$0.002/unique Worker/day (waived during beta)" ], "limitations": [ "JS/TS only (V8 runtime)", "Not for arbitrary Linux binaries", "Weaker isolation than microVMs" ], "notes": "Unique edge-first approach using V8 isolates instead of containers/VMs. Credential injection without agent visibility is a strong security feature. Open beta early 2026.", "isolation_tier": "wasm", "adoption_effort": "sign-up", "deployment_model": "cloud" }, { "name": "Claude Code Sandbox", "category": "agent-integrated", "maintainer": "Anthropic", "open_source": false, "license": null, "url": "https://code.claude.com/docs/en/sandboxing", "repo_url": null, "description": "Native OS-level sandboxing using bubblewrap (Linux) and Seatbelt/sandbox-exec (macOS), reducing permission prompts by 84%.", "isolation_type": [ "user-namespace", "seatbelt" ], "capabilities": [ "Filesystem isolation (CWD read/write, block writes elsewhere)", "Network isolation (proxy-based domain allowlisting)", "OS-level enforcement" ], "requirements": [ "Claude Code CLI", "macOS or Linux" ], "limitations": [ "dangerouslyDisableSandbox escape hatch can be triggered by agent itself", "macOS sandbox-exec deprecated by Apple", "Shared kernel" ], "notes": "Demonstrated escape by Ona (March 2026) via dangerouslyDisableSandbox flag. Uses bubblewrap on Linux, Seatbelt on macOS — different mechanisms per OS.", "isolation_tier": "process", "adoption_effort": "zero-config", "deployment_model": "built-in" }, { "name": "OpenAI Codex Sandbox", "category": "agent-integrated", "maintainer": "OpenAI", "open_source": false, "license": null, "url": "https://developers.openai.com/codex/concepts/sandboxing", "repo_url": null, "description": "Two modes: cloud (isolated containers, internet disabled during agent phase) and local CLI (Landlock + seccomp on Linux).", "isolation_type": [ "container", "landlock", "seccomp" ], "capabilities": [ "Cloud: isolated containers, two-phase runtime (setup with network, then offline agent)", "Cloud: per-project network lists, secrets removed before agent", "Local: Landlock + seccomp, workspace-only writes" ], "requirements": [ "Cloud: OpenAI account + GitHub", "Local: Linux kernel 5.13+" ], "limitations": [ "Cloud requires GitHub integration", "Local is Linux-only", "Network disabled by default in agent phase" ], "notes": "Only major agent with sandboxing enabled by default. Two-phase model (online setup, offline agent) is a unique security architecture — the agent never has network access during execution.", "isolation_tier": "container", "adoption_effort": "zero-config", "deployment_model": "built-in" }, { "name": "pi-sandbox", "category": "agent-integrated", "maintainer": "carderne (Chris Arderne)", "open_source": true, "license": "MIT", "url": "https://github.com/carderne/pi-sandbox", "repo_url": "https://github.com/carderne/pi-sandbox", "description": "Sandbox extension for the pi coding agent that wraps bash subprocesses with macOS sandbox-exec / Linux bubblewrap and intercepts read/write/edit tool calls with allow/deny lists and interactive permission prompts.", "isolation_type": [ "seatbelt", "user-namespace" ], "capabilities": [ "macOS Seatbelt (sandbox-exec) for bash subprocesses", "Linux bubblewrap for bash subprocesses", "In-process policy enforcement for read/write/edit tools", "Four-tier permission persistence (Abort / session / project / global)", "Asymmetric read/write rule precedence (denyWrite is hard-block, denyRead is overridable default)", "Project config via .pi/sandbox.json, global via ~/.pi/agent/sandbox.json", "/sandbox slash command in pi" ], "requirements": [ "pi coding agent", "macOS or Linux", "Anthropic sandbox-runtime", "ripgrep" ], "limitations": [ "Specific to pi agent only", "In-process file tool policy is not OS-enforced", "README acknowledges example browser config opens \"significant security loopholes\"" ], "notes": "Thin agent-specific layer atop Anthropic sandbox-runtime, demonstrating that runtime as a reusable library for non-Anthropic agents. Differentiator over Claude Code's sandbox is the four-tier permission persistence with explicit asymmetric precedence between read and write rules.", "isolation_tier": "process", "adoption_effort": "install", "deployment_model": "built-in" }, { "name": "loop", "category": "agent-integrated", "maintainer": "radutopala (Radu Topala)", "open_source": true, "license": "Apache-2.0", "url": "https://github.com/radutopala/loop", "repo_url": "https://github.com/radutopala/loop", "description": "Multi-platform (desktop, Slack, Discord) Claude Code runner that traps syscalls inside Docker containers via seccomp RET_USER_NOTIF and routes each trap to a three-button chat approval card, with a body-filtering Docker API proxy as a second gate.", "isolation_type": [ "container", "seccomp" ], "capabilities": [ "Hand-written seccomp BPF filter via RET_USER_NOTIF traps 12 syscalls (connect, execve, execveat, openat, openat2, renameat2, unlinkat, linkat, symlinkat, fchmodat, fchownat, mkdirat)", "ERRNO-denies io_uring family (closes seccomp bypass)", "PR_SET_NO_NEW_PRIVS + TSYNC; arch-locked with kill-process on mismatch", "Trap blocks in kernel's seccomp_do_user_notification until chat click resolves", "Three-button approval cards (once / session / deny / deny-session) routed to Slack or Discord", "Per-container Approval Manager caches session decisions; rate limits", "Docker HTTP proxy with JSONPath-lite body filtering on POST /containers/create", "Symlink-resolved bind-mount source paths to defeat /workdir/link bind-escape", "Bundles Claude Code; desktop, Slack, and Discord front-ends" ], "requirements": [ "Linux (seccomp RET_USER_NOTIF is Linux-only)", "Docker" ], "limitations": [ "Solo maintainer; project ~3 months old at time of inclusion", "Approval UX depends on a responsive operator or session-cached \"allow\"", "macOS and Windows not supported" ], "notes": "Differentiator vs commodity Docker-tier entries is the seccomp RET_USER_NOTIF + chat-routed HITL approval stack: kernel-parked traps resume only on SECCOMP_IOCTL_NOTIF_SEND with the CONTINUE flag, with path arguments read via process_vm_readv and symlink-resolved before the chat card is rendered. README credits agentsh for design inspiration; novel axis here is HITL governance via team chat rather than CLI prompts. ~11,500 LOC with a 1:1 test ratio despite low star count — code is production-grade on the security-critical paths.", "isolation_tier": "process", "adoption_effort": "install", "deployment_model": "local" }, { "name": "Docker Sandboxes", "category": "standalone", "maintainer": "Docker", "open_source": false, "license": null, "url": "https://docs.docker.com/ai/sandboxes/", "repo_url": null, "description": "MicroVM sandboxes for AI coding agents, each with its own Docker daemon, filesystem, and network.", "isolation_type": [ "microvm" ], "capabilities": [ "MicroVM isolation (not regular containers)", "Dedicated Docker daemon per sandbox", "Filesystem and network isolation", "Supports Claude Code, Codex, Copilot, Gemini, Kiro" ], "requirements": [ "Docker Engine 29.1.5+ (Docker Desktop 4.58+)", "macOS or Linux" ], "limitations": [ "Experimental", "MicroVM overhead" ], "notes": "Very new (March 2026). Multi-agent support is notable — works with most major coding agents out of the box.", "isolation_tier": "microvm", "adoption_effort": "install", "deployment_model": "local" }, { "name": "nono", "category": "standalone", "maintainer": "nolabs-ai", "open_source": true, "license": "Apache-2.0", "url": "https://nono.sh", "repo_url": "https://github.com/nolabs-ai/nono", "description": "Kernel-enforced agent sandbox with credential proxy, atomic rollback, Sigstore attestation, and cryptographic audit chain.", "isolation_type": [ "landlock", "seatbelt" ], "capabilities": [ "Kernel-level enforcement (Landlock on Linux, Seatbelt on macOS)", "Credential injection via proxy (keys never enter the sandbox)", "Atomic rollback with Merkle tree integrity", "Sigstore-based attestation of instruction files", "L7 API endpoint filtering", "Detach/reattach multiplexing", "Rust library with Python/TS/Go bindings" ], "requirements": [ "macOS, Linux, or WSL2", "brew install nono or single binary" ], "limitations": [ "Early alpha — not yet audited" ], "notes": "Unique combination of properties no other tool offers: credential proxy (API keys never enter the sandbox), attestation, and atomic rollback. Easy setup (brew install, then nono run -- claude). Very active development.", "isolation_tier": "process", "adoption_effort": "install", "deployment_model": "local" }, { "name": "Anthropic sandbox-runtime (srt)", "category": "standalone", "maintainer": "Anthropic", "open_source": true, "license": "Apache-2.0", "url": "https://github.com/anthropic-experimental/sandbox-runtime", "repo_url": "https://github.com/anthropic-experimental/sandbox-runtime", "description": "Lightweight sandboxing for arbitrary processes using bubblewrap (Linux) and Seatbelt (macOS), no container required.", "isolation_type": [ "user-namespace", "seatbelt" ], "capabilities": [ "Filesystem isolation (directory-level)", "Network isolation (proxy-based domain filtering with interactive approval)", "Works for any process, agent, or MCP server" ], "requirements": [ "macOS or Linux", "No root required on Linux" ], "limitations": [ "Experimental/research preview", "Not production-hardened", "macOS sandbox-exec deprecation risk" ], "notes": "Designed to sandbox any process, not just Claude Code. Interactive network approval mode is useful for discovering what network access a tool actually needs.", "isolation_tier": "process", "adoption_effort": "install", "deployment_model": "local" }, { "name": "NVIDIA OpenShell", "category": "standalone", "maintainer": "NVIDIA", "open_source": true, "license": "Apache-2.0", "url": "https://github.com/NVIDIA/OpenShell", "repo_url": "https://github.com/NVIDIA/OpenShell", "description": "Secure runtime for autonomous AI agents with kernel-level Landlock + seccomp enforcement and declarative YAML/OPA policies.", "isolation_type": [ "landlock", "seccomp" ], "capabilities": [ "Landlock + seccomp kernel enforcement", "Declarative YAML policies", "OPA/Rego policy support", "Static + dynamic policies", "Filesystem/network/process isolation", "Containerized agent support" ], "requirements": [ "Linux", "Early preview" ], "limitations": [ "Early preview", "Linux only", "No macOS support" ], "notes": "NVIDIA backing gives visibility. OPA/Rego policy support targets enterprise governance workflows. Announced at GTC 2026.", "isolation_tier": "process", "adoption_effort": "install", "deployment_model": "local" }, { "name": "Agent Safehouse", "category": "standalone", "maintainer": "eugene1g", "open_source": true, "license": null, "url": "https://github.com/eugene1g/agent-safehouse", "repo_url": "https://github.com/eugene1g/agent-safehouse", "description": "macOS sandbox-exec profile system with deny-first policy, composable profiles, and pre-built agent configurations.", "isolation_type": [ "seatbelt" ], "capabilities": [ "macOS Seatbelt profile generation", "Deny-first policy", "Composable profile system", "Pre-built profiles for major coding agents", "Policy builder web tool", "Fine-grained HOME access control", "Symlink-aware path resolution" ], "requirements": [ "macOS only", "brew install eugene1g/safehouse/agent-safehouse" ], "limitations": [ "macOS only (permanently — sandbox-exec is Apple-specific)", "sandbox-exec deprecation risk" ], "notes": "More mature than it appears — has CI tests, docs site, and thoughtful profile composition. The most polished macOS-specific sandboxing option.", "isolation_tier": "process", "adoption_effort": "install", "deployment_model": "local" }, { "name": "scode", "category": "standalone", "maintainer": "Laurent Bindschaedler", "open_source": true, "license": null, "url": "https://binds.ch/blog/scode-sandbox-for-ai-coding-tools/", "repo_url": null, "description": "OS-level sandbox wrapper for any AI coding harness with filesystem and network restrictions.", "isolation_type": [ "process" ], "capabilities": [ "OS-level sandboxing", "Works with any AI coding tool", "Filesystem and network restrictions" ], "requirements": [ "macOS or Linux" ], "limitations": [ "Smaller community project" ], "notes": "Early entry in the space (Sept 2025), motivated by Claude Code's initial lack of built-in sandboxing.", "isolation_tier": "process", "adoption_effort": "install", "deployment_model": "local" }, { "name": "microsandbox", "category": "standalone", "maintainer": "zerocore-ai", "open_source": true, "license": null, "url": "https://github.com/superradcompany/microsandbox", "repo_url": "https://github.com/superradcompany/microsandbox", "description": "Local-first programmable sandboxes using libkrun microVMs, designed for sensitive API keys with no external server.", "isolation_type": [ "microvm" ], "capabilities": [ "libkrun microVM isolation", "Local-first (no external server)", "Programmable SDK", "Agent Skills for Claude Code, Cursor, Codex, Gemini, Copilot" ], "requirements": [ "Linux (KVM) or macOS" ], "limitations": [ "Self-hosted only", "Smaller community" ], "notes": "Local-first is the key differentiator — no credentials leave your machine. Good for privacy-conscious users handling sensitive API keys.", "isolation_tier": "microvm", "adoption_effort": "install", "deployment_model": "local" }, { "name": "agent-infra/sandbox", "category": "standalone", "maintainer": "agent-infra (community)", "open_source": true, "license": null, "url": "https://github.com/agent-infra/sandbox", "repo_url": "https://github.com/agent-infra/sandbox", "description": "All-in-one sandbox combining Browser, Shell, File management, MCP, and VSCode Server in a single Docker container.", "isolation_type": [ "container" ], "capabilities": [ "Browser automation", "Shell access", "File management", "MCP integration", "VSCode Server" ], "requirements": [ "Docker" ], "limitations": [ "Container isolation only (shared kernel)", "Monolithic design" ], "notes": "Kitchen-sink approach — good for prototyping and development, less suitable for security-critical production use.", "isolation_tier": "container", "adoption_effort": "install", "deployment_model": "local" }, { "name": "llm-sandbox", "category": "standalone", "maintainer": "vndee", "open_source": true, "license": "MIT", "url": "https://github.com/vndee/llm-sandbox", "repo_url": "https://github.com/vndee/llm-sandbox", "description": "Lightweight Python library for executing LLM-generated code inside Docker, Podman, or Kubernetes containers with network isolation and resource limits.", "isolation_type": [ "container" ], "capabilities": [ "Multi-backend (Docker, Podman, Kubernetes)", "Network isolation", "Resource limits", "Security policies", "MCP integration", "PyPI published" ], "requirements": [ "Docker, Podman, or Kubernetes", "Python" ], "limitations": [ "Container isolation only (shared kernel)", "Code interpreter focus (not general agent sandboxing)" ], "notes": "Multi-backend support is the differentiator — same API across Docker, Podman, and K8s. Good for sandboxing LLM-generated code execution specifically. SonarCloud + codecov CI suggests reasonable code quality standards.", "isolation_tier": "container", "adoption_effort": "install", "deployment_model": "local" }, { "name": "monty", "category": "standalone", "maintainer": "Pydantic", "open_source": true, "license": "MIT", "url": "https://github.com/pydantic/monty", "repo_url": "https://github.com/pydantic/monty", "description": "Minimal, secure Python interpreter written in Rust providing language-runtime sandboxing for AI-generated code with no host access except via explicit caller-provided functions.", "isolation_type": [ "process" ], "capabilities": [ "Custom Python interpreter in Rust", "No filesystem, env, or network access by default", "Caller-provided functions for explicit host integration", "Memory, stack, and time limits", "Snapshotting" ], "requirements": [ "pip install pydantic-monty" ], "limitations": [ "Experimental — explicitly not ready for production", "Python subset only (not full CPython)" ], "notes": "Different approach from Pyodide — a custom Rust interpreter rather than CPython compiled to Wasm. Will power Pydantic AI's codemode feature. Backed by Pydantic, but explicitly experimental. Categorized in the wasm tier because language-runtime sandboxing fits the same isolation strength characterization (fastest/lightest, limited to specific runtimes), even though it's not actually Wasm.", "isolation_tier": "wasm", "adoption_effort": "install", "deployment_model": "local" }, { "name": "ai-sandbox-wrapper", "category": "standalone", "maintainer": "kokorolx", "open_source": true, "license": null, "url": "https://github.com/nano-step/ai-sandbox-wrapper", "repo_url": "https://github.com/nano-step/ai-sandbox-wrapper", "description": "npm CLI that wraps Docker for coding agents (opencode, amp, droid) with workspace whitelisting, capability dropping, and Git fetch-only mode.", "isolation_type": [ "container" ], "capabilities": [ "Docker container isolation", "Workspace whitelisting (filesystem boundary)", "Non-root execution", "CAP_DROP=ALL (drops all Linux capabilities)", "Explicit API key passing", "Git fetch-only mode (egress restriction)", "Targets opencode, amp, droid coding agents" ], "requirements": [ "Docker", "npm install -g @kokorolx/ai-sandbox-wrapper" ], "limitations": [ "No LICENSE file in repo (legal status unclear)", "Solo maintainer", "Container isolation only (shared kernel)" ], "notes": "Opinionated hardening over default Docker — capability dropping and Git fetch-only mode are substantive choices most Docker wrappers don't make. No license means the code is technically all-rights-reserved by default; consider asking the author to add one before relying on it.", "isolation_tier": "container", "adoption_effort": "install", "deployment_model": "local" }, { "name": "locki", "category": "standalone", "maintainer": "JanPokorny", "open_source": true, "license": null, "url": "https://github.com/JanPokorny/locki", "repo_url": "https://github.com/JanPokorny/locki", "description": "CLI that runs coding agents inside Incus containers in a shared Lima VM, with auto-managed git worktrees and a host-side SSH git proxy.", "isolation_type": [ "kvm", "container" ], "capabilities": [ "VM isolation via Lima/QEMU", "Container isolation via Incus", "Auto-managed git worktrees", "Host-side SSH git proxy with command allowlist", "Supports claude, gemini, codex, opencode, shell" ], "requirements": [ "macOS or Linux", "Lima and Incus", "pip or uv install" ], "limitations": [ "No LICENSE file in repo (legal status unclear)", "Author explicitly disclaims security guarantees", "No exfiltration protection", "Solo maintainer", "Very early" ], "notes": "One of the few sandboxes that layers VM (Lima/QEMU) plus container (Incus) for coding agents — interesting design worth tracking. Author is candid about \"no security guarantees\" in the README. No license means the code is technically all-rights-reserved by default; consider asking the author to add one before relying on it.", "isolation_tier": "hardware-vm", "adoption_effort": "install", "deployment_model": "local" }, { "name": "agentsh", "category": "standalone", "maintainer": "canyonroad", "open_source": true, "license": "Apache-2.0", "url": "https://github.com/canyonroad/agentsh", "repo_url": "https://github.com/canyonroad/agentsh", "description": "Policy-enforced execution gateway that intercepts file, network, process, and signal syscalls for agent commands with allow/deny/approve/redirect decisions and structured audit.", "isolation_type": [ "process", "landlock", "seatbelt" ], "capabilities": [ "Syscall interception (file, network, process, signal)", "Subprocess tree coverage", "Allow/deny/approve/redirect policy decisions", "Structured audit events", "Pairs with containers", "Cross-platform (Linux LSM/FUSE, macOS ESF+NE, Windows minifilter)", "Linux is production-ready; macOS alpha; Windows pending driver signing" ], "requirements": [ "Linux (production), macOS (alpha), or Windows (pending)", "Homebrew, .deb, .rpm, or .apk install" ], "limitations": [ "macOS support is alpha", "Windows support pending driver signing" ], "notes": "Real runtime enforcement, not just wrapping. The \"redirect\" policy decision is unusual — can transparently steer agent network calls or out-of-workspace writes to scratch dirs without the agent knowing it was redirected.", "isolation_tier": "process", "adoption_effort": "install", "deployment_model": "local" }, { "name": "jailoc", "category": "standalone", "maintainer": "Seznam", "open_source": true, "license": "MIT", "url": "https://github.com/seznam/jailoc", "repo_url": "https://github.com/seznam/jailoc", "description": "Per-workspace Docker Compose sandbox for OpenCode agents with iptables egress filtering, dropped capabilities, and a DinD sidecar to avoid host socket mounting.", "isolation_type": [ "container" ], "capabilities": [ "Per-workspace Docker Compose sandboxes", "iptables egress filtering (blocks RFC 1918, link-local, CGNAT by default)", "UID 1000, dropped capabilities, no_new_privs", "DinD sidecar instead of mounting docker.sock", "OpenCode agent integration", "Renovate-pinned base image" ], "requirements": [ "Docker", "Linux" ], "limitations": [ "OpenCode-specific defaults (sandboxing model is general)", "Container isolation only (shared kernel)" ], "notes": "Backed by Seznam (Czech search engine). Network isolation via iptables allowlist prevents pivot to internal infra. The DinD sidecar approach avoids the common docker.sock mount escape vector.", "isolation_tier": "container", "adoption_effort": "install", "deployment_model": "local" }, { "name": "sand", "category": "standalone", "maintainer": "banksean", "open_source": true, "license": "Apache-2.0", "url": "https://github.com/banksean/sand", "repo_url": "https://github.com/banksean/sand", "description": "macOS CLI that spawns disposable Apple Containerization VMs with APFS copy-on-write workspace clones for running coding agents.", "isolation_type": [ "microvm" ], "capabilities": [ "Apple Containerization (Kata-based microVMs)", "APFS clonefile copy-on-write workspace clones", "SSH agent forwarding", "DNS", "eBPF egress filtering with --allowed-domains-file", "One-command launch of Claude Code or opencode" ], "requirements": [ "Apple Silicon", "macOS 15+", "Homebrew tap" ], "limitations": [ "macOS only (Apple Silicon)", "Solo maintainer" ], "notes": "Apple Containerization gives hardware-isolated micro-VMs (Kata-based) on Apple Silicon. APFS clonefile makes workspace clones instant without copying files. eBPF egress filtering is a notable hardening choice for a solo project.", "isolation_tier": "microvm", "adoption_effort": "install", "deployment_model": "local" }, { "name": "sevorix-lite", "category": "standalone", "maintainer": "Sevorix", "open_source": true, "license": "AGPL-3.0", "url": "https://github.com/sevorix/sevorix-lite", "repo_url": "https://github.com/sevorix/sevorix-lite", "description": "Rust-native runtime containment engine combining eBPF syscall interception, mount namespace shell override, HTTP proxy, and a human-in-the-loop policy dashboard.", "isolation_type": [ "seccomp", "user-namespace" ], "capabilities": [ "eBPF syscall interception (Linux)", "Mount-namespace bind-mount of sevsh over /bin/bash", "HTTP proxy for network filtering", "libseccomp integration", "Central policy engine with web dashboard", "Green/Red/Yellow lane model with human-in-the-loop intervention", "Claude Code vault integration", "Claims <20ms enforcement latency" ], "requirements": [ "Linux or WSL (full enforcement)", "macOS (proxy + shell interception only, no eBPF/seccomp)" ], "limitations": [ "macOS support is reduced (no eBPF/seccomp)", "\"Lite\" edition of a commercial product (Sevorix)", "AGPL means modifications must be shared" ], "notes": "Multi-layered runtime containment rather than VM/container isolation. The \"Yellow Lane\" human-in-the-loop model with countdown timer is unusual — the agent pauses pending human approval via dashboard. Claude Code support is built in, not bolted on.", "isolation_tier": "process", "adoption_effort": "install", "deployment_model": "local" }, { "name": "fence", "category": "standalone", "maintainer": "Tusk", "open_source": true, "license": "Apache-2.0", "url": "https://github.com/Use-Tusk/fence", "repo_url": "https://github.com/Use-Tusk/fence", "description": "Container-free CLI sandbox using OS-native primitives for network domain allowlisting, filesystem access control, and command deny-lists.", "isolation_type": [ "seatbelt", "user-namespace" ], "capabilities": [ "macOS sandbox-exec (Seatbelt)", "Linux bubblewrap + socat for network bridging", "Network domain allowlisting", "Filesystem access control", "Command deny-lists", "Built-in templates for Claude Code, Codex, Amp, Gemini CLI, Copilot", "Go library for programmatic use" ], "requirements": [ "macOS or Linux", "Homebrew, Nix, or Go install" ], "limitations": [ "macOS sandbox-exec deprecation risk", "Process-level isolation (shared kernel)" ], "notes": "Lightest-weight option for wrapping agent processes with real isolation — no container runtime needed. Inspired by Anthropic's srt. Built-in agent templates mean zero config for common agents. Well-documented security model and architecture.", "isolation_tier": "process", "adoption_effort": "install", "deployment_model": "local" }, { "name": "aide", "category": "standalone", "maintainer": "jskswamy", "open_source": true, "license": "MIT", "url": "https://github.com/jskswamy/aide", "repo_url": "https://github.com/jskswamy/aide", "description": "Unified agent launcher with capability-based permission model and OS-native sandbox enforcement on macOS.", "isolation_type": [ "seatbelt" ], "capabilities": [ "Capability-based permission model (19 built-in capabilities)", "Composable grants with never-allow hard denials", "macOS Seatbelt sandbox enforcement", "Per-project context resolution (agent, credentials, capabilities)", "Supports multiple agents from a single launcher" ], "requirements": [ "macOS (sandbox enforcement)", "Go" ], "limitations": [ "Linux sandbox not yet implemented (Landlock + seccomp planned)", "macOS-only sandbox enforcement today", "Early project (v0.1.0)" ], "notes": "The capability model is the differentiator — 19 built-in capabilities (docker, k8s, aws, etc.) with composable grants and never-allow hard denials. More opinionated than fence or Agent Safehouse about what agents should be allowed to do. Linux sandbox is planned but not yet implemented.", "isolation_tier": "process", "adoption_effort": "install", "deployment_model": "local" }, { "name": "envpod-ce", "category": "standalone", "maintainer": "markamo", "open_source": true, "license": "BSL-1.1", "url": "https://github.com/markamo/envpod-ce", "repo_url": "https://github.com/markamo/envpod-ce", "description": "Linux governance sandbox using OverlayFS COW, namespaces, cgroups v2, and seccomp-BPF with a diff/commit/rollback workflow for agent changes to host files.", "isolation_type": [ "user-namespace", "seccomp" ], "capabilities": [ "OverlayFS copy-on-write (agents work on real files, changes staged)", "Linux namespaces (PID, net, mount, UTS, user)", "cgroups v2 resource limits", "seccomp-BPF syscall filtering", "Per-pod DNS with allowlisting", "Encrypted credential vault", "Diff/commit/rollback workflow for host changes", "Jailbreak test suite included" ], "requirements": [ "Linux only", "Single-binary Rust install" ], "limitations": [ "Linux only", "BSL-1.1 license (not OSI-approved open source)", "Very early (v0.1.15, 9 stars)" ], "notes": "The diff/commit/rollback workflow is unique — agents work on real host files via an OverlayFS overlay, and changes are staged for human review before committing to the host. Most sandboxes either fully isolate (agent can't touch host files) or don't isolate at all. This is a middle ground that enables real work with reversibility. BSL-1.1 license restricts production use without a commercial license.", "isolation_tier": "process", "adoption_effort": "install", "deployment_model": "local" }, { "name": "brood-box", "category": "standalone", "maintainer": "Stacklok", "open_source": true, "license": "Apache-2.0", "url": "https://github.com/stacklok/brood-box", "repo_url": "https://github.com/stacklok/brood-box", "description": "CLI that runs coding agents inside hardware-isolated microVMs with COW workspace snapshots and interactive per-file diff review before changes land.", "isolation_type": [ "kvm", "microvm" ], "capabilities": [ "Hardware VM isolation (libkrun/KVM on Linux, Hypervisor.framework on macOS)", "COW workspace snapshots", "Interactive per-file diff review (VM stopped before review, TOCTOU-resistant)", "DNS-aware egress firewall", "Ephemeral SSH keys", "Non-overridable secret exclusions", "Permission stripping on flush" ], "requirements": [ "Linux (KVM) or macOS (Apple Silicon, Hypervisor.framework)" ], "limitations": [ "Experimental" ], "notes": "From Stacklok (founded by Luke Hinds of Sigstore). Hardware VM isolation like cleanroom, but adds TOCTOU-resistant diff review — the VM is stopped before the user reviews changes, preventing the agent from modifying files during review. DNS egress firewall and non-overridable secret exclusions are strong default posture.", "isolation_tier": "hardware-vm", "adoption_effort": "install", "deployment_model": "local" }, { "name": "alcless", "category": "standalone", "maintainer": "AkihiroSuda", "open_source": true, "license": "Apache-2.0", "url": "https://github.com/AkihiroSuda/alcless", "repo_url": "https://github.com/AkihiroSuda/alcless", "description": "macOS sandbox using separate local user accounts for process/filesystem isolation with rsync workspace sync and user-confirmed sync-back.", "isolation_type": [ "process" ], "capabilities": [ "Separate macOS user account isolation", "rsync-based workspace isolation", "User-confirmed file sync-back", "Mach bootstrap subset isolation via pam_launchd", "No VM or container overhead" ], "requirements": [ "macOS only" ], "limitations": [ "macOS only (by design — Linux/FreeBSD have containers)", "Requires sudo for user switching", "Early project" ], "notes": "From AkihiroSuda (maintainer of Lima, nerdctl). Deliberately positioned as the lightweight complement to Lima (VM-based). Zero VM overhead — just Unix user separation. The rsync + confirm workflow means changes don't land on the host without approval.", "isolation_tier": "process", "adoption_effort": "install", "deployment_model": "local" }, { "name": "hole", "category": "standalone", "maintainer": "lukashornych", "open_source": true, "license": "Apache-2.0", "url": "https://github.com/lukashornych/hole", "repo_url": "https://github.com/lukashornych/hole", "description": "CLI that runs AI agents inside ephemeral Docker/Podman containers with proxy-based network domain whitelisting and configurable filesystem exclusions.", "isolation_type": [ "container" ], "capabilities": [ "Docker and Podman container isolation", "Proxy-based network domain whitelisting (three profiles)", "--dump-network-access logging", "File exclusion via bind-mount overrides", "Docker-in-Docker support for agents that need containers", "Ephemeral containers (destroyed on exit)", "Non-root user inside container" ], "requirements": [ "Docker or Podman", "Linux, macOS, or WSL" ], "limitations": [ "Container isolation only (shared kernel)", "Solo maintainer", "Early project" ], "notes": "The --dump-network-access flag is useful for discovering what network access an agent actually needs — similar to Anthropic srt's interactive approval mode but post-hoc. Docker-in-Docker support is unusual and needed for agents that themselves use containers.", "isolation_tier": "container", "adoption_effort": "install", "deployment_model": "local" }, { "name": "EdgeBox", "category": "standalone", "maintainer": "BIGPPWONG", "open_source": true, "license": "GPL-3.0", "url": "https://github.com/BIGPPWONG/EdgeBox", "repo_url": "https://github.com/BIGPPWONG/EdgeBox", "description": "Local Electron/Docker desktop app that runs LLM agents in isolated Docker containers with both CLI and full GUI (VNC) desktop environments, exposed via MCP.", "isolation_type": [ "container" ], "capabilities": [ "Docker container isolation per session", "Full GUI desktop environment (VNC) for computer-use agents", "CLI shell environments", "Multi-session concurrency with separate containers", "MCP protocol support" ], "requirements": [ "Docker", "Electron (desktop app)" ], "limitations": [ "Container isolation only (shared kernel)", "GPL-3.0 license" ], "notes": "The GUI desktop environment (VNC) is the differentiator — agents can operate browsers and desktop apps, not just execute code. Essentially a self-hosted E2B with a GUI layer for computer-use agent workflows.", "isolation_tier": "container", "adoption_effort": "install", "deployment_model": "local" }, { "name": "code-on-incus", "category": "standalone", "maintainer": "mensfeld", "open_source": true, "license": "MIT", "url": "https://github.com/mensfeld/code-on-incus", "repo_url": "https://github.com/mensfeld/code-on-incus", "description": "Hardened Incus container sandbox with real-time nftables threat detection (reverse shells, C2, DNS tunneling, exfiltration) and automated container pause/kill response.", "isolation_type": [ "container", "seccomp" ], "capabilities": [ "Incus unprivileged system containers (seccomp, AppArmor, UID remapping)", "Firewalld network isolation (restricted/allowlist/open modes)", "Real-time nftables threat detection daemon", "Automated container pause/kill on threat detection", "Protected paths via read-only mounts + chattr +i", "Supply-chain hardening (read-only .git/hooks, .husky, .vscode)", "Credential isolation (host credentials not mounted)", "Health-check command verifying seccomp/AppArmor/privilege posture" ], "requirements": [ "Linux (native)", "macOS via Lima/Colima VM" ], "limitations": [ "Container isolation (shared kernel)", "Linux-native (macOS requires VM layer)" ], "notes": "Goes beyond isolation into active defense — the monitoring daemon uses kernel-level nftables packet inspection to detect reverse shells, C2 callbacks, DNS tunneling, and data exfiltration patterns, then auto-pauses or kills the container. Supply-chain hardening (read-only git hooks) is a detail most sandboxes miss.", "isolation_tier": "container", "adoption_effort": "install", "deployment_model": "local" }, { "name": "hazmat", "category": "standalone", "maintainer": "dredozubov", "open_source": true, "license": "MIT", "url": "https://github.com/dredozubov/hazmat", "repo_url": "https://github.com/dredozubov/hazmat", "description": "macOS triple-layer containment stacking a dedicated user account, per-session Seatbelt kernel sandbox, and pf firewall with DNS blocklists and Kopia snapshots.", "isolation_type": [ "seatbelt", "process" ], "capabilities": [ "Dedicated macOS agent user (blocks ~/.ssh, ~/.aws, Keychain)", "Per-session Seatbelt kernel sandbox (default-deny filesystem)", "pf packet filter scoped to agent user", "DNS blocklists (ngrok, pastebin, webhook.site)", "Supply-chain hardening (npm ignore-scripts by default)", "Kopia backup snapshots", "TLA+ formally verified session lifecycle and policy structure" ], "requirements": [ "macOS only", "Homebrew install" ], "limitations": [ "macOS only", "Seatbelt is undocumented by Apple", "HTTPS exfiltration not blocked", "/tmp is shared" ], "notes": "Strongest macOS-specific sandbox — layers everything alcless (user isolation) and Agent Safehouse (Seatbelt) do individually, plus pf firewall and DNS blocklists. TLA+ formal verification of session lifecycle is unusual rigor for a sandbox tool. Honest about limitations (HTTPS exfil, shared /tmp).", "isolation_tier": "process", "adoption_effort": "install", "deployment_model": "local" }, { "name": "skilllite", "category": "standalone", "maintainer": "EXboys", "open_source": true, "license": "MIT", "url": "https://github.com/EXboys/skilllite", "repo_url": "https://github.com/EXboys/skilllite", "description": "Rust single-binary agent engine with a built-in OS-native sandbox using macOS Seatbelt and Linux bubblewrap/seccomp for skill execution isolation.", "isolation_type": [ "seatbelt", "user-namespace", "seccomp" ], "capabilities": [ "OS-native sandbox (Seatbelt on macOS, bubblewrap + seccomp on Linux)", "Filesystem, network, and IPC lockdown", "Process-exec whitelisting", "Resource limits via rlimits", "Three-layer defense (install-time scan, pre-exec auth, runtime sandbox)", "Zero-dependency single binary", "Sandbox component usable independently of the agent engine" ], "requirements": [ "macOS or Linux" ], "limitations": [ "Early project", "Smaller community" ], "notes": "The skilllite-sandbox component is independently usable — you don't have to use the agent engine to get the sandbox. Three-layer defense model (install scan + pre-exec auth + runtime sandbox) is more depth than most standalone tools offer.", "isolation_tier": "process", "adoption_effort": "install", "deployment_model": "local" }, { "name": "sandcastle", "category": "standalone", "maintainer": "Matt Pocock", "open_source": true, "license": "MIT", "url": "https://github.com/mattpocock/sandcastle", "repo_url": "https://github.com/mattpocock/sandcastle", "description": "TypeScript library for orchestrating coding agents inside Docker containers with git-aware branch strategies and automatic commit merging.", "isolation_type": [ "container" ], "capabilities": [ "Docker container isolation (self-managed, not delegated)", "Git-aware branch strategy orchestration", "Automatic commit merging from agent branches", "TypeScript API (sandcastle.run())", "npm package" ], "requirements": [ "Docker", "Node.js / TypeScript" ], "limitations": [ "Orchestration-focused (sandboxing is the mechanism, not the product)", "Container isolation only (shared kernel)" ], "notes": "Uses Docker containers it creates directly — not delegating to E2B or Daytona. The git branch strategy (agents work on branches, commits merge back) is the differentiator. Useful if you want multi-agent orchestration with isolation included.", "isolation_tier": "container", "adoption_effort": "install", "deployment_model": "local" }, { "name": "gocker", "category": "standalone", "maintainer": "lunguini", "open_source": true, "license": "Apache-2.0", "url": "https://github.com/lunguini/gocker", "repo_url": "https://github.com/lunguini/gocker", "description": "Docker-compatible CLI and API daemon for Apple Container on macOS 26+, where each container runs as a hardware-isolated Linux microVM.", "isolation_type": [ "microvm" ], "capabilities": [ "Apple Container (Virtualization.framework) microVMs", "Docker-compatible CLI and REST API", "Docker compose support", "Configurable isolation modes (full/hybrid/shared)", "gocker sandbox run claude command for agent sandboxing", "Claude session sync", "Portainer and Testcontainers compatible" ], "requirements": [ "macOS 26+ (Apple Silicon)" ], "limitations": [ "macOS only", "Very early (6 stars)", "Requires macOS 26+" ], "notes": "Different from cleanroom/sand/locki — gocker is a Docker replacement on macOS, not an embeddable sandbox library. The Docker-compatible API means existing Docker workflows and tools (compose, Portainer, Testcontainers) work out of the box, but each container is a hardware-isolated microVM via Apple Virtualization.framework.", "isolation_tier": "microvm", "adoption_effort": "install", "deployment_model": "local" }, { "name": "cleanroom", "category": "standalone", "maintainer": "Buildkite", "open_source": true, "license": null, "url": "https://github.com/buildkite/cleanroom", "repo_url": "https://github.com/buildkite/cleanroom", "description": "Self-hosted microVM sandbox using Firecracker (Linux) or Apple Virtualization.framework (macOS) with deny-by-default network and host-side credential proxy.", "isolation_type": [ "microvm", "kvm" ], "capabilities": [ "Firecracker microVMs (Linux)", "Apple Virtualization.framework (macOS)", "Deny-by-default egress with policy-controlled allowlists", "Host-side credential proxy (credentials never enter sandbox)", "Repo-scoped cleanroom.yaml network policy", "Docker-inside-sandbox support" ], "requirements": [ "Linux (KVM) or macOS" ], "limitations": [ "Early project", "No LICENSE file in repo" ], "notes": "From Buildkite (established CI company). Strongest isolation in recent discovery batches — hardware VM boundary, not containers or namespaces. Credential proxy model is similar to nono (keys never enter the sandbox). cleanroom.yaml per-repo policy is a clean declarative approach.", "isolation_tier": "hardware-vm", "adoption_effort": "install", "deployment_model": "local" }, { "name": "gondolin", "category": "standalone", "maintainer": "earendil-works", "open_source": true, "license": "Apache-2.0", "url": "https://github.com/earendil-works/gondolin", "repo_url": "https://github.com/earendil-works/gondolin", "description": "TypeScript-controlled Linux microVM sandbox (QEMU/KVM or libkrun) with programmable network egress hooks and per-secret credential injection.", "isolation_type": [ "kvm", "microvm" ], "capabilities": [ "Hardware VM isolation (QEMU/KVM default, experimental libkrun)", "TypeScript control plane (programmable sandbox API)", "Host-side HTTP/TLS egress hooks", "Per-secret, per-destination credential injection (agent never sees real keys)", "Filesystem controls", "Snapshot and resume", "macOS + Linux" ], "requirements": [ "Linux (KVM) or macOS (libkrun/Hypervisor.framework)", "Node.js / TypeScript" ], "limitations": [ "libkrun backend is experimental", "Linux-focused (macOS via experimental backend)" ], "notes": "The programmable egress hooks are the differentiator — host-side HTTP/TLS interception with per-secret, per-destination injection gives fine-grained control over what credentials reach which endpoints, without the agent ever seeing the real values. Similar credential model to nono and cleanroom but with a TypeScript programmable control plane rather than CLI/config.", "isolation_tier": "hardware-vm", "adoption_effort": "install", "deployment_model": "local" }, { "name": "cua", "category": "standalone", "maintainer": "trycua", "open_source": true, "license": "MIT", "url": "https://www.trycua.com", "repo_url": "https://github.com/trycua/cua", "description": "Open-source infrastructure for computer-use agents providing OS-level VM sandboxes (macOS, Windows, Linux, Android) via QEMU and Apple Virtualization.framework with a unified SDK for screen, mouse, and keyboard control.", "isolation_type": [ "microvm" ], "capabilities": [ "Multi-OS desktop sandboxes (macOS, Windows, Linux, Android)", "Apple Virtualization.framework on Apple Silicon (Lume)", "QEMU-based VMs for Linux/Windows (lumier)", "Unified SDK for screen capture, mouse, keyboard, multi-touch", "Computer-use agent benchmarks (OSWorld, ScreenSpot, Windows Arena)", "Optional cuabot wrapper with H.265 streaming and shared clipboard", "BYOI .qcow2/.iso support", "Optional cua.ai cloud-managed offering" ], "requirements": [ "macOS, Linux, or Windows (depending on backend)", "Apple Silicon for native macOS VMs via Lume" ], "limitations": [ "Bundled \"Cua Driver\" component runs unsandboxed on host (use Sandbox/Lume/cuabot for isolation)", "Optional ML components include AGPL-3.0 (ultralytics) and CC-BY-4.0 (OmniParser)" ], "notes": "Provisions full graphical desktops for macOS, Windows, Linux, and Android — distinct from container/microVM sandboxes that only give Linux shells. One of few options that legally and performantly virtualizes macOS for agent workloads, via Apple Virtualization.framework on Apple Silicon. Designed for visual/UI-driven agents rather than code-execution agents.", "isolation_tier": "hardware-vm", "adoption_effort": "install", "deployment_model": "local" }, { "name": "LINCE", "category": "standalone", "maintainer": "RisorseArtificiali", "open_source": true, "license": "MIT", "url": "https://lince.sh", "repo_url": "https://github.com/RisorseArtificiali/lince", "description": "Multi-agent TUI dashboard (Zellij-based) that orchestrates parallel CLI coding agents inside a bundled bubblewrap-based agent-sandbox module, with experimental nono backend on macOS.", "isolation_type": [ "user-namespace" ], "capabilities": [ "Bubblewrap-based agent-sandbox module (usable independently)", "Filesystem isolation and bind-mount control", "Environment variable filtering", "Process namespace isolation (hides host processes)", "Blocks git push out of sandbox", "Multi-agent parallel execution via Zellij panes (up to 8 agents)", "Real-time status and token tracking dashboard", "VoxCode/Whisper voice input integration", "Experimental macOS support via nono backend" ], "requirements": [ "Linux (Fedora 43 tested; Ubuntu/Debian/Arch claimed)", "bubblewrap", "Zellij" ], "limitations": [ "macOS support flagged experimental (delegates to nono)", "Standard bubblewrap isolation, no novel security primitive", "Early-stage (16 stars)" ], "notes": "Bundled agent-sandbox module is usable independently of the dashboard (agent-sandbox run -a codex). Differentiator is the multi-agent TUI orchestration plus voice input layered on standard bubblewrap isolation, packaged as a complete coding workstation.", "isolation_tier": "process", "adoption_effort": "install", "deployment_model": "local" }, { "name": "pixels", "category": "standalone", "maintainer": "deevus (Simon Hartcher)", "open_source": true, "license": "MIT", "url": "https://github.com/deevus/pixels", "repo_url": "https://github.com/deevus/pixels", "description": "Disposable Incus container sandboxes for AI coding agents with ZFS-backed snapshot/clone fan-out, nftables egress allowlists, and a built-in MCP server exposing sandbox lifecycle as MCP tools.", "isolation_type": [ "container" ], "capabilities": [ "Incus (LXD-derived) system containers — kernel namespaces and cgroups", "ZFS/btrfs-backed snapshots with checkpoint and clone-from-checkpoint workflow", "nftables-based egress allowlist (curated AI API list)", "Restricted sudoers inside container", "Built-in MCP server for sandbox lifecycle and file CRUD as MCP tools", "Pluggable backends (local Incus, TrueNAS SCALE-managed Incus)", "Preloaded coding agents (Claude Code, Codex, OpenCode)" ], "requirements": [ "Linux with Incus", "Optionally TrueNAS SCALE for remote backend" ], "limitations": [ "Egress is best-effort — root with cap_net_admin can bypass nftables rules", "MCP server path is alpha with weaker isolation than pixels create", "MCP daemon relies on loopback binding for auth", "Solo maintainer" ], "notes": "Second Incus-based entry alongside code-on-incus, but distinct differentiators: ZFS snapshot fan-out makes spinning up N task containers from a \"ready\" base a first-class primitive, and the built-in MCP server fits the \"MCP server sandboxing\" specialized use case called out in the raised-bar criteria. Has a SECURITY.md with documented threat model.", "isolation_tier": "container", "adoption_effort": "install", "deployment_model": "local" }, { "name": "agent_sandbox", "category": "standalone", "maintainer": "katosh", "open_source": true, "license": "MIT", "url": "https://github.com/katosh/agent_sandbox", "repo_url": "https://github.com/katosh/agent_sandbox", "description": "Kernel-enforced user-space sandbox for AI coding agents with multi-backend isolation (bubblewrap, firejail, Landlock LSM) and a Slurm \"chaperon\" proxy that propagates sandboxing onto HPC compute nodes.", "isolation_type": [ "user-namespace", "landlock", "seccomp" ], "capabilities": [ "Bubblewrap primary backend (user namespaces + bind mounts, no setuid required)", "Firejail and Landlock LSM fallback backends", "Generated seccomp-BPF filters per syscall (x86_64 and aarch64)", "Slurm chaperon proxy wrapping sbatch/srun/squeue/scancel/scontrol/sacct/sacctmgr", "In-sandbox Slurm stubs talk to outside chaperon via named pipes", "Whitelist validation of Slurm flags; denies --pty/--container/--uid/--prolog/--bcast/--get-user-env", "Sandbox-exec wrapping injected onto allocated compute nodes", "Supports Claude Code, Codex, Gemini, Aider, OpenCode, pi-mono" ], "requirements": [ "Linux", "Bubblewrap (or firejail/Landlock-capable kernel)" ], "limitations": [ "Linux-only — no macOS path", "No egress allowlist or credential proxy (acknowledged in landscape doc)", "Author flags as \"best-effort user-space isolation, not a security product\"", "Young project (2 critical / 3 high pentest findings documented and addressed)" ], "notes": "Only sandbox surveyed with first-class HPC/Slurm awareness — the chaperon proxy intercepts Slurm submission and wraps job commands so an agent cannot escape by submitting an unsandboxed job to a compute node. Munge auth is deliberately blocked inside the sandbox so only the outside chaperon can submit. Bind-mount filesystem isolation returns ENOENT rather than EACCES, which sidesteps the ld-linux and /proc/self/root evasions that have hit Landlock-allowlist sandboxes. Ships with a 32 KB threat model and a documented pentest cycle.", "isolation_tier": "process", "adoption_effort": "install", "deployment_model": "local" }, { "name": "Agent Sandbox (kubernetes-sigs)", "category": "kubernetes", "maintainer": "Kubernetes SIG", "open_source": true, "license": "Apache-2.0", "url": "https://github.com/kubernetes-sigs/agent-sandbox", "repo_url": "https://github.com/kubernetes-sigs/agent-sandbox", "description": "Kubernetes CRD and controller for isolated agent workloads with gVisor or Kata runtime and warm pod pools.", "isolation_type": [ "gvisor", "kata" ], "capabilities": [ "Declarative CRD", "gVisor + Kata support", "Warm pod pool for <1s cold start", "Persistent storage", "Stable pod identity" ], "requirements": [ "Kubernetes cluster", "gVisor or Kata runtime" ], "limitations": [ "Kubernetes required", "Still maturing", "No standalone mode" ], "notes": "Official Kubernetes SIG project (launched KubeCon Atlanta Nov 2025). Likely to become the standard for K8s agent sandboxing.", "isolation_tier": "container", "adoption_effort": "install", "deployment_model": "kubernetes" }, { "name": "GKE Agent Sandbox", "category": "kubernetes", "maintainer": "Google Cloud", "open_source": false, "license": null, "url": "https://cloud.google.com", "repo_url": null, "description": "Managed Kubernetes service for AI code isolation on GKE using gVisor and kubernetes-sigs/agent-sandbox.", "isolation_type": [ "gvisor", "kata" ], "capabilities": [ "Managed gVisor/Kata runtime", "GKE integration", "Warm pools", "Persistent storage", "Cloud IAM" ], "requirements": [ "Google Cloud account", "GKE cluster" ], "limitations": [ "GKE-only", "Vendor lock-in" ], "notes": "Managed wrapper around the open-source agent-sandbox project. If you're already on GKE, this is the path of least resistance.", "isolation_tier": "container", "adoption_effort": "sign-up", "deployment_model": "kubernetes" }, { "name": "treadstone", "category": "kubernetes", "maintainer": "earayu", "open_source": true, "license": "Apache-2.0", "url": "https://github.com/earayu/treadstone", "repo_url": "https://github.com/earayu/treadstone", "description": "Self-hostable Kubernetes sandbox control plane that provisions gVisor-isolated pods from templates, with CLI, Python SDK, REST API, and built-in browser handoff for human intervention.", "isolation_type": [ "gvisor" ], "capabilities": [ "Kubernetes CRD-based provisioning (built on kubernetes-sigs/agent-sandbox)", "gVisor isolation", "Warm pod pools", "CLI + Python SDK + REST API", "Browser handoff — short-lived links to hand a running session to a human", "MCP-over-data-plane routing", "Data plane proxy for outbound traffic" ], "requirements": [ "Kubernetes cluster (self-hosted)", "or managed service at treadstone-ai.dev" ], "limitations": [ "Solo maintainer", "Maturity unclear", "Full SDK/CLI surface suggests active development" ], "notes": "Built on kubernetes-sigs/agent-sandbox as the underlying CRD. Browser handoff is an unusual feature — enables smooth transitions from autonomous agent execution to human intervention. Offered both as open source and as a hosted service.", "isolation_tier": "container", "adoption_effort": "install", "deployment_model": "kubernetes" }, { "name": "openkruise/agents", "category": "kubernetes", "maintainer": "OpenKruise (Alibaba / CNCF)", "open_source": true, "license": "Apache-2.0", "url": "https://github.com/openkruise/agents", "repo_url": "https://github.com/openkruise/agents", "description": "Kubernetes operator for agent sandbox lifecycle management with resource pooling, hibernation, checkpoint/restore, and E2B API compatibility.", "isolation_type": [ "container" ], "capabilities": [ "Sandbox pod lifecycle management", "Resource pooling", "Sandbox hibernation and checkpoint (memory + RW layer + GPU memory)", "E2B API compatibility on self-hosted K8s", "Configurable runtime (container, gVisor, Kata)" ], "requirements": [ "Kubernetes cluster" ], "limitations": [ "Early project", "Kubernetes required" ], "notes": "CNCF-affiliated via OpenKruise (Alibaba). The E2B API compatibility is notable — lets you use existing E2B SDK integrations against self-hosted K8s instead of E2B's cloud. Sandbox hibernation with GPU memory checkpoint is unusual.", "isolation_tier": "container", "adoption_effort": "install", "deployment_model": "kubernetes" }, { "name": "sandbox0", "category": "kubernetes", "maintainer": "sandbox0-ai", "open_source": true, "license": "Apache-2.0", "url": "https://github.com/sandbox0-ai/sandbox0", "repo_url": "https://github.com/sandbox0-ai/sandbox0", "description": "Kubernetes-native agent sandbox platform with warm pod pools, JuiceFS persistent storage, network policy enforcement, and in-pod process manager.", "isolation_type": [ "container", "gvisor" ], "capabilities": [ "Warm pod pools", "JuiceFS persistent storage", "Configurable runtimeClass (gVisor/Kata)", "L4/L7 network enforcement via dedicated netd daemon", "Egress auth proxy (credential injection outside sandbox)", "procd in-pod process manager (PID 1) with REPL session management" ], "requirements": [ "Kubernetes cluster", "Self-hosted" ], "limitations": [ "Early project", "Small community" ], "notes": "The procd process manager inside pods provides REPL session management — unusual for a K8s sandbox. Egress credential injection keeps secrets outside the sandbox boundary, similar to nono's credential proxy model but at the K8s level.", "isolation_tier": "container", "adoption_effort": "install", "deployment_model": "kubernetes" }, { "name": "Ona (formerly Gitpod)", "category": "dev-environment", "maintainer": "Ona", "open_source": false, "license": null, "url": "https://ona.com", "repo_url": null, "description": "Pivoted from CDE to \"mission control for AI agents\" with sandboxed dev environments, AI agents, and guardrails.", "isolation_type": [ "container" ], "capabilities": [ "API-first environments", "devcontainer.json support", "OS-level isolation", "Ona Agents", "Ona Guardrails" ], "requirements": [ "Cloud-hosted", "Enterprise tiers" ], "limitations": [ "Rapid pivot — product still evolving", "Less sandbox API focus than E2B/Daytona" ], "notes": "Major pivot from Gitpod (rebranded Sept 2025). Demonstrated Claude Code sandbox escape (March 2026). Not agent-specific but increasingly agent-oriented.", "isolation_tier": "container", "adoption_effort": "sign-up", "deployment_model": "cloud" }, { "name": "GitHub Codespaces", "category": "dev-environment", "maintainer": "GitHub / Microsoft", "open_source": false, "license": null, "url": "https://github.com/features/codespaces", "repo_url": null, "description": "Cloud-hosted dev environments usable for isolating agent execution in a full Linux VM.", "isolation_type": [ "container" ], "capabilities": [ "Full Linux VM", "devcontainer.json support", "Pre-built images", "GitHub integration", "Port forwarding" ], "requirements": [ "GitHub account", "Usage-based pricing (free tier available)" ], "limitations": [ "Not agent-specific", "Higher startup latency", "Dev tool, not a sandbox service" ], "notes": "Not purpose-built for agents, but accessible to anyone familiar with GitHub. A \"good enough\" isolation option for personal agent use without learning new tools.", "isolation_tier": "container", "adoption_effort": "sign-up", "deployment_model": "cloud" }, { "name": "Coder", "category": "dev-environment", "maintainer": "Coder", "open_source": true, "license": "AGPL-3.0", "url": "https://github.com/coder/coder", "repo_url": "https://github.com/coder/coder", "description": "Self-hosted remote development platform with container and VM workspaces, RBAC, and audit logging.", "isolation_type": [ "container" ], "capabilities": [ "Self-hosted", "Container and VM workspaces", "Templates", "RBAC", "Audit logging" ], "requirements": [ "Self-hosted on Kubernetes or Docker" ], "limitations": [ "No agent-specific features", "No MCP integration" ], "notes": "Not agent-specific, but good for teams wanting self-hosted isolation without cloud dependency. AGPL license means modifications must be shared.", "isolation_tier": "container", "adoption_effort": "install", "deployment_model": "self-hosted" }, { "name": "DevPod", "category": "dev-environment", "maintainer": "Loft Labs", "open_source": true, "license": null, "url": "https://github.com/loft-sh/devpod", "repo_url": "https://github.com/loft-sh/devpod", "description": "Client-only tool for reproducible, provider-agnostic dev environments using devcontainer.json.", "isolation_type": [ "container" ], "capabilities": [ "Provider-agnostic (Docker/SSH/K8s/cloud)", "devcontainer.json support", "Client-only (no server)", "Open source" ], "requirements": [ "Docker or cloud provider" ], "limitations": [ "No agent-specific features", "No MCP integration", "No managed service" ], "notes": "Not agent-specific. Good open-source alternative to Codespaces for local-first workflows where you want reproducible isolated environments.", "isolation_tier": "container", "adoption_effort": "install", "deployment_model": "local" }, { "name": "ComputeSDK", "category": "abstraction", "maintainer": "ComputeSDK", "open_source": false, "license": null, "url": "https://www.computesdk.com", "repo_url": null, "description": "Unified API across multiple sandbox providers (E2B, Daytona, Modal, Blaxel, etc.).", "isolation_type": [ "microvm", "container" ], "capabilities": [ "Provider-agnostic API", "Single SDK for multiple backends" ], "requirements": [ "Account with underlying provider" ], "limitations": [ "Abstraction adds complexity", "Provider-dependent isolation" ], "notes": "Useful if you want to avoid vendor lock-in. Isolation strength depends entirely on the chosen backend provider.", "isolation_tier": "microvm", "adoption_effort": "sign-up", "deployment_model": "cloud" }, { "name": "LangChain Sandboxes", "category": "abstraction", "maintainer": "LangChain", "open_source": true, "license": null, "url": "https://docs.langchain.com/oss/python/deepagents/sandboxes", "repo_url": null, "description": "Sandbox integration layer within the LangChain agent framework.", "isolation_type": [ "container" ], "capabilities": [ "Framework integration", "Provider abstraction", "Agent workflow orchestration" ], "requirements": [ "LangChain framework", "Python" ], "limitations": [ "Framework-dependent", "Not standalone" ], "notes": "Only relevant if already using LangChain. The sandbox capabilities come from the underlying provider, not LangChain itself.", "isolation_tier": "container", "adoption_effort": "install", "deployment_model": "cloud" }, { "name": "OpenSandbox", "category": "standalone", "maintainer": "Alibaba", "open_source": true, "license": "Apache-2.0", "url": "https://github.com/opensandbox-group/OpenSandbox", "repo_url": "https://github.com/opensandbox-group/OpenSandbox", "description": "Universal sandbox for AI apps with multi-language SDKs, Docker + K8s runtimes, covering coding agents, GUI agents, evaluation, and RL training.", "isolation_type": [ "container" ], "capabilities": [ "Multi-language SDKs (Python/Java/JS/C#/Go planned)", "Unified API", "Dual runtime (Docker for dev, K8s for prod)", "Evaluation and RL training support" ], "requirements": [ "Docker or Kubernetes", "Self-hosted" ], "limitations": [ "Very new (created December 2025)" ], "notes": "Broadest scope of any sandbox — covers evaluation and RL training environments, not just agent sandboxing.", "isolation_tier": "container", "adoption_effort": "install", "deployment_model": "self-hosted" }, { "name": "NanoClaw", "category": "abstraction", "maintainer": "Lazer and Gavriel Cohen", "open_source": true, "license": "MIT", "url": "https://github.com/qwibitai/nanoclaw", "repo_url": "https://github.com/qwibitai/nanoclaw", "description": "Lightweight containerized agent orchestration wrapping Claude Code with messaging platform integrations.", "isolation_type": [ "container" ], "capabilities": [ "Container isolation (Docker/Docker Sandboxes/Apple Container)", "WhatsApp/Telegram/Slack/Discord/Gmail integration", "Memory management", "Scheduled jobs" ], "requirements": [ "Docker or Apple Container" ], "limitations": [ "Tied to Claude/Anthropic SDK", "Container-level isolation unless using Docker Sandboxes" ], "notes": "More of an agent orchestration framework with sandbox support than a sandbox itself. High adoption. Sandbox capability comes from Docker or Docker Sandboxes underneath.", "isolation_tier": "container", "adoption_effort": "install", "deployment_model": "local" }, { "name": "AgentScope Runtime", "category": "abstraction", "maintainer": "agentscope-ai (Alibaba)", "open_source": true, "license": "Apache-2.0", "url": "https://github.com/agentscope-ai/agentscope-runtime", "repo_url": "https://github.com/agentscope-ai/agentscope-runtime", "description": "Agent runtime framework with real sandbox backends (Docker, gVisor, BoxLite, K8s, serverless) and pre-built sandbox images for GUI, browser, and mobile.", "isolation_type": [ "container", "gvisor" ], "capabilities": [ "Docker container sandboxing (default)", "Optional gVisor hardening", "BoxLite sandbox backend", "K8s and serverless (Alibaba Cloud) backends", "Pre-built sandbox images (base, GUI/VNC, browser, filesystem, mobile/Android)", "Multi-framework compatibility (AgentScope, LangGraph, Agno, AutoGen)", "Async sandbox support" ], "requirements": [ "Docker (local)", "K8s or Alibaba Cloud (production)", "Python" ], "limitations": [ "Primarily an agent runtime framework — sandboxing is one feature among many", "Alibaba Cloud for serverless backend" ], "notes": "Real sandbox depth despite being a runtime framework — pre-built images covering GUI (VNC), browser, and mobile (Android emulator) environments go well beyond typical container sandboxes. Multiple sandbox backends (Docker, gVisor, BoxLite, K8s) abstracted behind a single API.", "isolation_tier": "container", "adoption_effort": "install", "deployment_model": "cloud" }, { "name": "agentbox-sdk", "category": "abstraction", "maintainer": "TwillAI", "open_source": true, "license": "MIT", "url": "https://github.com/TwillAI/agentbox-sdk", "repo_url": "https://github.com/TwillAI/agentbox-sdk", "description": "TypeScript SDK that runs coding agents (Claude Code, opencode, codex) as server processes inside swappable sandbox backends (E2B, Modal, Daytona, Vercel, local Docker), each agent reached over its upstream-native protocol.", "isolation_type": [ "microvm", "container" ], "capabilities": [ "Five sandbox backends (E2B, Modal, Daytona, Vercel, local-docker)", "Native-protocol agent transports — Claude Code custom HTTP daemon, opencode SSE with Last-Event-ID resume, codex JSON-RPC WebSocket", "Mid-run message injection into a running agent stream", "Interactive approval flows preserved across backends", "Sub-agent orchestration" ], "requirements": [ "Node.js / TypeScript", "Account with chosen backend provider (E2B/Modal/Daytona/Vercel) or local Docker" ], "limitations": [ "No LICENSE file in repo as of 2026-05-12 (package.json declares MIT)", "Isolation strength entirely dictated by chosen backend", "Pre-release — no formal versions cut yet" ], "notes": "Differentiator vs other abstraction-tier entries is heterogeneous-protocol agent transport: each upstream agent is reached via its native protocol rather than CLI-wrapped, so mid-run interactivity, approval flows, and sub-agent orchestration survive being inside a sandbox. ComputeSDK is closed-source and sandbox-only; LangChain Sandboxes is framework-bound; NanoClaw is Claude-only; AgentScope Runtime is Python-only and ships its own agent framework.", "isolation_tier": "microvm", "adoption_effort": "install", "deployment_model": "cloud" }, { "name": "Firecracker", "category": "vm-runtime", "maintainer": "AWS", "open_source": true, "license": "Apache-2.0", "url": "https://github.com/firecracker-microvm/firecracker", "repo_url": "https://github.com/firecracker-microvm/firecracker", "description": "Lightweight microVM monitor using KVM with <5MB overhead, powering Lambda, Fargate, E2B, Vercel, Bunnyshell, and Fly Sprites.", "isolation_type": [ "kvm", "microvm" ], "capabilities": [ "KVM hardware isolation", "<125ms boot", "<5MB memory per VM", "Snapshot/restore (~28ms)", "Rate limiters", "Jailer for additional containment" ], "requirements": [ "Linux with KVM", "x86_64 or aarch64" ], "limitations": [ "Linux only", "No GPU passthrough", "Minimal device model", "Must build own orchestration layer" ], "notes": "The foundation most cloud sandbox platforms build on. Battle-tested at AWS scale (Lambda, Fargate). If you're building a sandbox product, this is likely your starting point.", "isolation_tier": "hardware-vm", "adoption_effort": "compose", "deployment_model": "self-hosted" }, { "name": "gVisor", "category": "vm-runtime", "maintainer": "Google", "open_source": true, "license": "Apache-2.0", "url": "https://github.com/google/gvisor", "repo_url": "https://github.com/google/gvisor", "description": "User-space kernel that intercepts and re-implements Linux syscalls, providing container isolation without hardware virtualization.", "isolation_type": [ "gvisor" ], "capabilities": [ "Syscall interception in user space", "No hardware virtualization needed", "OCI-compatible (drop-in runsc runtime)", "Sentry kernel + Gofer file proxy architecture" ], "requirements": [ "Linux", "OCI runtime (runsc)" ], "limitations": [ "Performance overhead on syscall-heavy workloads", "Not all syscalls implemented" ], "notes": "Used by GKE and kubernetes-sigs/agent-sandbox. Good middle ground between container and VM isolation — stronger than containers, lighter than full VMs.", "isolation_tier": "container", "adoption_effort": "compose", "deployment_model": "self-hosted" }, { "name": "Kata Containers", "category": "vm-runtime", "maintainer": "OpenInfra Foundation", "open_source": true, "license": "Apache-2.0", "url": "https://github.com/kata-containers/kata-containers", "repo_url": "https://github.com/kata-containers/kata-containers", "description": "VM-level isolation per container, OCI/CRI compatible, supporting QEMU, Cloud Hypervisor, and Firecracker VMMs.", "isolation_type": [ "kata", "kvm" ], "capabilities": [ "Hardware VM per container", "OCI/CRI compatible", "Multiple VMM backends (QEMU/Cloud Hypervisor/Firecracker)", "Kubernetes integration" ], "requirements": [ "Linux with KVM" ], "limitations": [ "Higher overhead than gVisor", "Requires KVM", "More complex setup" ], "notes": "Production-proven at scale via Northflank (2M+ workloads/month). Good for Kubernetes environments that need VM-level isolation per pod.", "isolation_tier": "hardware-vm", "adoption_effort": "compose", "deployment_model": "self-hosted" }, { "name": "libkrun", "category": "vm-runtime", "maintainer": "Containers project (Red Hat)", "open_source": true, "license": "Apache-2.0", "url": "https://github.com/containers/libkrun", "repo_url": "https://github.com/containers/libkrun", "description": "Library-based KVM virtualization with container-competitive startup, supporting Apple Virtualization.framework on macOS.", "isolation_type": [ "kvm" ], "capabilities": [ "Library-embeddable (no daemon)", "KVM isolation", "Fast startup", "Apple Virtualization.framework on macOS" ], "requirements": [ "Linux (KVM) or macOS (Virtualization.framework)" ], "limitations": [ "Less tooling than Firecracker", "Smaller community" ], "notes": "macOS support via Apple Virtualization.framework is unique among VM runtimes — Firecracker and Kata are Linux-only. Used by microsandbox.", "isolation_tier": "hardware-vm", "adoption_effort": "compose", "deployment_model": "self-hosted" }, { "name": "Zeroboot", "category": "vm-runtime", "maintainer": "Zeroboot (community)", "open_source": true, "license": null, "url": "https://github.com/zerobootdev/zeroboot", "repo_url": "https://github.com/zerobootdev/zeroboot", "description": "Sub-millisecond VM sandboxes via COW forking of Firecracker snapshots (~0.8ms fork creation).", "isolation_type": [ "kvm", "microvm" ], "capabilities": [ "KVM isolation", "Firecracker snapshot COW forking", "~0.8ms sandbox creation", "Self-hostable", "Managed API also available" ], "requirements": [ "Linux with KVM" ], "limitations": [ "Very new", "Small community" ], "notes": "0.8ms sandbox creation via COW forking is remarkable if verified at scale. Worth watching as a potential next-gen approach to sandbox provisioning.", "isolation_tier": "hardware-vm", "adoption_effort": "compose", "deployment_model": "self-hosted" }, { "name": "bubblewrap (bwrap)", "category": "os-primitive", "maintainer": "Containers project (Flatpak origin)", "open_source": true, "license": "LGPL-2.0+", "url": "https://github.com/containers/bubblewrap", "repo_url": "https://github.com/containers/bubblewrap", "description": "Unprivileged user-namespace sandbox for Linux requiring no root, used by Claude Code and Flatpak.", "isolation_type": [ "user-namespace" ], "capabilities": [ "User namespaces", "Mount namespaces", "Network namespace", "No root required" ], "requirements": [ "Linux with user namespace support" ], "limitations": [ "Linux only", "Low-level (must compose with other tools)" ], "notes": "Years of hardening via Flatpak. Claude Code's Linux sandbox builds on this. The go-to unprivileged sandbox primitive on Linux.", "isolation_tier": "process", "adoption_effort": "compose", "deployment_model": "local" }, { "name": "macOS Seatbelt / sandbox-exec", "category": "os-primitive", "maintainer": "Apple", "open_source": false, "license": null, "url": null, "repo_url": null, "description": "macOS mandatory access control using SBPL policies for filesystem, network, and process restrictions.", "isolation_type": [ "seatbelt" ], "capabilities": [ "Filesystem access control", "Network control", "Process restrictions", "Kernel-level enforcement" ], "requirements": [ "macOS only" ], "limitations": [ "sandbox-exec deprecated by Apple", "SBPL policy language poorly documented" ], "notes": "Deprecated but still the only game in town for macOS process sandboxing. Used by Claude Code, Agent Safehouse, and srt on macOS. No replacement announced by Apple.", "isolation_tier": "process", "adoption_effort": "compose", "deployment_model": "local" }, { "name": "Firejail", "category": "os-primitive", "maintainer": "netblue30 (community)", "open_source": true, "license": "GPL-2.0", "url": "https://github.com/netblue30/firejail", "repo_url": "https://github.com/netblue30/firejail", "description": "SUID sandbox combining namespaces, seccomp, and capabilities with desktop-aware features (audio, display).", "isolation_type": [ "user-namespace", "seccomp" ], "capabilities": [ "Namespace isolation", "seccomp-BPF filtering", "Filesystem whitelisting", "Network filtering", "Desktop app support (audio, display)", "Pre-built profiles for common apps" ], "requirements": [ "Linux", "Setuid binary" ], "limitations": [ "SUID is a larger attack surface", "Desktop-focused", "Linux only" ], "notes": "Primarily for desktop app sandboxing, but applicable to agent processes. SUID requirement is a trade-off — convenience vs. attack surface.", "isolation_tier": "process", "adoption_effort": "install", "deployment_model": "local" }, { "name": "Landlock LSM", "category": "os-primitive", "maintainer": "Linux kernel community", "open_source": true, "license": "GPL-2.0", "url": "https://landlock.io", "repo_url": null, "description": "Unprivileged filesystem access control at kernel level, used by Codex CLI and NVIDIA OpenShell.", "isolation_type": [ "landlock" ], "capabilities": [ "Filesystem access restrictions per path", "Unprivileged (no root)", "Stackable with other LSMs", "Kernel-level enforcement" ], "requirements": [ "Linux kernel 5.13+ (network support in 6.7+)" ], "limitations": [ "Filesystem only in early kernel versions", "Must combine with seccomp for full coverage", "Linux only" ], "notes": "The modern Linux answer to unprivileged sandboxing. Network support in kernel 6.7 makes it much more complete. Used by Codex CLI and OpenShell.", "isolation_tier": "process", "adoption_effort": "compose", "deployment_model": "local" }, { "name": "seccomp-BPF", "category": "os-primitive", "maintainer": "Linux kernel community", "open_source": true, "license": "GPL-2.0", "url": null, "repo_url": null, "description": "Syscall filtering using BPF programs to kill, trap, or errno on forbidden syscalls.", "isolation_type": [ "seccomp" ], "capabilities": [ "Syscall-level filtering", "BPF programmability", "Kill/trap/errno on forbidden syscalls" ], "requirements": [ "Linux kernel 3.5+" ], "limitations": [ "Syscall-level only (no file path awareness)", "Complex BPF filter authoring", "Linux only" ], "notes": "Building block, not standalone. Almost always used alongside Landlock or namespaces to provide full sandbox coverage.", "isolation_tier": "process", "adoption_effort": "compose", "deployment_model": "local" }, { "name": "Linux Namespaces + cgroups", "category": "os-primitive", "maintainer": "Linux kernel community", "open_source": true, "license": "GPL-2.0", "url": null, "repo_url": null, "description": "Foundation of all container technology — PID, mount, network, user, UTS, and IPC namespaces plus cgroups for resource limits.", "isolation_type": [ "user-namespace" ], "capabilities": [ "Process isolation (PID namespace)", "Filesystem isolation (mount namespace)", "Network isolation (network namespace)", "User isolation (user namespace)", "CPU/memory/IO limits (cgroups)" ], "requirements": [ "Linux" ], "limitations": [ "Building blocks only — must compose into usable tools", "Shared kernel", "Linux only" ], "notes": "Everything in the container and VM space builds on these primitives. Understanding namespaces and cgroups is foundational to evaluating any Linux-based sandbox's isolation claims.", "isolation_tier": "process", "adoption_effort": "compose", "deployment_model": "local" }, { "name": "nsjail", "category": "os-primitive", "maintainer": "Google", "open_source": true, "license": "Apache-2.0", "url": "https://github.com/google/nsjail", "repo_url": "https://github.com/google/nsjail", "description": "Process isolation tool combining namespaces, seccomp, and resource limits with the Kafel policy language.", "isolation_type": [ "user-namespace", "seccomp" ], "capabilities": [ "Namespace isolation", "seccomp-BPF filtering", "cgroup resource limits", "chroot/pivot_root", "Network filtering", "Kafel policy language" ], "requirements": [ "Linux" ], "limitations": [ "Linux only", "Less actively maintained", "CLI only" ], "notes": "Google-maintained. Kafel policy language is more ergonomic than raw seccomp-BPF. Used by competitive programming judges for untrusted code execution.", "isolation_tier": "process", "adoption_effort": "compose", "deployment_model": "local" }, { "name": "Wasmtime", "category": "wasm-runtime", "maintainer": "Bytecode Alliance", "open_source": true, "license": "Apache-2.0", "url": "https://github.com/bytecodealliance/wasmtime", "repo_url": "https://github.com/bytecodealliance/wasmtime", "description": "Fast, secure WebAssembly runtime with WASI capability-based security and linear memory isolation.", "isolation_type": [ "wasm" ], "capabilities": [ "Memory-safe execution", "WASI capability-based security", "Multi-tenant isolation", "Thousands of concurrent instances", "Cross-platform" ], "requirements": [ "Cross-platform", "Must compile tools to Wasm" ], "limitations": [ "Must compile to Wasm", "Not for arbitrary Linux binaries", "Ecosystem still maturing" ], "notes": "The reference Wasm runtime from Bytecode Alliance. Architecturally elegant sandboxing but requires toolchain buy-in — you can't run arbitrary binaries.", "isolation_tier": "wasm", "adoption_effort": "compose", "deployment_model": "local" }, { "name": "WasmEdge", "category": "wasm-runtime", "maintainer": "CNCF", "open_source": true, "license": "Apache-2.0", "url": "https://github.com/WasmEdge/WasmEdge", "repo_url": "https://github.com/WasmEdge/WasmEdge", "description": "Cloud-native WebAssembly runtime optimized for edge, AI, and serverless workloads.", "isolation_type": [ "wasm" ], "capabilities": [ "Memory-safe execution", "WASI support", "AI/ML inference extensions", "Kubernetes integration", "Edge deployment focus" ], "requirements": [ "Cross-platform", "Must compile tools to Wasm" ], "limitations": [ "Must compile to Wasm", "Not for arbitrary Linux binaries" ], "notes": "CNCF project. Differentiates from Wasmtime with AI/ML inference extensions and edge deployment focus.", "isolation_tier": "wasm", "adoption_effort": "compose", "deployment_model": "local" }, { "name": "wasmCloud", "category": "wasm-runtime", "maintainer": "wasmCloud community", "open_source": true, "license": "Apache-2.0", "url": "https://github.com/wasmCloud/wasmCloud", "repo_url": "https://github.com/wasmCloud/wasmCloud", "description": "Application platform for building distributed Wasm applications with capability-based security.", "isolation_type": [ "wasm" ], "capabilities": [ "Distributed Wasm applications", "Capability-based security model", "Provider-based extensibility", "Lattice networking" ], "requirements": [ "Cross-platform", "NATS for messaging" ], "limitations": [ "Must compile to Wasm", "More complex than standalone runtimes", "Application platform, not just a runtime" ], "notes": "Higher-level than Wasmtime or WasmEdge — it's an application platform, not just a runtime. Useful if building distributed agent systems with Wasm isolation.", "isolation_tier": "wasm", "adoption_effort": "compose", "deployment_model": "self-hosted" }, { "name": "Wassette", "category": "wasm-runtime", "maintainer": "Microsoft (Azure Core Upstream)", "open_source": true, "license": null, "url": "https://github.com/microsoft/wassette", "repo_url": "https://github.com/microsoft/wassette", "description": "Wasm Components exposed via MCP, using Wasmtime runtime with agents fetching Wasm tools from OCI registries.", "isolation_type": [ "wasm" ], "capabilities": [ "Wasm Component Model", "MCP interface", "Deny-by-default security", "Wasmtime runtime (browser-grade isolation)", "OCI registry integration" ], "requirements": [ "Rust toolchain", "MCP-compatible agent" ], "limitations": [ "Wasm only (must compile tools to Wasm)", "Early ecosystem" ], "notes": "Interesting intersection of MCP and Wasm — agents discover and load sandboxed tools via MCP from OCI registries. Microsoft backing. Released Aug 2025.", "isolation_tier": "wasm", "adoption_effort": "compose", "deployment_model": "local" }, { "name": "Pyodide", "category": "wasm-runtime", "maintainer": "Pyodide community (Mozilla origin)", "open_source": true, "license": "MPL-2.0", "url": "https://github.com/pyodide/pyodide", "repo_url": "https://github.com/pyodide/pyodide", "description": "CPython compiled to WebAssembly providing browser-grade sandbox security for Python execution.", "isolation_type": [ "wasm" ], "capabilities": [ "Full CPython in Wasm", "Browser-grade isolation", "Supports NumPy, Pandas, and other scientific packages" ], "requirements": [ "Browser or Wasm runtime" ], "limitations": [ "Python only", "Not all C extensions supported", "No native filesystem or network access", "Performance overhead vs. native CPython" ], "notes": "Good for sandboxing Python-only agent code execution where you need browser-grade isolation guarantees without running a VM.", "isolation_tier": "wasm", "adoption_effort": "compose", "deployment_model": "local" }, { "name": "mitos", "category": "kubernetes", "maintainer": "mitos-run", "open_source": true, "license": "Apache-2.0", "url": "https://github.com/mitos-run/mitos", "repo_url": "https://github.com/mitos-run/mitos", "description": "Kubernetes-native runtime that gives each agent a Firecracker microVM and live copy-on-write forks a running VM into N siblings in tens of milliseconds, with durable versioned workspaces and declarative CRDs.", "isolation_type": [ "microvm", "kvm" ], "capabilities": [ "Firecracker microVM per agent (KVM hardware isolation)", "Live copy-on-write fork of a running VM into N siblings (tens of ms)", "Restore from memory snapshots in milliseconds", "Durable, versioned workspaces", "Declarative CRDs with a Kubernetes operator", "KVM device-plugin for scheduling microVMs", "Go SDK" ], "requirements": [ "Kubernetes", "Nodes with KVM (bare-metal or nested virtualization)", "Self-hosted" ], "limitations": [ "Very new (created May 2026); prerelease tags", "Alpha — features split across \"husk\" and \"engine\" paths mid-migration", "Linux/KVM only" ], "notes": "Distinct from raw Firecracker (already listed): a live copy-on-write fork of a warm, running microVM plus a Kubernetes operator, CRDs, and a KVM device-plugin. Fast memory-snapshot restore suits parallel agent exploration and RL-style environment resets.", "isolation_tier": "microvm", "adoption_effort": "install", "deployment_model": "kubernetes" }, { "name": "Containarium", "category": "standalone", "maintainer": "FootprintAI", "open_source": true, "license": "Apache-2.0", "url": "https://containarium.dev", "repo_url": "https://github.com/FootprintAI/Containarium", "description": "Self-hostable agent runtime that gives each agent a persistent, SSH-reachable LXC/Incus box with per-tenant network isolation and an in-box MCP server; Kubernetes and LXC backends with GPU passthrough.", "isolation_type": [ "container" ], "capabilities": [ "Persistent, SSH-reachable LXC/Incus box per agent", "Per-tenant network isolation (agent holds an SSH key, not a kube-apiserver token)", "Userspace SOCKS5 egress proxy for network policy", "MCP-native admin CLI plus a second MCP server running inside the box", "Kubernetes and LXC/Incus backends", "GPU passthrough", "Port exposure to the public internet" ], "requirements": [ "Linux with LXC/Incus, or Kubernetes", "Go 1.25 to build", "Self-hosted" ], "limitations": [ "eBPF egress policy is experimental (under experimental/); the enforced egress path is the SOCKS5 proxy", "In-box file-ops sandbox (AGENTBOX_ROOT) is opt-in, default-off", "Container isolation (shared kernel)" ], "notes": "SSH-native per-tenant LXC/Incus boxes; blast radius is bounded by an SSH key rather than a cluster token. Ships two MCP servers (host admin and an in-box shell_exec). The tagline advertises eBPF egress, but that code is experimental — the shipping egress control is a userspace SOCKS5 proxy.", "isolation_tier": "container", "adoption_effort": "install", "deployment_model": "self-hosted" }, { "name": "sandcat", "category": "dev-environment", "maintainer": "VirtusLab", "open_source": true, "license": "Apache-2.0", "url": "https://github.com/VirtusLab/sandcat", "repo_url": "https://github.com/VirtusLab/sandcat", "description": "Docker/devcontainer sandbox that routes all container traffic through a transparent WireGuard-to-mitmproxy for allow/deny egress filtering and injects secrets at the proxy so the container never sees real credential values.", "isolation_type": [ "container" ], "capabilities": [ "Devcontainer or standalone Docker sandbox", "Transparent WireGuard tunnel routing all HTTP/S, DNS, and TCP/UDP to mitmproxy", "Allow/deny list-based network egress engine", "Proxy-level secret substitution (real credentials never enter the container)", "Runs agents in bypass / auto-approve mode within the boundary", "VS Code / IDE integration", "CLI wrapper around docker-compose" ], "requirements": [ "Docker", "Linux or macOS" ], "limitations": [ "Container isolation only (shared kernel)", "Templates need per-project tuning for the development stack" ], "notes": "Transparent full-traffic capture via WireGuard (not per-tool HTTP_PROXY) combined with proxy-level secret substitution brings the credential-proxy pattern — previously VM-tier only in this list (nono) — down to the container tier. Part of VirtusLab's Visdom delivery infrastructure.", "isolation_tier": "container", "adoption_effort": "install", "deployment_model": "local" }, { "name": "warren", "category": "standalone", "maintainer": "jayminwest", "open_source": true, "license": "MIT", "url": "https://github.com/jayminwest/warren", "repo_url": "https://github.com/jayminwest/warren", "description": "Self-hostable control plane and UI for ephemeral coding agents; each run executes in a native bubblewrap sandbox, validates, pushes a branch, and spins down, with live event streaming, mid-run steering, and human sign-off / PR-merge-gated dispatch.", "isolation_type": [ "user-namespace" ], "capabilities": [ "Native bubblewrap-isolated workspace per run (host unreachable)", "Control plane reaches the sandbox runtime over a unix socket with a bearer token", "Live NDJSON event streaming", "Mid-run steering (POST /steer)", "Human sign-off gates that arm dispatch", "Serial plan-run dispatch gated on prior-PR merges", "Built-in claude-code agent plus a steerable alternative harness", "Single container/volume/HTTP API/UI; optional Postgres backend" ], "requirements": [ "Docker (single container), or Fly.io / a cluster", "A GitHub repo URL and a prompt" ], "limitations": [ "Early (v0.6.2); org-readiness features (SSO, remote workers, MCP, audit, budgets) on the roadmap", "Process-level isolation (bubblewrap), shared kernel" ], "notes": "Unlike control planes that delegate isolation to a cloud backend, warren ships its own bubblewrap sandbox — the host is unreachable and the control plane talks to the runtime over a unix socket. The differentiator is the governance layer (mid-run steering, sign-off gates, PR-merge-gated serial dispatch) on native isolation. 33 scenario-based acceptance tests; runs on Fly.io.", "isolation_tier": "process", "adoption_effort": "install", "deployment_model": "self-hosted" }, { "name": "klangk", "category": "dev-environment", "maintainer": "mcdonc", "open_source": true, "license": "MIT", "url": "https://mcdonc.github.io/klangk/", "repo_url": "https://github.com/mcdonc/klangk", "description": "Self-hosted multi-user collaborative coding platform that runs each user's agent workspace in its own rootless-podman container, with real-time collaboration (presence, terminal-sharing, ACLs) and bundled agents.", "isolation_type": [ "container", "seccomp" ], "capabilities": [ "Rootless podman, one container per workspace (filesystem, process, network)", "pasta networking and seccomp profiles", "Per-workspace JWT and per-user bind-mounted homes", "Multi-user real-time collaboration (presence, terminal-sharing, ACLs)", "Bundled agents (OpenClaw, Hermes, Pi)", "Flutter web UI with a FastAPI backend" ], "requirements": [ "Podman (rootless)", "Linux", "Self-hosted" ], "limitations": [ "Commodity container isolation (rootless podman); no novel security primitive", "Broad platform scope beyond a sandbox primitive", "Early-stage (14 stars, created May 2026)" ], "notes": "The only multi-user collaborative sandbox platform in this list — the isolation axis is the per-user workspace (rootless podman), not multiple parallel agents (see LINCE and warren for that). The differentiator is the team-collaboration use case (presence, terminal-sharing, ACLs) on real per-workspace container isolation, not the isolation mechanism itself.", "isolation_tier": "container", "adoption_effort": "install", "deployment_model": "self-hosted" }, { "name": "DAM", "category": "kubernetes", "maintainer": "dam-agents (IBM)", "open_source": true, "license": "Apache-2.0", "url": "https://github.com/dam-agents/dam", "repo_url": "https://github.com/dam-agents/dam", "description": "Self-hostable Kubernetes platform for running headless coding-agent harnesses, each in an isolated pod with deny-all-egress NetworkPolicy, pod SecurityContextConstraints, a policy-enforced access gateway, and zero-trust credential injection.", "isolation_type": [ "container" ], "capabilities": [ "Isolated Kubernetes pod per agent", "Deny-all egress NetworkPolicy per agent", "OpenShift SecurityContextConstraints (pod hardening)", "Policy-enforced gateway for all agent access", "Zero-trust credential injection (credentials never exposed to the runtime)", "CRDs (agents/forks/runs) with an operator", "Web UI, CLI, Slack, and scheduled triggers", "ACP-compatible bring-your-own harness (Claude Code, Pi, Bob, Codex)" ], "requirements": [ "Kubernetes (Helm chart)", "Self-hosted (a hosted option is waitlist-gated)" ], "limitations": [ "Very new (~2 months, 10 stars at inclusion)", "Hosted service is waitlist-gated" ], "notes": "Brings a credential proxy plus a policy-enforced egress gateway to the Kubernetes tier — most k8s sandbox entries isolate pods but do not proxy credentials. IBM-backed (ibm.biz docs; the bundled \"Bob\" harness targets IBM workflows). Runs any ACP-compatible harness, not just the bundled ones.", "isolation_tier": "container", "adoption_effort": "install", "deployment_model": "kubernetes" }, { "name": "bx-mac", "category": "standalone", "maintainer": "holtwick", "open_source": true, "license": "MIT", "url": "https://github.com/holtwick/bx-mac", "repo_url": "https://github.com/holtwick/bx-mac", "description": "macOS CLI that launches GUI apps and agent CLIs under a generated Seatbelt profile denying access to everything in the home directory except the specified project directories.", "isolation_type": [ "seatbelt" ], "capabilities": [ "Kernel-enforced filesystem isolation via sandbox-exec with generated SBPL profiles", "Sandboxes full GUI IDEs (VSCode, Cursor, Xcode, Zed), terminals, and arbitrary commands", "Electron detection that disables Chromium's internal sandbox to avoid Seatbelt conflicts", "Multi-directory sessions; gitignore-style .bxignore per-project secret blocking", "Hardcoded denies for ~/.ssh, ~/.gnupg, ~/.docker, and sensitive ~/Library paths", "Dry-run mode to preview the generated profile" ], "requirements": [ "macOS", "Node >= 22 (Homebrew tap or npm install bx-mac)" ], "limitations": [ "Filesystem only — no network or process isolation", "Allow-first blocklist model — $HOME is scanned at launch; files created after launch are not blocked, and paths outside $HOME are broadly allowed", "Relies on deprecated sandbox-exec; single maintainer" ], "notes": "The only Seatbelt wrapper here that targets whole GUI IDEs rather than CLI agent processes. Weaker guarantee than the deny-first wrappers (fence, hazmat, jailoc, sand): the profile is a launch-time snapshot of $HOME with deny rules, and the README states plainly that this is protection against accidental or misguided file access, not airtight isolation.", "isolation_tier": "process", "adoption_effort": "install", "deployment_model": "local" }, { "name": "agent-glovebox", "category": "standalone", "maintainer": "AlexanderMattTurner", "open_source": true, "license": "Apache-2.0", "url": "https://github.com/AlexanderMattTurner/agent-glovebox", "repo_url": "https://github.com/AlexanderMattTurner/agent-glovebox", "description": "Security wrapper that runs Claude Code sessions inside a Docker sbx microVM with an egress allowlist, a second-model monitor gating tool calls, per-repo credential scoping, and a tamper-evident audit log.", "isolation_type": [ "microvm" ], "capabilities": [ "Hypervisor-isolated microVM via Docker's sbx runtime (Linux/KVM, Apple Silicon macOS, WSL2)", "Project-directory-only bind mount; read-only system filesystems; unprivileged user; ephemeral per-session volumes", "Network egress restricted to an allowlist firewall", "Second-model monitor gates flagged tool calls, sends phone push notifications, and can halt the agent remotely", "Per-repository GitHub tokens generated outside the sandbox and never mounted into it", "Tamper-evident audit log stored outside the sandbox; panic command captures a forensics snapshot", "Edits returned on a glovebox/* branch for manual approval", "Privacy modes routing inference to open-weights or TEE-hosted providers" ], "requirements": [ "Docker with the sbx sandbox runtime", "Claude Code" ], "limitations": [ "Very new (created 2026-05-24; ~10 weeks at inclusion)", "Monitor and sanitization layers are best-effort filters on top of the hard boundaries" ], "notes": "Clears the container-tier bar on three axes at once — per-repo credential scoping, second-model threat detection with human-in-the-loop halt, and an external tamper-evident audit trail — a combination none of the other Claude Code wrappers offer. Ships a written threat model and heavy security CI (gitleaks, grype, mutation testing), unusual at its size.", "isolation_tier": "microvm", "adoption_effort": "install", "deployment_model": "local" }, { "name": "temps", "category": "standalone", "maintainer": "gotempsh (David Viejo)", "open_source": true, "license": "Apache-2.0", "url": "https://github.com/gotempsh/temps", "repo_url": "https://github.com/gotempsh/temps", "description": "Self-hosted Rust PaaS whose sandbox subsystem exposes a Vercel-Sandbox-compatible API with hardened Docker containers by default and opt-in Firecracker microVMs.", "isolation_type": [ "container", "microvm", "kvm" ], "capabilities": [ "Vercel Sandbox SDK-compatible API with per-sandbox backend selection", "Hardened Docker default (CapDrop=ALL, minimal capability adds)", "Opt-in Firecracker backend — pinned guest kernel, rootfs built from the OCI image, vsock guest agent, TAP/NAT networking with guest-to-host and cloud-metadata paths dropped", "Requesting Firecracker on a non-KVM host fails with 422 rather than silently downgrading", "Full PaaS around it — git-push deploys, observability, analytics, email, AI gateway" ], "requirements": [ "Self-hosted (Rust binary)", "Linux with /dev/kvm for the Firecracker backend; Docker as the image toolchain" ], "limitations": [ "Sandboxing is one subsystem of a much larger platform", "Firecracker backend ~2 weeks old at inclusion; jailer deferred (VMM runs as the server's user); egress restriction deferred (restricted mode fails closed to no-network)", "Effectively single-maintainer" ], "notes": "The only self-hostable entry offering drop-in Vercel Sandbox SDK compatibility on your own hardware. The Firecracker backend is real in-repo code (vsock agent, e2e test, design ADR), not a wrapper over an external sandbox API — but it is weeks old; the Docker path is the battle-tested default.", "isolation_tier": "container", "adoption_effort": "install", "deployment_model": "self-hosted" }, { "name": "cplt", "category": "standalone", "maintainer": "NAV (Norwegian Labour and Welfare Administration)", "open_source": true, "license": "MIT", "url": "https://github.com/navikt/cplt", "repo_url": "https://github.com/navikt/cplt", "description": "Single static Rust binary that runs AI coding agent CLIs under OS sandbox primitives — Seatbelt on macOS, Landlock plus seccomp-BPF on Linux — with default-deny credential paths, a domain-filtering egress proxy, and a version-controlled per-repo policy file.", "isolation_type": [ "seatbelt", "landlock", "seccomp", "user-namespace" ], "capabilities": [ "Kernel-enforced filesystem, network, and syscall restrictions with no Docker or VM", "Runs Copilot CLI, OpenCode, Gemini CLI, Antigravity, Pi, Claude Code, or a plain shell", "Default-deny on ~/.ssh, ~/.gnupg, ~/.aws, ~/.kube, .env*, key files, and 15+ credential dirs", "Kernel-blocked writes to .git/hooks, .git/config, and .gitmodules (persistence vectors)", "CONNECT proxy with domain allow/block lists and egress auditing; localhost outbound kernel-blocked", "Committed .cplt.toml policy — deny rules auto-apply and only tighten; proposals require developer sign-off via cplt trust accept", "Env-var allowlisting (blocks AWS_*, *_TOKEN, *_SECRET); npm postinstall scripts disabled by default", "Optional bubblewrap namespace isolation on Linux" ], "requirements": [ "macOS, or Linux kernel 5.13+ (full network filtering needs 6.7+)" ], "limitations": [ "Linux enforcement self-described as weaker than macOS", "gh/git guard wrappers are soft barriers, not kernel-enforced", "Container isolation explicitly out of scope" ], "notes": "Backed by NAV, Norway's national welfare agency — rare institutional provenance in this space. The differentiator is the governance model: the policy file lives in version control, deny rules can only tighten, and loosening requires an explicit trust-acceptance workflow, making agent policy team-auditable in a way no other wrapper here offers.", "isolation_tier": "process", "adoption_effort": "install", "deployment_model": "local" }, { "name": "hull", "category": "standalone", "maintainer": "Artalis", "open_source": true, "license": "AGPL-3.0", "url": "https://github.com/artalis-io/hull", "repo_url": "https://github.com/artalis-io/hull", "description": "Single-binary application runtime executing Lua, QuickJS, and WASM code under manifest-declared capability allowlists enforced by a userspace capability layer plus kernel sandboxes (seccomp-bpf and Landlock, Seatbelt, or pledge/unveil).", "isolation_type": [ "seccomp", "landlock", "seatbelt", "wasm" ], "capabilities": [ "Kernel enforcement per platform — seccomp-bpf + Landlock on Linux (violation SIGKILL), deny-default Seatbelt SBPL on macOS, pledge/unveil on OpenBSD and Cosmopolitan APE builds", "Manifest-declared allowlists for filesystem paths, outbound hosts, env vars, and DB access", "Two-phase sandbox lifecycle (before app load, after manifest resolution)", "WASM compute modules in WAMR — no WASI, single host call, gas metering, 2 MiB default heap", "QuickJS instruction-count gas metering; W^X enforcement", "Apps compile to Ed25519-signed static executables with hull verify and JSON audit logging", "libhull.a lets native C/Rust/Zig programs link just the sandbox and capability layer" ], "requirements": [ "Linux, macOS, or OpenBSD (single binary; Cosmopolitan builds run cross-platform)" ], "limitations": [ "Sandboxes code written for its runtime, not arbitrary processes", "Solo maintainer; ~5 months old at inclusion; pre-stable APIs", "Security audits are self-authored; dual AGPL-3.0/commercial with copyright-assignment CLA" ], "notes": "No other entry combines a multi-language app runtime with a process-level kernel sandbox: the wasm-runtime entries isolate only WASM, and the kernel-primitive wrappers (nono, cplt) wrap existing commands rather than providing the runtime. Aimed at running AI-generated application code where the signed manifest is the verifiable capability declaration.", "isolation_tier": "process", "adoption_effort": "install", "deployment_model": "local" }, { "name": "gbash", "category": "standalone", "maintainer": "ewhauser", "open_source": true, "license": "Apache-2.0", "url": "https://github.com/ewhauser/gbash", "repo_url": "https://github.com/ewhauser/gbash", "description": "Pure-Go in-process bash interpreter that executes agent shell scripts against a virtual filesystem and ~90 built-in command implementations, with no fork/exec path to host binaries.", "isolation_type": [ "process" ], "capabilities": [ "Registry-backed command resolution — unknown commands exit 127 and never reach host binaries", "Virtual in-memory filesystem; host mounts opt-in and read-only under a copy-on-write overlay", "Network off by default; allowlist-based HTTP client with redirect revalidation and response-size caps", "Execution budgets — command count, loop iterations, glob expansion, substitution depth, output caps", "Go library, CLI, JSON-RPC server mode, persistent sessions, and a wasm build" ], "requirements": [ "Go (library) or single binary" ], "limitations": [ "Alpha; single maintainer", "No kernel boundary — explicitly not hardened against interpreter bugs or DoS beyond the budgets", "Host-directory and workspace modes expose real host paths; server mode is unauthenticated (loopback/Unix-socket defaults)" ], "notes": "The interpreter-level sandbox class of monty, applied to bash — nothing else on the list sandboxes the shell itself. Ships a detailed THREAT_MODEL.md with per-boundary data-flow analysis and a published coreutils-compatibility report; the README is explicit that OS- or process-level isolation should wrap it when containment against interpreter bugs matters.", "isolation_tier": "wasm", "adoption_effort": "install", "deployment_model": "local" }, { "name": "Tencent Cloud Agent Sandbox (AGS)", "category": "cloud-managed", "maintainer": "Tencent Cloud", "open_source": false, "license": null, "url": "https://cloud.tencent.com/product/ags", "repo_url": null, "description": "Managed Tencent Cloud service running agent workloads in per-sandbox KVM microVMs with dedicated guest kernels, exposing E2B-compatible APIs across code-execution, browser, Android, Windows, and computer-use sandbox types.", "isolation_type": [ "microvm", "kvm" ], "capabilities": [ "Per-sandbox microVM with a dedicated guest kernel (KVM hardware virtualization)", "eBPF network segmentation", "E2B-compatible API, Python/Go/Node SDKs, and an agr CLI", "Code-execution, browser, mobile (Android/Appium), Windows, and computer-use sandbox types", "Custom container images", "Vendor claims <60ms cold start, <5MB per-sandbox memory overhead, 2,000+ sandboxes per 96-vCPU host" ], "requirements": [ "Tencent Cloud (mainland China) account" ], "limitations": [ "Closed beta; one documented region (ap-guangzhou); no published pricing", "Chinese-only product and docs pages (English exists only in the GitHub cookbook)" ], "notes": "The only cloud-managed entry offering managed Android and Windows sandboxes. Press coverage indicates the engine is Tencent's open-source CubeSandbox (also listed) — inferred, not stated on the product page. Samples at github.com/TencentCloudAgentRuntime/ags-cookbook.", "isolation_tier": "microvm", "adoption_effort": "sign-up", "deployment_model": "cloud" }, { "name": "CubeSandbox", "category": "standalone", "maintainer": "Tencent Cloud", "open_source": true, "license": "Apache-2.0", "url": "https://github.com/TencentCloud/CubeSandbox", "repo_url": "https://github.com/TencentCloud/CubeSandbox", "description": "Self-hostable microVM sandbox service built on RustVMM and KVM, E2B-SDK-compatible, creating hardware-isolated sandboxes in under 60ms with copy-on-write snapshot, clone, and rollback.", "isolation_type": [ "microvm", "kvm" ], "capabilities": [ "RustVMM + KVM microVM per sandbox (hardware-level isolation)", "Sandbox creation <60ms with <5MB memory overhead (vendor benchmarks)", "E2B-compatible SDK (PyPI cubesandbox)", "CubeCoW copy-on-write engine — event-level snapshots, instant clone, rollback to any saved state", "Credential vault — agents call external APIs while keys never enter the sandbox", "Per-sandbox traffic tokens and policy-routing egress", "AutoPause/AutoResume for idle sandboxes", "Single-node, multi-node cluster, Kubernetes, and Terraform deployment; ARM64 support" ], "requirements": [ "Linux hosts with KVM", "Self-hosted" ], "limitations": [ "v0.x (first open-source release April 2026); fast-moving surface", "License is Tencent's Apache-2.0 variant with third-party carve-outs (SPDX NOASSERTION on GitHub)" ], "notes": "Missed by keyword discovery despite ~10.9k stars — surfaced while investigating Tencent's managed AGS service, which press coverage says runs on this engine. Combines three properties usually found separately: hardware VM isolation, credential brokering, and sub-second CoW snapshot/rollback — the closest self-hosted analog to mitos's fork model, at much larger scale and with an E2B-compatible API.", "isolation_tier": "microvm", "adoption_effort": "install", "deployment_model": "self-hosted" }, { "name": "axern", "category": "standalone", "maintainer": "cofy-x (Chen Yingwei)", "open_source": true, "license": "Apache-2.0", "url": "https://github.com/cofy-x/axern", "repo_url": "https://github.com/cofy-x/axern", "description": "Self-hostable sandbox platform running untrusted agent code under gVisor and trusted long-lived services under runc, behind one PostgreSQL-backed control plane with Go/Python/TypeScript SDKs.", "isolation_type": [ "gvisor", "container" ], "capabilities": [ "gVisor (runsc) user-space kernel as the untrusted-code boundary", "Dual runtime — runc containers for trusted durable services under the same lifecycle APIs", "Control plane owns placement, leases, replicas, health, storage, and rollouts across restarts", "OCI and Nydus (lazy-loading rootfs) image paths", "Docker Compose local mode and a cloud-neutral Helm chart", "Axrun agent-task harness with verification, trajectories, and typed artifacts" ], "requirements": [ "Docker Compose (local) or Kubernetes (Helm)", "Linux hosts for runsc" ], "limitations": [ "Six days of public history at inclusion; single maintainer; pre-1.0", "README disclaims multi-tenant production safety of default deployments" ], "notes": "The only self-hostable platform entry using gVisor as its untrusted-code boundary — the peers are plain-container (OpenSandbox, EdgeBox, agent-infra) or microVM (microsandbox). Included with strong maturity caveats: the scaffolding (docs site, three SDKs, Helm chart, governance files) far exceeds its public age, implying prior private development; sustainability unproven.", "isolation_tier": "container", "adoption_effort": "compose", "deployment_model": "self-hosted" } ] }