akitaonrails/ai-jail

Multi-OS sandbox to run AI agents with better constraints (it is not 100% secure, but enough)

What it solves

ai-jail provides a secure OS-level sandbox for running AI coding agents. It prevents agents from having unrestricted access to your host system, home directory, and sensitive credentials, reducing the risk of accidental or malicious damage when agents execute code or access files.

How it works

On Linux, the tool utilizes bubblewrap (bwrap) combined with Landlock, seccomp, and resource limits to isolate the process. On macOS, it uses the sandbox-exec interface. By default, it creates a private, ephemeral home directory (tmpfs) and restricts access to the network, GPU, display, and host IPC. Users can explicitly opt-in to specific capabilities (like network access or mounting specific agent credentials) via CLI flags or configuration files.

Who it’s for

Developers who use AI coding agents (such as Claude) and want to run them in a restricted environment to protect their host machine and personal data without needing a full virtual machine.

Highlights

  • Secure Defaults: Network, GPU, display, and host home access are disabled by default.
  • Granular Control: Ability to selectively mount agent state, specific environment variables, or read-only/read-write paths.
  • Secret Protection: Supports masking or denying access to specific files or directories (e.g., .env files) within the project folder.
  • Cross-Platform: Supports Linux and macOS (via WSL2 for Windows).
  • Toolchain Integration: Integrates with mise to ensure agents have access to the correct project language versions.

Related

  • Project
    webcoyote/sandvault

    A macOS utility that sandboxes AI agents and shell commands using limited user accounts and sandbox-exec to prevent them from accessing sensitive host files.

  • Project
    finbarr/yolobox

    A containerized sandbox for AI coding agents that allows them to run commands with sudo privileges while protecting the host's home directory from accidental destruction.

  • Project
    opensandbox-group/OpenSandbox

    A general-purpose sandbox platform for AI applications that provides secure, isolated environments for code execution, agent evaluation, and RL training.

  • Project
    nikvdp/cco

    A sandboxing wrapper for Claude Code and other AI coding agents that provides secure isolation using native OS tools or Docker without sacrificing autonomous productivity.

  • Project
    h5i-dev/h5i

    A lightweight, pure-Rust browser for AI agents that provides policy-controlled network access, detailed auditing, and multiple tiers of sandboxing.