opensandbox-group/OpenSandbox

Secure, Fast, and Extensible Sandbox runtime for AI agents.

What it solves

OpenSandbox provides isolated, secure environments (sandboxes) for AI agents to execute code, run shell commands, manage files, and operate browsers or desktops on a user's own infrastructure. It eliminates the risk of running model-generated code on a host machine while providing the flexibility to scale from local Docker setups to production Kubernetes clusters.

How it works

It uses a unified sandbox API to manage the lifecycle of isolated environments. It supports multiple runtimes, including a high-density "Fast Sandbox" based on Firecracker microVMs for rapid creation (64ms P50) and the ability to pause and resume states. The system includes a network ingress gateway for inbound traffic and egress policies to control outbound access, as well as a Credential Vault to inject external service credentials without exposing them to the sandbox workload.

Who it’s for

  • AI Agent Developers: Those building coding agents, data analysis tools, or browser automation agents who need a safe execution environment.
  • ML Engineers: Users running agent evaluations or RL training workloads that require many separate, clean environments.
  • DevOps/Infrastructure Engineers: Teams wanting to host their own agent execution infrastructure on Kubernetes.

Highlights

  • High-Performance Runtimes: Extremely fast sandbox startup times using Firecracker on Kubernetes.
  • Multi-Runtime Support: Seamless transition from local Docker development to Kubernetes deployment.
  • Comprehensive Tooling: SDKs for Python, Java, TypeScript, C#, and Go, plus a CLI and an MCP server for integration with clients like Claude Code and Cursor.
  • Security Controls: Built-in network access control (ingress/egress) and a secure credential vault.

Related

  • Dispatch
    Securing AI Agents with Isolated Docker Sandboxes

    An exploration of agent-sandbox, a tool designed to run AI coding agents within isolated Docker containers to prevent unauthorized system access and ensure execution safety.

  • Dispatch
    Sandboxing AI Agents and Developer CLIs: The Critical Need for Isolation

    An exploration of the disappeared urgency for secure execution environments for AI agents and developer tools, highlighting the challenges of preventing unauthorized system access.

  • Project
    tensorlakeai/tensorlake

    Tensorlake is a cloud platform that offers fast, scalable MicroVM sandboxes for running AI agents safely. It provides a Python SDK and CLI to create, manage, snapshot, and pool sandboxes, a versioned object‑store filesystem, and a serverless orchestration layer where functions (decorated with `@function`) run in isolated sandboxes and can be invoked via HTTP.

  • Project
    tastyeffectco/sandboxd

    An open-source, self-hosted AI app builder engine that uses coding agents to create and host real applications in isolated Docker sandboxes on your own server.

  • Project
    superradcompany/microsandbox

    A tool for running untrusted workloads in fast, local microVMs with hardware-level isolation, specifically designed for AI agents and automated code execution.