sandbox
OpenShell is the safe, private runtime for autonomous AI agents.
NVIDIA OpenShell is the safe, private runtime for autonomous AI agents. It provides sandboxed execution environments that protect your data, credentials, and infrastructure. Agents run with exactly the permissions they need and nothing more, governed by declarative policies that prevent unauthorized file access, data exfiltration, and uncontrolled network activity.
Related contents:
Run a single command in a speedy virtual machine with zero-setup vmexec is a zero-setup CLI tool that runs single commands in a throwaway virtual machines. The idea is for you to run a command in VM without having think about the performance implications, how to mount files, how to forward ports, etc. Nowadays, many are used to the convenience of container runners such as podman or docker but so far it hasn't been as covenient to run a VM, often requiring a manual set up step.
Related contents:
Component toolkit for creating live-running code editing experiences.
Sandpack is a component toolkit for creating your own live running code editing experience powered by CodeSandbox.
Full autonomy. Controlled environment. OS-level containment for AI coding agents on macOS.
macOS containment for AI agents — user isolation, kernel sandbox, pf firewall, DNS blocklist, backup/rollback. TLA+ verified.
AI coding agents are most useful when you let them work autonomously. But full autonomy means the agent runs with your full privileges, your credentials, your files.
Hazmat makes that safe.
Related contents:
Every agent deserves its own machine.
Run agents in secure, local-first sandboxes. On your laptop, in your VPC, on-prem, or in our cloud. Programmable, fast, and yours.
microsandbox takes a different approach: every sandbox is a real VM with its own Linux kernel. It provides security primitives for preventing exploits like secret exfiltration. And it runs locally on your machine.
Related contents:
Vulnerable REST API with OWASP top 10 vulnerabilities for security testing.
VAmPI is a vulnerable API made with Flask and it includes vulnerabilities from the OWASP top 10 vulnerabilities for APIs. It was created as I wanted a vulnerable API to evaluate the efficiency of tools used to detect security issues in APIs. It includes a switch on/off to allow the API to be vulnerable or not while testing. This allows to cover better the cases for false positives/negatives. VAmPI can also be used for learning/teaching purposes. You can find a bit more details about the vulnerabilities in erev0s.com.
A sandboxed bash interpreter for AI agents. Pure TypeScript with in-memory filesystem.
A simulated bash environment with an in-memory virtual filesystem, written in TypeScript. Designed for AI agents that need a secure, sandboxed bash environment. Supports optional network access via curl with secure-by-default URL filtering.
Malware analysis tool. Cuckoo3 is a Python 3 open source automated malware analysis system.
Cuckoo3 is an open-source tool to test suspicious files or links in a controlled environment. It will test them in a sandboxed platform emulator(s) and generate a report, showing what the files or websites did during the test.
Universal Sandbox Infrastructure for AI Applications.
Securely run commands, filesystems, code interpreters, browsers, and developer tools in isolated runtime environments.
OpenSandbox is a general-purpose sandbox platform for AI applications, offering multi-language SDKs, unified sandbox APIs, and Docker/Kubernetes runtimes for scenarios like Coding Agents, GUI Agents, Agent Evaluation, AI Code Execution, and RL Training.
Security, visibility, and authorization for AI agents
Leash wraps AI coding agents in containers and monitors their activity. You define policies in Cedar; Leash enforces them instantly.
Authorize and monitor your AI agents with policy enforcement, sandboxed execution, and real-time observability—ensuring they operate safely within your defined boundaries.
Create and manage micro VMs at scale for safe execution of untrusted code. Secure sandboxed compute for AI agents and workloads
K7 Demo
Katakate aims to make it easy to create, manage and orchestrate lightweight safe VM sandboxes for executing untrusted code, at scale. It is built on battle-tested VM isolation with Kata, Firecracker and Kubernetes. It is orignally motivated by AI agents that need to run arbitrary code at scale.
The Enterprise AI Agent Cloud.
AI Sandboxes for Open-source, secure environment with real-world tools for enterprise-grade agents.
Related contents:
Hyperlight is a lightweight Virtual Machine Manager (VMM) designed to be embedded within applications. It enables safe execution of untrusted code within micro virtual machines with very low latency and minimal overhead.
VMM for native-performance sandboxing.
TinyKVM is a simple, slim and specialized userspace emulator library with native performance.
TinyKVM is designed to execute regular Linux programs and also excels at request-based workloads in high-performance HTTP caches and web servers.
Related contents:
Vagrant is the command line utility for managing the lifecycle of virtual machines. Isolate dependencies and their configuration within a single disposable and consistent environment.
Related contents:
Isolated databases for every AI agent branch. Build, test, and migrate in parallel. Production stays untouched.
Database safety infrastructure for AFK agentic development.
SafeAgentDB is built for serious vibe coders shipping real products with a team — whether your teammates are people, AI agents, or both. Once you have many branches in flight at the same time, one shared database becomes the thing everyone breaks. SafeAgentDB gives every branch and PR a live preview URL backed by its own isolated database, so agents can run migrations, hydrate realistic data, and test real app behavior without risking production, corrupting shared development data, or stepping on each other.
Built first for Supabase + Vercel + GitHub Actions, with guidance for adapting the same infrastructure pattern to other stacks.
Lightweight, container-free sandbox for running commands with network and filesystem restrictions.
Fence wraps commands in a sandbox that blocks network access by default and restricts filesystem operations based on configurable rules. It's most useful for running semi-trusted code (package installs, build scripts, CI jobs, unfamiliar repos) with controlled side effects, and it can also complement AI coding agents as defense-in-depth.
Empowering your AI Agents. Instant, Concurrent, Secure & Lightweight Sandbox Service for AI Agents.
Cube Sandbox is a high-performance, out-of-the-box secure sandbox service built on RustVMM and KVM. It supports both single-node deployment and easy scaling to multi-node clusters. It is compatible with the E2B SDK and can create a hardware-isolated, fully serviceable sandbox in under 60ms with less than 5MB of memory overhead.
Persistent & Secure sandboxes for AI agents.
Give your agents lightning-fast sandboxes with persistent state and versioned filesystems.
Advanced vm/sandbox for Node.js. vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Securely!
Sandboxing for Nix.
NixPak is essentially a fancy declarative wrapper around bwrap. You can use it to sandbox all sorts of Nix-packaged applications, including graphical ones.
Let your AI go full send. Your home directory stays home.
Run Claude Code, Codex, or any AI coding agent in "yolo mode" without nuking your home directory.
Related contents:
PHPSandbox + Packagist. This is a playground to try Composer packages. With it, you can try 350k+ packages using a standard PHP v8.1 environment.
TIO is a family of online interpreters for an evergrowing list of practical and recreational programming languages. To use TIO, simply click the arrow below, pick a programming language, and start typing. Once you click the run button, your code is sent to a TIO arena, executed in a sandboxed environment, and the results are sent back to your browser. You can share your code by generating a client-side permalink that encodes code and input directly in the URL.
Agent Substrate is a system built on top of Kubernetes which manages agent-like workloads to achieve higher scale and efficiency than Kubernetes alone can offer, with lower latency. It builds on top of Kubernetes features like Pods and Pod autoscaling, but takes the Kubernetes control-plane out of the critical path to achieve lower latency.
Related contents:
Run Coding Agents in Sandboxes. Control Them Over HTTP. Supports Claude Code, Codex, OpenCode, and Amp.
Related contents:
Go hard on agents, not on your filesystem. easy containment for AI agents.
Use jai for effortless containment of AI agents on Linux. jai strives to be the easiest container in the world to configure--so easy that you never again need to run a code assistant without protection. It's not a substitute for docker or podman when you need better isolation. But if you regularly do risky things like run an AI CLI with your own privileges in your home directory on a computer that you care about, then jai could reduce the damage when things go wrong.
Go full --yolo. We've got you.
macOS-native sandboxing for local agents. Move fast, break nothing. Sandbox your local AI agents so they can read/write only what they need
Related contents:
Easy Linux virtual machine on MacOS to sandbox LLM agents.
Vibe is a quick, zero-configuration way to spin up a Linux virtual machine on Mac to sandbox LLM agents.
Related contents:
Godcoder doesn't just use a harness. It writes one, improves it, and optimizes it — autonomously, in real time.
A local-first, open-source coding agent for your desktop. Bring your own LLM key; your code stays on your machine and only ever leaves to the model provider. The AI Agent builds its own Harness.
Matchlock secures AI agent workloads with a Linux-based sandbox.
Matchlock is a CLI tool for running AI agents in ephemeral microVMs - with network allowlisting, secret injection via MITM proxy, and VM-level isolation. Your secrets never enter the VM.
Malware? Tear it apart, discover its ins and outs and collect actionable threat data. Cuckoo is the leading open source automated malware analysis system.
Efficient and consistent CI/CD with Kubernetes.
A solution for implementing efficient and consistent software delivery to Kubernetes facilitating best practices. werf is a CNCF Sandbox CLI tool to implement full-cycle CI/CD to Kubernetes easily. werf integrates into your CI system and leverages familiar and reliable technologies, such as Git, Dockerfile, Helm, and Buildah.
Self-hosted dev sandboxes with preview URLs. One command. No Kubernetes, perfect for coding agents and Saas factories.
The open-source engine for AI app-builder products. Give every user an isolated cloud dev environment, a built-in coding agent, and a live preview URL — self-hosted, on one machine, in one command.
A security-focused library OS supporting kernel- and user-mode execution.
LiteBox is a sandboxing library OS that drastically cuts down the interface to the host, thereby reducing attack surface. It focuses on easy interop of various "North" shims and "South" platforms. LiteBox is designed for usage in both kernel and non-kernel scenarios.
A Self-Hostable Wasm Sandbox for JavaScript Workers
Ever wanted to run a Cloudflare Workers-style handler, on a VPS or anywhere, without Node.js, Bun, or even Docker?
Kyushu is an open source CLI that lets you write a JavaScript or TypeScript handler, build it into a self-contained WebAssembly binary, and run it anywhere with one command - kyu.
Run AI Generated Code Locally. A secure local sandbox to run LLM-generated code using Apple containers.
CodeRunner is an MCP (Model Context Protocol) server that executes AI-generated code in a sandboxed environment on your Mac using Apple's native containers.
Related contents:
agent-sandbox enables easy management of isolated, stateful, singleton workloads, ideal for use cases like AI agent runtimes.
Related contents:
📦 Lightweight, ephemeral, sandboxes for Linux.
Create lightweight sandboxes for Linux with host isolation, rootfs images, and networking.
Microbox is a sandbox runtime that creates ephemeral and isolated execution environments on Linux by combining specific kernel features such as namespaces, cgroups, seccomp, and capabilities. It provides lightweight sandboxes to run container-like applications securely.
Dev Environment Management Platform. The future of dev environments.
Daytona is the enterprise-grade Codespaces alternative for managing self-hosted, secure and standardized development environments.
Related contents:
A lightweight sandboxing tool for enforcing filesystem and network restrictions on arbitrary processes at the OS level, without requiring a container.
Related contents:
Give a coding agent its own disposable Linux machine, not yours. Disposable, network-restricted Linux VMs for AI coding agents.
clawk is a third option. cd into a repo, type clawk, and Claude Code (or Codex, or a shell) is working inside a disposable Linux VM (your code mounted in, root in the guest, no permission prompts) while your files, your keychain, and the rest of your machine stay out of reach. The agent gets its own machine instead of yours.
In-browser Postgres sandbox with AI assistance.
With postgres.new, you can instantly spin up an unlimited number of Postgres databases that run directly in your browser (and soon, deploy them to S3).
Orchestrate sandboxed coding agents in TypeScript with sandcastle.run().
A TypeScript library for orchestrating AI coding agents in isolated sandboxes.
Secure, ephemeral browsing in a disposable VM (macOS only).
Bromure is a native macOS app that runs every browser session inside a lightweight, disposable Linux virtual machine using Apple's Virtualization.framework. The browser and your Mac don't share an operating system, a filesystem, or even a kernel. When you close the window, the VM is destroyed -- cookies, history, malware, trackers, all of it. Gone.
Sandbox any command with file, network, and credential controls.
Lightweight, cross-platform process sandboxing powered by OpenAI Codex's runtime. Sandbox any command with file, network, and credential controls.
A CLI to create code sandboxes with automatic HTTPS and long running processes in your cloud provider account.
Three primitives. Zero integration cost.
Effortlessly compose, extend, and observe every service in real-time for the first time ever. iii is the easiest way to compose, extend, and observe every service in your stack in real time.
Every backend starts as a project before the first line of business logic. Queues, cron, HTTP, state, observability, agents, and sandboxes each usually bring their own integration story. iii collapses that into one live system surface.
Save 98% of your AI coding agent's context window.
Context window optimization for AI coding agents. Sandboxes tool output, 98% reduction. 15 platforms