Agent Sandboxesagentsandboxes.org
Alternatives

nono alternatives

Answer in brief

The 6 alternatives below are grouped by kind of sandbox, and each says what it does differently from nono. Start from whatever made you look: missing GPUs, session limits, self-hosting, pricing or isolation.

By the Agent Sandboxes editors · Updated

Why teams look beyond nono

A strong choice for per-tool-call policy and credential brokering around local coding agents, provided OS-level isolation is enough for your threat model.

  • OS-level sandboxing shares the host kernel; not a VM boundary
  • Pre-1.0 with APIs still stabilising
  • Native Windows is only via WSL2; no hosted option

nono alternatives, by kind

Isolation primitives and runtimes

The hypervisors, user-space kernels, OS sandboxes and WebAssembly runtimes that sandbox platforms build on.

  • bubblewrap

    The unprivileged Linux namespace sandboxer behind Flatpak and Anthropic's sandbox runtime; you assemble the policy from command-line flags.

    • Linux namespaces
    • Open source
    • Self-hostable

    How it differs: Lightweight process sandboxing on Linux where you control the policy and do not need a kernel boundary. The right primitive for a laptop or CI sandbox on Linux when you can write the policy yourself; not a substitute for a VM.

    Full profile →bubblewrap alternativesWebsite ↗

Local sandboxes for coding agents

Isolation for agents like Claude Code, Codex or Gemini CLI on your own laptop.

  • agents-sandbox

    GPL-3.0 launcher that gives each project and coding agent its own microsandbox microVM on Linux/KVM or Apple Silicon macOS, with secrets kept on the host.

    • microsandbox microVM
    • Open source

    How it differs: Developers who want each coding agent confined to a per-project microVM on their own Linux or Apple Silicon machine. A focused per-project microVM launcher for opencode users; support for other agents is still experimental.

    Full profile →agents-sandbox alternativesWebsite ↗

  • Anthropic Sandbox Runtime

    Open-source CLI and library (`srt`) that restricts filesystem and network access for any local process at the OS level, without a container or VM.

    • OS-level (Seatbelt / bubblewrap)
    • Open source
    • Self-hostable

    How it differs: Lightweight local sandboxing of coding agents and CLI tools. Excellent lightweight guardrail for local agents; pair with a VM for untrusted multi-tenant code.

    Full profile →Website ↗

  • Codex CLI sandboxing

    Codex CLI's built-in sandbox: Seatbelt on macOS, bubblewrap on Linux/WSL2 and a native Windows sandbox, with read-only, workspace-write and full-access modes.

    • Seatbelt / bubblewrap / Windows
    • Open source

    How it differs: Confining Codex CLI command execution on macOS, Linux or Windows without containers. Solid built-in confinement for Codex CLI across all three desktop platforms; it is a CLI feature, not a reusable sandbox.

    Full profile →Codex CLI sandboxing alternativesWebsite ↗

  • Gemini CLI sandboxing

    Gemini CLI's built-in sandbox: macOS Seatbelt profiles or a Docker/Podman container around the agent's tool calls, with gVisor, LXC and a Windows option.

    • Seatbelt or container
    • Open source

    How it differs: Confining Gemini CLI tool execution on a developer machine using built-in OS or container sandboxing. Adequate built-in confinement for Gemini CLI users; it is a feature of the CLI rather than a general sandbox.

    Full profile →Gemini CLI sandboxing alternativesWebsite ↗

  • Minimal

    Open-source CLI that runs coding agents in declarative, isolated sessions built from a minimal.toml and a from-source package catalogue, on Linux namespaces or a libkrun microVM.

    • namespaces or libkrun microVM
    • Open source

    How it differs: Reproducible, declaratively scoped local sessions for Claude Code, Codex, Gemini and Pi with a supply-chain-audited toolchain. A promising beta for developers who want declarative, reproducible agent sessions and are comfortable with a young toolchain.

    Full profile →Minimal alternativesWebsite ↗

nono vs alternatives

SandboxIsolationOpen sourceSelf-host / BYOCCold start (vendor)Max sessionSnapshots / pauseGPUSDKs
nonoLandlock / SeatbeltYesNo / NoNot documentedNot documentedYes / Not documentedNot documentedCLI, Rust, Python, JavaScript/TypeScript, Go
agents-sandboxmicrosandbox microVMYesNo / NoNot documentedNot documentedNot documented / Not documentedNot documentedCLI
Anthropic Sandbox RuntimeOS-level (Seatbelt / bubblewrap)YesYes / Not documentedProcess startNot documentedNo / NoNot documentedCLI (srt), TypeScript (npm)
bubblewrapLinux namespacesYesYes / NoNot documentedNot documentedNo / NoNot documentedCLI
Codex CLI sandboxingSeatbelt / bubblewrap / WindowsYesNo / NoNot documentedNot documentedNo / Not documentedNot documentedCLI
Gemini CLI sandboxingSeatbelt or containerYesNo / NoNot documentedNot documentedNo / Not documentedNot documentedCLI
Minimalnamespaces or libkrun microVMYesNo / NoNot documentedNot documentedNot documented / Not documentedNot documentedCLI, MCP server

Frequently asked questions

What are the main alternatives to nono?
agents-sandbox, Anthropic Sandbox Runtime, bubblewrap, Codex CLI sandboxing, Gemini CLI sandboxing, Minimal. Which one fits depends on what you need that nono does not offer; each entry above explains how it differs.
Is there an open-source alternative to nono?

Cite this page

Agent Sandboxes. (2026). nono alternatives. agentsandboxes.org. Last reviewed November 9, 2026. https://agentsandboxes.org/alternatives/nono/

Found an error or a missing sandbox? Submit a correction — every entry links to the sources it relies on.