Agent Sandboxesagentsandboxes.org
Alternatives

Pullrun alternatives

Answer in brief

The 6 alternatives below are grouped by kind of sandbox, and each says what it does differently from Pullrun. Start from whatever made you look: missing GPUs, session limits, self-hosting, pricing or isolation.

By the Agent Sandboxes editors · Updated

Why teams look beyond Pullrun

A promising self-hosted OCI-to-microVM runtime for teams who want to own the sandbox layer, but not yet a hosted platform.

  • No hosted service yet; the managed API is only "planned".
  • No language SDKs; interaction is through the CLI, Compose files or MCP.
  • Pause/resume of running VMs, GPU support and session limits are not documented.
  • Early project: v0.7.x, 134 stars and backends the README describes as still evolving.

Pullrun alternatives, by kind

Open-source runtimes to self-host

Open-source sandbox runtimes you run on your own servers or Kubernetes.

  • BoxLite

    Embeddable, daemonless microVM library that runs OCI images in hardware-isolated boxes on a laptop or server, with an optional managed cloud.

    • microVM + jailer
    • Open source
    • Self-hostable

    How it differs: Embedding a microVM sandbox directly in your own process on a laptop or server without running a daemon. A practical choice when you want microVM isolation embedded in your own process rather than behind a service.

    Full profile →BoxLite alternativesWebsite ↗

  • Celesto (SmolVM)

    Open-source microVM "computers" for agents from Celesto AI, published as the smolvm package, with Firecracker on Linux and QEMU on macOS, plus a hosted cloud option.

    • Firecracker / QEMU microVM
    • Open source
    • Self-hostable
    • Pause/resume

    How it differs: Running agent computers as microVMs on your own Linux or Apple Silicon machine, with the same API available as a hosted cloud computer. A young, alpha-labelled but feature-rich open-source microVM runtime that is easy to try locally on macOS or Linux and has a per-hour cloud behind it.

    Full profile →Celesto (SmolVM) alternativesWebsite ↗

  • Microsandbox

    Open-source, local-first microVM runtime that gives each sandbox its own Linux kernel, with an optional managed cloud.

    • MicroVM (libkrun)
    • Open source
    • Self-hostable
    • BYOC
    • Snapshots

    How it differs: Self-hosted microVM isolation on developer machines or your own servers. The most approachable way to get microVM-grade isolation locally or self-hosted.

    Full profile →Website ↗

Isolation primitives and runtimes

The hypervisors, user-space kernels, OS sandboxes and WebAssembly runtimes that sandbox platforms build on.

  • Firecracker

    The KVM-based microVM monitor from AWS that underpins Lambda and Fargate, and the sandboxes of E2B, Vercel, Fly.io, Koyeb and Northflank.

    • KVM microVM
    • Open source
    • Self-hostable
    • Pause/resume

    How it differs: Building your own microVM sandbox fleet on Linux hosts with KVM. The reference microVM primitive for sandbox platforms; choose it when you are building a platform rather than consuming one.

    Full profile →Firecracker alternativesWebsite ↗

Local sandboxes for coding agents

Isolation for agents like Claude Code, Codex or Gemini CLI on your own laptop.

  • Apple container

    Apple's open-source CLI that runs each Linux container in its own lightweight virtual machine on Apple silicon Macs.

    • Lightweight VM per container
    • Open source

    How it differs: Running Linux containers for coding agents on an Apple silicon Mac with VM-grade isolation instead of a shared VM. The strongest isolation you can get for local containers on a Mac from the OS vendor itself, at the cost of maturity and platform reach.

    Full profile →Apple container alternativesWebsite ↗

  • Docker Sandboxes

    Docker’s `sbx` CLI for running AI coding agents in microVM sandboxes on your machine, with an experimental Docker-hosted cloud.

    • MicroVM
    • Self-hostable
    • GPU
    • Pause/resume

    How it differs: Running coding agents unsupervised on a laptop with microVM isolation. The easiest way to give local coding agents a real microVM boundary.

    Full profile →Website ↗

Pullrun vs alternatives

SandboxIsolationOpen sourceSelf-host / BYOCCold start (vendor)Max sessionSnapshots / pauseGPUSDKs
PullrunFirecracker / Apple VM / runcYesYes / No~500 ms (claim)Not documentedYes / Not documentedNot documentedCLI, MCP server
Apple containerLightweight VM per containerYesNo / NoSub-second (claimed)Not documentedNo / NoNot documentedCLI
BoxLitemicroVM + jailerYesYes / No~1 s (claim)Not documentedNot documented / Not documentedNot documentedPython, JavaScript/TypeScript, Go, Rust, C, CLI, REST API
Celesto (SmolVM)Firecracker / QEMU microVMYesYes / No~500 ms (claim)Not documentedYes / YesNot documentedPython, JavaScript/TypeScript, CLI, MCP server
Docker SandboxesMicroVMNoYes / NoNot documentedUntil removed (local)Yes / YesYessbx CLI, TypeScript (cloud), REST API (cloud)
FirecrackerKVM microVMYesYes / No<125 ms (spec)Not documentedYes / YesNoREST API, CLI
MicrosandboxMicroVM (libkrun)YesYes / Yes<100 msNot documentedYes / Not documentedNoTypeScript, Python, Rust, Go, Ruby, CLI, MCP server

Frequently asked questions

What are the main alternatives to Pullrun?
Apple container, BoxLite, Celesto (SmolVM), Docker Sandboxes, Firecracker, Microsandbox. Which one fits depends on what you need that Pullrun does not offer; each entry above explains how it differs.
Is there an open-source alternative to Pullrun?

Cite this page

Agent Sandboxes. (2026). Pullrun alternatives. agentsandboxes.org. Last reviewed November 9, 2026. https://agentsandboxes.org/alternatives/pullrun/

Found an error or a missing sandbox? Submit a correction — every entry links to the sources it relies on.