Self-hosting agent sandboxes: open-source options
Answer in brief
You can self-host agent sandboxes with open-source platforms (such as the E2B and Daytona codebases, Microsandbox or Kubernetes agent-sandbox) or assemble your own from building blocks like Firecracker, Kata Containers and gVisor. Self-hosting gives control over data, network and cost, but you take on operating the fleet — including bare-metal or nested-virtualization hosts if you want microVM isolation.
When self-hosting makes sense
- Data must stay inside your network or region and BYOC is not an option.
- Very high, steady volume where owning hardware beats per-second pricing.
- You need custom kernels, hardware or network topologies.
- You already operate Kubernetes or bare-metal fleets.
Building blocks
- Firecracker — microVM monitor; needs KVM (bare metal or nested virtualization).
- Kata Containers — VM-per-pod runtime for Kubernetes.
- gVisor — user-space kernel; runs wherever containers run.
- Cloud Hypervisor — feature-rich Rust VMM.
What you will have to operate
- Warm pools and snapshot storage to keep cold starts low.
- Scheduling and bin-packing across hosts.
- Network policy, egress proxies and metadata-endpoint blocking.
- Image/template builds, cleanup of orphaned sandboxes, quotas and abuse detection.
- Observability and incident response.
Open-source and self-hostable sandboxes
| Project | Isolation | Licence | Notes |
|---|---|---|---|
| E2B | Firecracker microVM | Apache-2.0 | Code interpreters and short-to-medium-lived agent tasks that need microVM isolation, with an open-source self-host path |
| Cloudflare Sandbox SDK | MicroVM (Containers) | SDK Apache-2.0 (runs only on Cloudflare) | Teams building on Cloudflare Workers that want per-user sandboxes with egress and credentials controlled in code |
| Beam Sandboxes | gVisor | AGPL-3.0 (beta9 runtime) | Teams that want an open-source, self-hostable sandbox runtime with GPU access |
| Kubernetes Agent Sandbox | gVisor or Kata | Apache-2.0 | Platform teams that want to run agent sandboxes on their own Kubernetes or GKE clusters |
| Microsandbox | MicroVM (libkrun) | Apache-2.0 | Self-hosted microVM isolation on developer machines or your own servers |
| Docker Sandboxes | MicroVM | Not documented | Running coding agents unsupervised on a laptop with microVM isolation |
| Anthropic Sandbox Runtime | OS-level (Seatbelt / bubblewrap) | Apache-2.0 | Lightweight local sandboxing of coding agents and CLI tools |
Frequently asked questions
Can I run Firecracker on a normal cloud VM?
Only if the instance supports nested virtualization or you use bare-metal instances, because Firecracker needs KVM. gVisor does not have this requirement.
Cite this page
Agent Sandboxes. (2026). Self-hosting agent sandboxes: open-source options. agentsandboxes.org. Last reviewed November 8, 2026. https://agentsandboxes.org/guides/self-hosting-agent-sandboxes/
Found an error or a missing sandbox? Submit a correction — every entry links to the sources it relies on.