agents-sandbox
GPL-3.0 launcher that gives each project and coding agent its own microsandbox microVM on Linux/KVM or Apple Silicon macOS, with secrets kept on the host. A focused per-project microVM launcher for opencode users; support for other agents is still experimental.
Overview
agents-sandbox "allows you to isolate your coding agents from the rest of your dev environment" by building or reusing a microsandbox VM for each project and agent, then attaching the agent inside it. Supported agents are opencode and opencode2 (the tested defaults; opencode2 is in beta) plus pi, Claude Code, Codex, Hermes Agent and Oh My Pi, which are "experimental - not well tested with agents-sandbox". The host project is mounted at /workspace; other host files are invisible unless copied or mounted, and env.secret keeps real credential values on the host while the guest sees a placeholder.
Egress is controlled by profiles from public to allowlist-only none. The README warns that the default setup copies the active agent's host configuration into the VM, which may include credentials. It runs on Linux with KVM and macOS on Apple Silicon ("Platform requirements change; check upstream docs") and does not need a system-wide microsandbox install. GPL-3.0.
Notable
- GPL-3.0; built on microsandbox VMs with a separate Linux kernel per project
- opencode2 is the default agent and in beta; five other agents are marked experimental
- Secrets via env.secret stay on the host; guest sees a placeholder
agents-sandbox specifications
| Attribute | Details |
|---|---|
| Isolation | Dedicated microsandbox microVM per project and agent with a "separate microVM and Linux kernel"; the README does not name the hypervisor |
| Deployment | Local / OS-level |
| Open source | Yes (GPL-3.0) |
| SDKs and interfaces | CLI |
| Cold start (vendor claim) | Not documented |
| Max session length | Not documented |
| Persistence | VM is built or reused per project; agent state persists in a /home/dev volume; the project directory is mounted read-write at /workspace, or an isolated VM-internal worktree for some agents |
| GPU | Not documented |
| Networking | Egress profiles: public (default), private and host extend it, none is allowlist-only "deny-by-default egress, not a complete air gap"; links can open in the host browser for allowlisted schemes |
| Pricing | Free (GPL-3.0) |
| Free tier | Free |
| Compliance | Not documented |
| Regions | Not documented |
Facts from agents-sandbox’s public documentation, verified November 9, 2026. Performance numbers are vendor claims.
Strengths and trade-offs
Strengths
- You want one microVM per project rather than one shared sandbox
- You need secrets kept off the guest while the agent still works
- You want configurable egress without a full air gap
Trade-offs
- Most agents other than opencode are marked experimental
- Hypervisor and boot behaviour are inherited from microsandbox and not documented here
- GPL-3.0; Linux/KVM or Apple Silicon only
Good fit for: Developers who want each coding agent confined to a per-project microVM on their own Linux or Apple Silicon machine.
How agents-sandbox compares
| Sandbox | Isolation | Open source | Self-host / BYOC | Cold start (vendor) | Max session | Snapshots / pause | GPU | SDKs |
|---|---|---|---|---|---|---|---|---|
| agents-sandbox | microsandbox microVM | Yes | No / No | Not documented | Not documented | Not documented / Not documented | Not documented | CLI |
| Minimal | namespaces or libkrun microVM | Yes | No / No | Not documented | Not documented | Not documented / Not documented | Not documented | CLI, MCP server |
| Microsandbox | MicroVM (libkrun) | Yes | Yes / Yes | <100 ms | Not documented | Yes / Not documented | No | TypeScript, Python, Rust, Go, Ruby, CLI, MCP server |
| Docker Sandboxes | MicroVM | No | Yes / No | Not documented | Until removed (local) | Yes / Yes | Yes | sbx CLI, TypeScript (cloud), REST API (cloud) |
| nono | Landlock / Seatbelt | Yes | No / No | Not documented | Not documented | Yes / Not documented | Not documented | CLI, Rust, Python, JavaScript/TypeScript, Go |
| Anthropic Sandbox Runtime | OS-level (Seatbelt / bubblewrap) | Yes | Yes / Not documented | Process start | Not documented | No / No | Not documented | CLI (srt), TypeScript (npm) |
| Celesto (SmolVM) | Firecracker / QEMU microVM | Yes | Yes / No | ~500 ms (claim) | Not documented | Yes / Yes | Not documented | Python, JavaScript/TypeScript, CLI, MCP server |
Frequently asked questions
What is agents-sandbox?
How does agents-sandbox isolate code?
Is agents-sandbox open source?
How much does agents-sandbox cost?
What are the alternatives to agents-sandbox?
Sources
Cite this page
Agent Sandboxes. (2026). agents-sandbox. agentsandboxes.org. Last reviewed November 9, 2026. https://agentsandboxes.org/sandboxes/agents-sandbox/
Found an error or a missing sandbox? Submit a correction — every entry links to the sources it relies on.