AIO Sandbox
All-in-one agent sandbox image bundling a VNC browser, shell, filesystem, VS Code, Jupyter and an MCP server in a single Docker container. A convenient batteries-included environment image for agents, best treated as a workload to run inside a stronger isolation layer.
Overview
AIO Sandbox is an open-source Docker image from the Agent Infra team (published through ByteDance's open-source channels and offered as a one-click application on ByteDance's Volcengine Function Service) that packs everything an agent might need into one container: a Chromium browser with VNC and CDP access, a WebSocket shell, file APIs, VS Code Server, Jupyter, and an MCP server exposing browser, file, shell and markitdown tools. All components share one filesystem, so a file the shell writes is visible in the editor, the notebook and the browser. You run it with a single docker run (Compose and Kubernetes manifests are provided) and talk to it through a REST API at /v1/..., Python, TypeScript or Go SDKs, or MCP at /mcp.
Isolation is the Docker container itself; the quick start disables the seccomp profile and the README recommends setting SANDBOX_API_KEY, otherwise the API, Jupyter and VNC are open. There is no snapshot, pause or multi-tenant control plane: it is an environment image, and scheduling is left to you or to a hosting platform. Hosted paths exist on Volcengine veFaaS (Beijing region only) and inside Alibaba Cloud Model Studio's sandbox service, which uses the same all-in-one image behind an E2B-compatible API. The repository is Apache-2.0 with a pinned release line (1.11.0 cited in the README) and a companion paper, arXiv 2509.02544.
Notable
- Apache-2.0; roughly 6.3k GitHub stars and a Go SDK repository alongside Python and TypeScript packages
- Volcengine Function Service lists an "All-in-One Sandbox" one-click application restricted to the North China 2 (Beijing) region
- Accompanied by a research paper, arXiv 2509.02544
AIO Sandbox specifications
| Attribute | Details |
|---|---|
| Isolation | Single Docker container per sandbox with a shared filesystem across its services; the quick start runs it with --security-opt seccomp=unconfined |
| Deployment | Open-source project · Self-hostable |
| Open source | Yes (Apache-2.0) |
| SDKs and interfaces | Python, JavaScript/TypeScript, Go, REST API, MCP server |
| Cold start (vendor claim) | Not documented |
| Max session length | Not documented |
| Persistence | State lives in the container for as long as it runs; no snapshot or pause feature is documented |
| GPU | Not documented |
| Networking | Container listens on port 8080 (bound to 127.0.0.1 in the examples); port forwarding and preview for apps running inside; README advises keeping 8080 private behind a reverse proxy or Ingress when deployed in the cloud |
| Pricing | Free to self-host; hosted deployments through Volcengine Function Service (veFaaS) and Alibaba Cloud Model Studio are billed by those platforms |
| Free tier | Free to self-host |
| Compliance | Not documented |
| Regions | Self-hosted anywhere; the veFaaS one-click deployment is limited to North China 2 (Beijing) |
Facts from AIO Sandbox’s public documentation, verified November 9, 2026. Performance numbers are vendor claims.
Strengths and trade-offs
Strengths
- You want browser, shell, editor and notebook in one image without wiring services together
- You run computer-use or browser agents that also need to run code against the same files
- You need MCP tools for the sandbox out of the box
- You are on Volcengine or Alibaba Cloud Model Studio and want a hosted version of the same image
Trade-offs
- Container-level isolation only, and the documented run command sets seccomp to unconfined
- No snapshots, pause/resume or built-in orchestration; one container is one sandbox
- Services are open unless an API key is configured
- The maintainer is identified only as the "Agent Infra team" in the repository; corporate ownership is inferred from ByteDance's open-source channels and Volcengine's hosted listing
Good fit for: Agents that need a browser, terminal, editor and notebook in one container with a shared filesystem.
How AIO Sandbox compares
| Sandbox | Isolation | Open source | Self-host / BYOC | Cold start (vendor) | Max session | Snapshots / pause | GPU | SDKs |
|---|---|---|---|---|---|---|---|---|
| AIO Sandbox | Docker container | Yes | Yes / No | Not documented | Not documented | No / No | Not documented | Python, JavaScript/TypeScript, Go, REST API, MCP server |
| OpenSandbox | Containers or Firecracker | Yes | Yes / No | 64 ms P50 (claimed) | Not documented | Not documented / Yes | Not documented | Python, JavaScript/TypeScript, Java, Kotlin, Go, C#, CLI, MCP server, REST API |
| Docker Sandboxes | MicroVM | No | Yes / No | Not documented | Until removed (local) | Yes / Yes | Yes | sbx CLI, TypeScript (cloud), REST API (cloud) |
| OpenHands Runtime | Docker container | Yes | Yes / No | Not documented | Not documented | Not documented / Not documented | Not documented | Python, JavaScript/TypeScript, REST API |
| Cua | gVisor container or VM | Yes | Yes / No | Not documented | Until destroyed | Yes / Yes | Not documented | Python, JavaScript/TypeScript, Rust, CLI, MCP server |
| E2B | Firecracker microVM | Yes | Yes / Yes | Not documented | 1 h / 24 h (Pro) | Yes / Yes | No | Python, JavaScript/TypeScript |
Frequently asked questions
What is AIO Sandbox?
How does AIO Sandbox isolate code?
--security-opt seccomp=unconfined.Is AIO Sandbox open source?
How much does AIO Sandbox cost?
What are the alternatives to AIO Sandbox?
Sources
Cite this page
Agent Sandboxes. (2026). AIO Sandbox. agentsandboxes.org. Last reviewed November 9, 2026. https://agentsandboxes.org/sandboxes/aio-sandbox/
Found an error or a missing sandbox? Submit a correction — every entry links to the sources it relies on.