Arrakis
Self-hosted microVM sandbox for agent code execution and computer use, with snapshot-and-restore and a VNC-accessible GUI in every VM. A single-maintainer, AGPL microVM sandbox that stands out for bundling a GUI and snapshot/restore for self-hosters on Linux.
Overview
Arrakis is "a fully customizable and self-hosted sandboxing solution for AI agent code execution and computer use" maintained by GitHub user abshkbh. Each sandbox is a microVM run by Cloud Hypervisor on a Linux host with /dev/kvm (the README includes a GCE setup guide); a Go REST server (arrakis-restserver) manages VMs, and you drive it from the py-arrakis Python SDK, the arrakis-client CLI, the REST API or a separate MCP server for Claude Desktop, Cursor and Windsurf.
Every VM starts a VNC server at boot with Chrome preinstalled, so computer-use agents get a desktop as well as a shell, and snapshot-and-restore lets an agent back out of a bad state. Licensing is AGPL-3.0 with commercial licences offered by email. The README carries no stability or release label and the Releases page is empty; a contribution guide is "going to be available soon".
Notable
- AGPL-3.0 licence with commercial licensing offered by email
- Snapshot-and-restore and a VNC/noVNC desktop with Chrome in every sandbox
- Linux-only host requirement: Cloud Hypervisor needs /dev/kvm
Arrakis specifications
| Attribute | Details |
|---|---|
| Isolation | MicroVM per sandbox using Cloud Hypervisor as the VMM on Linux/KVM; overlayfs protects each sandbox root filesystem |
| Deployment | Open-source project · Self-hostable |
| Open source | Yes (AGPL-3.0) |
| SDKs and interfaces | Python, REST API, CLI, MCP server |
| Cold start (vendor claim) | Not documented |
| Max session length | Not documented |
| Persistence | Snapshot-and-restore "out of the box" so an agent can return to an earlier state; a restored VM currently reuses the original IP, so the original must be stopped or destroyed first on the same host |
| GPU | Not documented |
| Networking | Each sandbox gets a tap device on a Linux bridge on the host; SSH access and automatic port forwarding; VNC exposed through port forwarding with a noVNC proxy |
| Pricing | Free to self-host under AGPL-3.0; commercial licensing by email |
| Free tier | Free to self-host |
| Compliance | Not documented |
| Regions | Not documented |
Facts from Arrakis’s public documentation, verified November 9, 2026. Performance numbers are vendor claims.
Strengths and trade-offs
Strengths
- You want a self-hosted microVM sandbox that includes a desktop for computer-use agents
- You need snapshot/restore so agents can roll back
- You want an MCP server so desktop agent clients can use the sandbox directly
Trade-offs
- Linux/KVM hosts only; no macOS or Windows support documented
- AGPL-3.0 may not suit every deployment
- No release tags, maturity label, boot-time figures or resource-limit documentation
Good fit for: Self-hosting a GUI-capable microVM sandbox with snapshot/restore for computer-use and code-execution agents.
How Arrakis compares
| Sandbox | Isolation | Open source | Self-host / BYOC | Cold start (vendor) | Max session | Snapshots / pause | GPU | SDKs |
|---|---|---|---|---|---|---|---|---|
| Arrakis | Cloud Hypervisor microVM | Yes | Yes / No | Not documented | Not documented | Yes / Not documented | Not documented | Python, REST API, CLI, MCP server |
| Celesto (SmolVM) | Firecracker / QEMU microVM | Yes | Yes / No | ~500 ms (claim) | Not documented | Yes / Yes | Not documented | Python, JavaScript/TypeScript, CLI, MCP server |
| BoxLite | microVM + jailer | Yes | Yes / No | ~1 s (claim) | Not documented | Not documented / Not documented | Not documented | Python, JavaScript/TypeScript, Go, Rust, C, CLI, REST API |
| Microsandbox | MicroVM (libkrun) | Yes | Yes / Yes | <100 ms | Not documented | Yes / Not documented | No | TypeScript, Python, Rust, Go, Ruby, CLI, MCP server |
| Firecracker | KVM microVM | Yes | Yes / No | <125 ms (spec) | Not documented | Yes / Yes | No | REST API, CLI |
| Cua | gVisor container or VM | Yes | Yes / No | Not documented | Until destroyed | Yes / Yes | Not documented | Python, JavaScript/TypeScript, Rust, CLI, MCP server |
| E2B | Firecracker microVM | Yes | Yes / Yes | Not documented | 1 h / 24 h (Pro) | Yes / Yes | No | Python, JavaScript/TypeScript |
Frequently asked questions
What is Arrakis?
How does Arrakis isolate code?
Is Arrakis open source?
How much does Arrakis cost?
What are the alternatives to Arrakis?
Sources
Cite this page
Agent Sandboxes. (2026). Arrakis. agentsandboxes.org. Last reviewed November 9, 2026. https://agentsandboxes.org/sandboxes/arrakis/
Found an error or a missing sandbox? Submit a correction — every entry links to the sources it relies on.