just-bash
In-process bash reimplementation in TypeScript with a virtual filesystem, built by Vercel Labs so agents can run shell commands without touching the host. Useful as an agent tool and test double, not as a security boundary for untrusted code.
Overview
just-bash is "a virtual bash environment with an in-memory filesystem, written in TypeScript and designed for AI agents", published by Vercel Labs. It reimplements the shell and a large command set (file and text tools, jq, sqlite3, yq, rg, archives) in TypeScript, so commands never reach the host OS; optional python3 (WebAssembly) and js-exec (QuickJS) are off by default. Filesystem backends range from pure in-memory to an overlay over a real directory, and bash-tool wraps it as an AI SDK tool. A Sandbox class mimics @vercel/sandbox for in-process development and testing.
The README is explicit about the model: this is not VM isolation, Node worker limits do not reliably cap WebAssembly memory, and for arbitrary binaries it recommends Vercel Sandbox. Limits on call depth, command count, output size and time are configurable. It is labelled beta: "This is beta software. Use at your own risk and please provide feedback." Requires Node 20.19+. We list it as an isolation primitive because it is a language-level sandbox, classed isolate here as the closest in-process category rather than a V8 isolate.
Notable
- README: "This is beta software. Use at your own risk"
- Network disabled by default; allow-list of URL prefixes when enabled
- README recommends Vercel Sandbox when you need a full VM or arbitrary binaries
just-bash specifications
| Attribute | Details |
|---|---|
| Isolation | Language-level sandbox: a TypeScript shell interpreter running inside your Node.js process with an in-memory virtual filesystem; "The shell only has access to the provided filesystem" and "All execution happens without VM isolation" |
| Deployment | Open-source project · Self-hostable |
| Open source | Yes (Apache-2.0) |
| SDKs and interfaces | JavaScript/TypeScript |
| Cold start (vendor claim) | Not documented |
| Max session length | Not documented |
| Persistence | Filesystem persists across exec() calls within a Bash instance while shell state is reset per call; backends are InMemoryFs (default), OverlayFs (copy-on-write over a real directory), ReadWriteFs (direct access to a real directory) and MountableFs |
| GPU | No - a JavaScript interpreter |
| Networking | "Network access is disabled by default"; when enabled, limited to an allow-list of URL prefixes with GET/HEAD by default, and header transforms inject credentials at the fetch boundary |
| Pricing | Free (Apache-2.0) |
| Free tier | Free |
| Compliance | Not documented |
| Regions | Not documented |
Facts from just-bash’s public documentation, verified November 9, 2026. Performance numbers are vendor claims.
Strengths and trade-offs
Strengths
- You want a zero-infrastructure bash tool for agents that cannot touch the host
- You need deterministic, in-memory file manipulation in tests or serverless functions
- You want a drop-in local stand-in for Vercel Sandbox during development
Trade-offs
- Not an OS boundary; runs in your Node.js process without VM isolation
- No real binaries; only the reimplemented command set, Python and JS via WebAssembly
- Beta software; memory containment for WebAssembly needs external process isolation
Good fit for: Giving an agent a bash-like tool over a virtual filesystem inside a Node.js process, for development, testing and lightweight file manipulation.
How just-bash compares
| Sandbox | Isolation | Open source | Self-host / BYOC | Cold start (vendor) | Max session | Snapshots / pause | GPU | SDKs |
|---|---|---|---|---|---|---|---|---|
| just-bash | In-process interpreter | Yes | Yes / No | Not documented | Not documented | No / No | No | JavaScript/TypeScript |
| Vercel Sandbox | Firecracker microVM | No | No / No | Milliseconds (claim) | 24 h (Pro) | Yes / Yes | Not documented | JavaScript/TypeScript, Python |
| Pyodide | CPython in Wasm | Yes | Yes / No | Not documented | Not documented | No / No | No | JavaScript/TypeScript, Python |
| WebContainers | Browser tab (WebAssembly) | No | No / No | ms (claimed) | Not documented | No / No | No | JavaScript/TypeScript |
| Wasmer | Wasm sandbox | Yes | Yes / No | Not documented | Not documented | Not documented / Not documented | No | CLI, JavaScript/TypeScript, Python, Rust, Swift |
Frequently asked questions
What is just-bash?
How does just-bash isolate code?
Is just-bash open source?
How much does just-bash cost?
What are the alternatives to just-bash?
Sources
Cite this page
Agent Sandboxes. (2026). just-bash. agentsandboxes.org. Last reviewed November 9, 2026. https://agentsandboxes.org/sandboxes/just-bash/
Found an error or a missing sandbox? Submit a correction — every entry links to the sources it relies on.