Microsandbox
Open-source, local-first microVM runtime that gives each sandbox its own Linux kernel, with an optional managed cloud. The most approachable way to get microVM-grade isolation locally or self-hosted.
Overview
Microsandbox runs OCI images inside lightweight microVMs on Linux, macOS (Apple Silicon) and Windows, giving each sandbox its own kernel without a cloud dependency. It ships SDKs in five languages, a CLI and an MCP server.
Its network policy and placeholder-based secret injection are notably thoughtful for agent workloads. A managed cloud is in private beta; the project itself is labelled beta.
Notable
- Labelled beta; latest release v0.7.14.
- States Y Combinator backing.
Microsandbox specifications
| Attribute | Details |
|---|---|
| Isolation | Hardware-virtualized microVMs built on libkrun; requires KVM on Linux, Apple Silicon on macOS or Windows Hypervisor Platform |
| Deployment | Open-source project · BYOC available · Self-hostable |
| Open source | Yes (Apache-2.0) |
| SDKs and interfaces | TypeScript, Python, Rust, Go, Ruby, CLI, MCP server |
| Cold start (vendor claim) | README: average boot under 100 ms (measured on an M1 machine) |
| Max session length | Not documented |
| Persistence | Volumes, snapshots and forking; detached sandboxes |
| GPU | No |
| Networking | Network policy with hostname allowlists, port rules and private-network/metadata blocking; secrets substituted via placeholders so keys never enter the VM |
| Pricing | Free to self-host. Managed cloud (private beta): Free (5 compute-hours), Builder $49/mo (500 h), Teams $299/mo (2,000 h) |
| Free tier | Self-hosting is free; cloud Free plan with 5 compute-hours/month |
| Compliance | Not documented |
| Regions | Not documented |
Facts from Microsandbox’s public documentation, verified November 8, 2026. Performance numbers are vendor claims.
Strengths and trade-offs
Strengths
- You want microVM isolation on your own laptop or servers
- You want secrets kept out of the VM via placeholder substitution
- You want SDKs beyond Python and TypeScript
Trade-offs
- Beta software
- No GPU support documented
- Managed cloud still in private beta
Best for: Self-hosted microVM isolation on developer machines or your own servers.
Where Microsandbox ranks
How Microsandbox compares
| Sandbox | Isolation | Open source | Self-host / BYOC | Cold start (vendor) | Max session | Snapshots / pause | GPU | SDKs |
|---|---|---|---|---|---|---|---|---|
| Microsandbox | MicroVM (libkrun) | Yes | Yes / Yes | <100 ms | Not documented | Yes / Not documented | No | TypeScript, Python, Rust, Go, Ruby, CLI, MCP server |
| Anthropic Sandbox Runtime | OS-level (Seatbelt / bubblewrap) | Yes | Yes / Not documented | Process start | Not documented | No / No | Not documented | CLI (srt), TypeScript (npm) |
| Docker Sandboxes | MicroVM | No | Yes / No | Not documented | Until removed (local) | Yes / Yes | Yes | sbx CLI, TypeScript (cloud), REST API (cloud) |
| Kubernetes Agent Sandbox | gVisor or Kata | Yes | Yes / Yes | <1 s (warm pool) | Not documented | Yes / Yes | Yes | Kubernetes CRDs, Python, kubectl |
| E2B | Firecracker microVM | Yes | Yes / Yes | Not documented | 1 h / 24 h (Pro) | Yes / Yes | No | Python, JavaScript/TypeScript |
Head-to-head: Microsandbox vs E2B
Frequently asked questions
What is Microsandbox?
How does Microsandbox isolate code?
Is Microsandbox open source?
How much does Microsandbox cost?
What are the best Microsandbox alternatives?
Sources
Cite this page
Agent Sandboxes. (2026). Microsandbox. agentsandboxes.org. Last reviewed November 8, 2026. https://agentsandboxes.org/sandboxes/microsandbox/
Found an error or a missing sandbox? Submit a correction — every entry links to the sources it relies on.