Agent Sandboxesagentsandboxes.org
Sandbox profile · Local / OS-level

Minimal

Answer in brief

Open-source CLI that runs coding agents in declarative, isolated sessions built from a minimal.toml and a from-source package catalogue, on Linux namespaces or a libkrun microVM. A promising beta for developers who want declarative, reproducible agent sessions and are comfortable with a young toolchain.

By the Agent Sandboxes editors · Updated

Overview

Minimal is "a declarative isolation runtime for Claude Code, Gemini, Codex, Pi, and more". You describe the environment in a minimal.toml kept with the code, and Minimal builds a box from a catalogue where every package is built from source with SBOM and VEX data. On Linux the default sandbox uses unprivileged user and mount namespaces (kernel 5.10+); a libkrun microVM is available with --provider local-minvmd and is always used on Apple Silicon macOS. Intel Macs are not supported.

Sessions can be attached, detached and left running, and a hosted MCP server lets agents read the package catalogue. The CLI is in public beta (install page offers v0.7.2) and is Apache-2.0; remote execution and "Minimal for Teams" are marked coming soon or WIP. The README notes the full workspace does not yet build on macOS because the sandbox stack is Linux-only.

Notable

  • Public beta; install page offers v0.7.2; Apache-2.0
  • macOS uses a libkrun microVM on Hypervisor.framework; Linux defaults to unprivileged user/mount namespaces
  • "Remote execution is coming soon" and Minimal for Teams is WIP

Minimal specifications

AttributeDetails
IsolationLinux: unprivileged user and mount namespaces by default (local-minimald), or a libkrun microVM with --provider local-minvmd; macOS: always a lightweight Linux microVM booted by libkrun on Hypervisor.framework
DeploymentLocal / OS-level
Open sourceYes (Apache-2.0)
SDKs and interfacesCLI, MCP server
Cold start (vendor claim)Not documented
Max session lengthNot documented
PersistenceSessions can be attached, detached and kept running; the session workspace starts as a copy of the project files taken at activation; a /state directory can be shared across tasks via state_key
GPUNot documented
NetworkingPackage builds get network access only when a dependency requires it and tasks "when necessary"; session network policy is not documented
PricingCLI free to download for Linux and macOS during public beta; "Minimal for Teams" (managed builds, policy enforcement, attestation) is WIP with a waitlist
Free tierFree during public beta
ComplianceNot documented
RegionsNot documented

Facts from Minimal’s public documentation, verified November 9, 2026. Performance numbers are vendor claims.

Strengths and trade-offs

Strengths

  • You want the agent environment declared in a file next to the code and rebuilt reproducibly
  • You care about supply-chain provenance of the tools inside the sandbox
  • You are on Apple Silicon and want a microVM rather than a container

Trade-offs

  • Public beta; Teams, remote execution and some macOS pieces are not ready
  • Linux default is namespace isolation, which shares the host kernel
  • Intel Macs and Windows are not supported

Good fit for: Reproducible, declaratively scoped local sessions for Claude Code, Codex, Gemini and Pi with a supply-chain-audited toolchain.

How Minimal compares

SandboxIsolationOpen sourceSelf-host / BYOCCold start (vendor)Max sessionSnapshots / pauseGPUSDKs
Minimalnamespaces or libkrun microVMYesNo / NoNot documentedNot documentedNot documented / Not documentedNot documentedCLI, MCP server
agents-sandboxmicrosandbox microVMYesNo / NoNot documentedNot documentedNot documented / Not documentedNot documentedCLI
nonoLandlock / SeatbeltYesNo / NoNot documentedNot documentedYes / Not documentedNot documentedCLI, Rust, Python, JavaScript/TypeScript, Go
Docker SandboxesMicroVMNoYes / NoNot documentedUntil removed (local)Yes / YesYessbx CLI, TypeScript (cloud), REST API (cloud)
Anthropic Sandbox RuntimeOS-level (Seatbelt / bubblewrap)YesYes / Not documentedProcess startNot documentedNo / NoNot documentedCLI (srt), TypeScript (npm)
MicrosandboxMicroVM (libkrun)YesYes / Yes<100 msNot documentedYes / Not documentedNoTypeScript, Python, Rust, Go, Ruby, CLI, MCP server
libkrunIn-process microVMYesYes / NoNot documentedNot documentedNot documented / Not documentedYesRust, C

See all Minimal alternatives →

Frequently asked questions

What is Minimal?
Open-source CLI that runs coding agents in declarative, isolated sessions built from a minimal.toml and a from-source package catalogue, on Linux namespaces or a libkrun microVM. A promising beta for developers who want declarative, reproducible agent sessions and are comfortable with a young toolchain.
How does Minimal isolate code?
Minimal documents its isolation as: Linux: unprivileged user and mount namespaces by default (local-minimald), or a libkrun microVM with --provider local-minvmd; macOS: always a lightweight Linux microVM booted by libkrun on Hypervisor.framework.
Is Minimal open source?
Yes (Apache-2.0).
How much does Minimal cost?
CLI free to download for Linux and macOS during public beta; "Minimal for Teams" (managed builds, policy enforcement, attestation) is WIP with a waitlist Check the official pricing page for current rates.
What are the alternatives to Minimal?
Common alternatives include agents-sandbox, nono, Docker Sandboxes, Anthropic Sandbox Runtime, Microsandbox, libkrun. See Minimal alternatives for a full comparison.

Sources

  1. minimal.dev
  2. minimal.dev/docs
  3. minimal.dev/docs/concepts/sandboxing
  4. github.com/gominimal/minimal

Cite this page

Agent Sandboxes. (2026). Minimal. agentsandboxes.org. Last reviewed November 9, 2026. https://agentsandboxes.org/sandboxes/minimal/

Found an error or a missing sandbox? Submit a correction — every entry links to the sources it relies on.