OpenSandbox
Apache-2.0 sandbox runtime for agents that starts on Docker, scales on Kubernetes and offers a Firecracker "Fast Sandbox" with pause/resume. The most broadly supported open sandbox API of this batch, with real microVM isolation available once you are on Kubernetes.
Overview
OpenSandbox is an open-source sandbox runtime for agents, now governed as an Agentic AI Foundation project under LF Projects; Alibaba's origin shows in the SDK namespaces (com.alibaba.opensandbox, @alibaba-group/opensandbox, github.com/alibaba/OpenSandbox) and an Alibaba Cloud registry mirror. A server (uvx opensandbox-server) exposes a unified lifecycle API for creating sandboxes, running commands, managing files and executing code, with SDKs for Python, TypeScript, Java/Kotlin, Go and C#, an osb CLI and an MCP server for clients such as Claude Code and Cursor. Docker is the local runtime; Kubernetes adds resource pools and batch creation; and a Fast Sandbox runtime on Kubernetes uses Firecracker microVMs, with pause/resume that preserves memory and disk.
The project publishes integration examples for coding agents (Claude Code, Codex CLI, DeerFlow), a code interpreter, Playwright and Chrome, desktop environments and Harbor evaluations. Security features include an ingress gateway, per-sandbox egress policy and a Credential Vault. The website quotes 64 ms P50 warm creation on Firecracker. Images are published to Docker Hub, GHCR and Alibaba Cloud's registry, though the README warns that current umbrella releases lack the Cosign signing and provenance that earlier per-component releases had and advises pinning by digest. GPU support and snapshots are not documented.
Notable
- Contributed by Alibaba to the Agentic AI Foundation alongside Agent Skills, Open Responses and OpenEnv; listed in the CNCF Landscape
- Apache-2.0 with roughly 17k GitHub stars and SDKs in five languages plus CLI and MCP
- Website claims 64 ms P50 and 125.4 ms P99 (10 concurrent) warm creation on the Firecracker Fast Sandbox runtime
OpenSandbox specifications
| Attribute | Details |
|---|---|
| Isolation | Docker containers locally and Kubernetes pods in clusters, plus a Firecracker microVM "Fast Sandbox" runtime on Kubernetes |
| Deployment | Open-source project · Self-hostable |
| Open source | Yes (Apache-2.0) |
| SDKs and interfaces | Python, JavaScript/TypeScript, Java, Kotlin, Go, C#, CLI, MCP server, REST API |
| Cold start (vendor claim) | Website: Firecracker warm creation 64 ms P50 (serial) and 125.4 ms P99 (10 concurrent) on the Fast Sandbox runtime |
| Max session length | Not documented |
| Persistence | Fast Sandbox (Firecracker) sandboxes can be paused and resumed with memory and disk state preserved; snapshots and templates are not documented |
| GPU | Not documented |
| Networking | Unified ingress gateway for inbound traffic; per-sandbox outbound egress policies; Credential Vault lets agents call external services without real credentials entering the sandbox |
| Pricing | Free to self-host (Apache-2.0); no managed service listed |
| Free tier | Free to self-host |
| Compliance | Not documented |
| Regions | Self-hosted; images published to Docker Hub, GHCR and Alibaba Cloud Container Registry |
Facts from OpenSandbox’s public documentation, verified November 9, 2026. Performance numbers are vendor claims.
Strengths and trade-offs
Strengths
- You want one API and SDK set that works on Docker locally and Kubernetes in production
- You need Firecracker-level isolation with pause/resume on Kubernetes
- You run polyglot teams (Java, C#, Go, TypeScript, Python) that all need the same sandbox client
- You want foundation governance rather than a single-vendor project
Trade-offs
- Default Docker runtime is container isolation; microVM isolation requires the Kubernetes Fast Sandbox path
- Snapshots, templates and GPU support are not documented
- Umbrella releases currently lack signing and provenance evidence (tracked issue), so images should be pinned by digest
- No managed offering; you run the control plane yourself
Good fit for: Teams that want an open, multi-language sandbox API they can run from a laptop Docker daemon up to a Kubernetes cluster.
Use cases OpenSandbox fits
- Open source & self-hosted: Apache-2.0 sandbox API, contributed by Alibaba, that runs from a laptop Docker daemon to a Kubernetes cluster with a Firecracker fast path.
How OpenSandbox compares
| Sandbox | Isolation | Open source | Self-host / BYOC | Cold start (vendor) | Max session | Snapshots / pause | GPU | SDKs |
|---|---|---|---|---|---|---|---|---|
| OpenSandbox | Containers or Firecracker | Yes | Yes / No | 64 ms P50 (claimed) | Not documented | Not documented / Yes | Not documented | Python, JavaScript/TypeScript, Java, Kotlin, Go, C#, CLI, MCP server, REST API |
| E2B | Firecracker microVM | Yes | Yes / Yes | Not documented | 1 h / 24 h (Pro) | Yes / Yes | No | Python, JavaScript/TypeScript |
| CubeSandbox | RustVMM/KVM microVM | Yes | Yes / No | <60 ms (claimed) | Not documented | Yes / Yes | No | Python, JavaScript/TypeScript, Go, REST API, CLI |
| AIO Sandbox | Docker container | Yes | Yes / No | Not documented | Not documented | No / No | Not documented | Python, JavaScript/TypeScript, Go, REST API, MCP server |
| Kubernetes Agent Sandbox | gVisor or Kata | Yes | Yes / Yes | <1 s (warm pool) | Not documented | Yes / Yes | Yes | Kubernetes CRDs, Python, kubectl |
| Daytona | Containers or VMs | No | Not documented / Yes | <90 ms | Unlimited | Yes / Yes | Yes | Python, TypeScript, Ruby, Go, Java |
| Microsandbox | MicroVM (libkrun) | Yes | Yes / Yes | <100 ms | Not documented | Yes / Not documented | No | TypeScript, Python, Rust, Go, Ruby, CLI, MCP server |
Frequently asked questions
What is OpenSandbox?
How does OpenSandbox isolate code?
Is OpenSandbox open source?
How much does OpenSandbox cost?
What are the alternatives to OpenSandbox?
Sources
Cite this page
Agent Sandboxes. (2026). OpenSandbox. agentsandboxes.org. Last reviewed November 9, 2026. https://agentsandboxes.org/sandboxes/opensandbox/
Found an error or a missing sandbox? Submit a correction — every entry links to the sources it relies on.