Agent Sandboxesagentsandboxes.org
Sandbox profile · Self-hosted software

qbox

Answer in brief

Self-hosted Firecracker microVM orchestrator (alpha) for agents and untrusted code, installed with one script on any Linux host with KVM. An early self-hosted Firecracker orchestrator worth watching, but its alpha label and undocumented licensing make it a trial rather than a platform decision today.

By the Agent Sandboxes editors · Updated

Overview

qbox is a self-hosted sandbox platform by Utibeabasi Umanah, labelled alpha, that runs untrusted and AI-generated code in Firecracker microVMs on hardware you operate. A single installer (curl -fsSL https://qbox.sh/install.sh | sh) checks for KVM, TUN and Docker, stages Firecracker and jailer, downloads a guest kernel and the qboxd guest agent, and starts a Compose stack of PostgreSQL, NATS, object storage, a control plane, dashboard, template builder, host agent and Caddy for TLS. Hosts need Linux x86_64 with /dev/kvm (bare metal, .metal instances or nested virtualisation); arm64 is not supported yet.

Templates from OCI images or Git repos are baked into warm snapshots, sandboxes expose a Python SDK, a qbox CLI and a REST plus WebSocket API, and code can run in persistent Python or JavaScript kernels. Headless Chromium sessions can be driven over CDP and a WebRTC live view is included. The site stresses that nothing phones home. The docs do not publish a licence or a source repository: the installer pulls container images from a GHCR account, so whether the code is open source is undocumented. There is no admission gate yet, so overloading a host degrades rather than queues.

Notable

  • Labelled "alpha" on the site; requirements page says "There's no admission gate yet" and arm64 "isn't supported yet".
  • Minimum host: Linux x86_64 with /dev/kvm, 2 vCPU, 4 GB RAM, 20 GB disk; installer pins Firecracker v1.12.1.
  • No pricing, licence or source repository is published; contact is hi@qbox.sh.

qbox specifications

AttributeDetails
IsolationFirecracker microVM on KVM with its own kernel per sandbox
DeploymentSelf-hosted software · Self-hostable
Open sourceNot documented
SDKs and interfacesPython, CLI, REST API
Cold start (vendor claim)Website: sandboxes resume from template snapshots "in well under a second" (claim, no figure)
Max session lengthNot documented
PersistenceTemplates are baked from OCI images or Git repos into warm snapshots that sandboxes resume from; Python and JavaScript kernel contexts can be reused across calls; object-storage-backed volumes mount at a path and can be shared across sandboxes
GPUNot documented
NetworkingControl plane and guest talk over a private channel with no public SSH or inbound exposure; guest ports can be exposed as preview URLs; outbound access can be scoped or cut off; activity feed streams network, DNS and TLS events
PricingNot published; contact hi@qbox.sh
Free tierNot documented
ComplianceNone listed; "no telemetry, no phone-home" and no data leaves your perimeter
RegionsYour own hosts

Facts from qbox’s public documentation, verified November 9, 2026. Performance numbers are vendor claims.

Strengths and trade-offs

Strengths

  • You want Firecracker isolation on your own hosts with a one-script install and no Kubernetes.
  • You need sandboxes that never phone home, for regulated or air-gapped environments.
  • You want persistent Python/JavaScript kernels and headless Chromium in the same sandbox.

Trade-offs

  • Alpha software with no admission control; capacity planning is on you.
  • Licence, source availability and pricing are not documented.
  • x86_64 Linux only; no hosted option.
  • Pause/resume, GPU and session limits are not documented.

Good fit for: Operators who want Firecracker sandboxes on their own bare metal or KVM-capable VMs without Kubernetes.

How qbox compares

SandboxIsolationOpen sourceSelf-host / BYOCCold start (vendor)Max sessionSnapshots / pauseGPUSDKs
qboxFirecracker microVMNot documentedYes / No<1 s (claim)Not documentedNot documented / Not documentedNot documentedPython, CLI, REST API
MicrosandboxMicroVM (libkrun)YesYes / Yes<100 msNot documentedYes / Not documentedNoTypeScript, Python, Rust, Go, Ruby, CLI, MCP server
ArrakisCloud Hypervisor microVMYesYes / NoNot documentedNot documentedYes / Not documentedNot documentedPython, REST API, CLI, MCP server
FirecrackerKVM microVMYesYes / No<125 ms (spec)Not documentedYes / YesNoREST API, CLI
OpenSandboxContainers or FirecrackerYesYes / No64 ms P50 (claimed)Not documentedNot documented / YesNot documentedPython, JavaScript/TypeScript, Java, Kotlin, Go, C#, CLI, MCP server, REST API
PullrunFirecracker / Apple VM / runcYesYes / No~500 ms (claim)Not documentedYes / Not documentedNot documentedCLI, MCP server

See all qbox alternatives →

Frequently asked questions

What is qbox?
Self-hosted Firecracker microVM orchestrator (alpha) for agents and untrusted code, installed with one script on any Linux host with KVM. An early self-hosted Firecracker orchestrator worth watching, but its alpha label and undocumented licensing make it a trial rather than a platform decision today.
How does qbox isolate code?
qbox documents its isolation as: Firecracker microVM on KVM with its own kernel per sandbox.
Is qbox open source?
No, qbox is not open source.
How much does qbox cost?
Not published; contact hi@qbox.sh Check the official pricing page for current rates.
What are the alternatives to qbox?
Common alternatives include Microsandbox, Arrakis, Firecracker, OpenSandbox, Pullrun. See qbox alternatives for a full comparison.

Sources

  1. qbox.sh
  2. qbox.sh/docs
  3. qbox.sh/docs/self-hosting
  4. qbox.sh/docs/requirements
  5. qbox.sh/install.sh

Cite this page

Agent Sandboxes. (2026). qbox. agentsandboxes.org. Last reviewed November 9, 2026. https://agentsandboxes.org/sandboxes/qbox/

Found an error or a missing sandbox? Submit a correction — every entry links to the sources it relies on.