Choosing a sandbox for local coding agents
Local coding agents run with your files and credentials, so a local sandbox should restrict writes to the project, deny network by default with an allowlist, and keep credentials out of reach, with little enough friction that developers keep it on. A microVM per agent (Docker Sandboxes, Microsandbox) is the stronger boundary. OS-level sandboxing (Anthropic Sandbox Runtime) is lighter and faster.
What local coding agents need from a sandbox
Coding agents such as Claude Code, Codex or Gemini CLI often run on a developer’s laptop with access to their files and credentials. A local sandbox should:
- Restrict filesystem writes to the project.
- Enforce deny-by-default network with an allowlist.
- Keep credentials out of the agent’s reach where possible.
- Add little friction, so developers actually use it.
Sandboxes that fit, by kind
8 sandboxes document what this workload needs. They are grouped by kind and listed alphabetically; the order is not a ranking. Shortlist two or three, then pilot them with your own workload.
Open-source runtimes to self-host
Open-source sandbox runtimes you run on your own servers or Kubernetes.
Microsandbox
Open-source, local-first microVM runtime that gives each sandbox its own Linux kernel, with an optional managed cloud.
- MicroVM (libkrun)
- Open source
- Self-hostable
- BYOC
- Snapshots
Why it fits: Open-source microVMs on macOS, Linux and Windows with network policy and placeholder secrets.
Local sandboxes for coding agents
Isolation for agents like Claude Code, Codex or Gemini CLI on your own laptop.
Anthropic Sandbox Runtime
Open-source CLI and library (`srt`) that restricts filesystem and network access for any local process at the OS level, without a container or VM.
- OS-level (Seatbelt / bubblewrap)
- Open source
- Self-hostable
Why it fits: Near-zero-overhead OS-level sandbox (Seatbelt/bubblewrap) with a deny-by-default network proxy; weaker boundary than a VM.
Apple container
Apple's open-source CLI that runs each Linux container in its own lightweight virtual machine on Apple silicon Macs.
- Lightweight VM per container
- Open source
Why it fits: Apple’s open-source container tool runs each Linux container in its own lightweight VM on Apple silicon.
Codex CLI sandboxing
Codex CLI's built-in sandbox: Seatbelt on macOS, bubblewrap on Linux/WSL2 and a native Windows sandbox, with read-only, workspace-write and full-access modes.
- Seatbelt / bubblewrap / Windows
- Open source
Why it fits: Codex CLI’s built-in sandboxing: Seatbelt on macOS, bubblewrap on Linux and WSL2, and a native Windows sandbox, with no containers.
Docker Sandboxes
Docker’s `sbx` CLI for running AI coding agents in microVM sandboxes on your machine, with an experimental Docker-hosted cloud.
- MicroVM
- Self-hostable
- GPU
- Pause/resume
Why it fits: A microVM per agent with its own Docker Engine, deny-by-default networking and host-side credential injection; templates for popular coding agents; free locally.
Gemini CLI sandboxing
Gemini CLI's built-in sandbox: macOS Seatbelt profiles or a Docker/Podman container around the agent's tool calls, with gVisor, LXC and a Windows option.
- Seatbelt or container
- Open source
Why it fits: Gemini CLI’s built-in sandboxing via macOS Seatbelt or Docker and Podman containers.
nono
Kernel-enforced OS-native sandbox for coding agents that runs each tool call in its own ephemeral sandbox, brokers credentials and keeps a tamper-evident audit chain.
- Landlock / Seatbelt
- Open source
- Snapshots
Why it fits: Kernel-enforced file and network allow-lists plus brokered credentials for Claude Code, Codex and other local agents.
Windows Sandbox
Disposable Windows desktop built into Windows Pro, Enterprise and Education, running on the Microsoft hypervisor with a separate kernel and wiped on close.
- Hyper-V lightweight VM
- GPU
Why it fits: A disposable Hyper-V copy of the host Windows OS for untrusted applications or Windows-targeting agents.
Side by side
| Sandbox | Isolation | Open source | Self-host / BYOC | Cold start (vendor) | Max session | Snapshots / pause | GPU | SDKs |
|---|---|---|---|---|---|---|---|---|
| Anthropic Sandbox Runtime | OS-level (Seatbelt / bubblewrap) | Yes | Yes / Not documented | Process start | Not documented | No / No | Not documented | CLI (srt), TypeScript (npm) |
| Apple container | Lightweight VM per container | Yes | No / No | Sub-second (claimed) | Not documented | No / No | Not documented | CLI |
| Codex CLI sandboxing | Seatbelt / bubblewrap / Windows | Yes | No / No | Not documented | Not documented | No / Not documented | Not documented | CLI |
| Docker Sandboxes | MicroVM | No | Yes / No | Not documented | Until removed (local) | Yes / Yes | Yes | sbx CLI, TypeScript (cloud), REST API (cloud) |
| Gemini CLI sandboxing | Seatbelt or container | Yes | No / No | Not documented | Not documented | No / Not documented | Not documented | CLI |
| Microsandbox | MicroVM (libkrun) | Yes | Yes / Yes | <100 ms | Not documented | Yes / Not documented | No | TypeScript, Python, Rust, Go, Ruby, CLI, MCP server |
| nono | Landlock / Seatbelt | Yes | No / No | Not documented | Not documented | Yes / Not documented | Not documented | CLI, Rust, Python, JavaScript/TypeScript, Go |
| Windows Sandbox | Hyper-V lightweight VM | No | No / No | A few seconds | Until closed | No / No | Yes | CLI |
Frequently asked questions
How do I sandbox Claude Code or Codex on my laptop?
Cite this page
Agent Sandboxes. (2026). Choosing a sandbox for local coding agents. agentsandboxes.org. Last reviewed November 9, 2026. https://agentsandboxes.org/use-cases/local-agents/
Found an error or a missing sandbox? Submit a correction — every entry links to the sources it relies on.