Choosing an open-source or self-hosted agent sandbox
Self-hosting gives you control over data, network and cost in exchange for operations work. Compare licence (and whether the backend, not just the SDK, is open), isolation out of the box, hardware needs (microVMs require KVM) and operational model: Kubernetes-native, single node, or a laptop. See the self-hosting guide for deployment detail.
What self-hosting need from a sandbox
Self-hosting gives control over data, network and cost. When comparing open-source options, look at:
- Licence (Apache-2.0 vs copyleft) and whether the full backend — not just the SDK — is open.
- Isolation you get out of the box, and whether it needs bare metal or nested virtualization.
- Operational effort: Kubernetes-native or single-node, warm pools, snapshots.
See also the self-hosting guide.
Sandboxes that fit, by kind
11 sandboxes document what this workload needs. They are grouped by kind and listed alphabetically; the order is not a ranking. Shortlist two or three, then pilot them with your own workload.
Hosted sandbox platforms
SDK-driven sandboxes you create, run code in and destroy through an API.
E2B
Open-source cloud sandboxes for AI agents, each a Firecracker microVM, with pause/resume, snapshots and forking.
- Firecracker microVM
- Open source
- Self-hostable
- BYOC
- Pause/resume
Why it fits: Apache-2.0 SDKs and backend runtime, a single-node self-host package (E2B Embed) with Terraform for AWS, GCP and Azure, and Firecracker isolation. Needs KVM.
Compute platforms with sandboxes
General serverless or app platforms that also offer sandboxes, often with GPUs.
Beam Sandboxes
Serverless AI compute platform whose sandboxes are gVisor-isolated containers with memory snapshots, optional GPUs and an open-source, self-hostable runtime.
- gVisor
- Open source
- Self-hostable
- BYOC
- GPU
- Pause/resume
Why it fits: The beta9 runtime behind Beam is AGPL-3.0 and self-hostable, with GPU support and memory snapshots. It uses gVisor containers rather than microVMs.
Browser and desktop sandboxes
Hosted browsers and full desktops that computer-use agents click, type and browse in.
Cua
Open-source computer-use infrastructure: Linux sandboxes as gVisor containers and macOS or Windows sandboxes as VMs, run locally, in your own cloud account or as shared "Spaces".
- gVisor container or VM
- Open source
- Self-hostable
- Pause/resume
Why it fits: Open-source computer-use sandboxes spanning macOS, Linux and Windows VMs.
Steel
Open-source browser API for agents (Apache-2.0, self-hostable with Docker) with a managed Steel Cloud adding stealth, captcha solving, profiles and a hosted MCP server.
- Isolated Chromium session
- Open source
- Self-hostable
Why it fits: Apache-2.0 browser API for computer-use agents, self-hostable or managed.
Open-source runtimes to self-host
Open-source sandbox runtimes you run on your own servers or Kubernetes.
CubeSandbox
Tencent Cloud's open-source, E2B-compatible sandbox platform that runs each sandbox in a RustVMM/KVM microVM with copy-on-write snapshots.
- RustVMM/KVM microVM
- Open source
- Self-hostable
- Pause/resume
Why it fits: Tencent Cloud’s Apache-2.0, E2B-compatible microVM sandbox built on RustVMM and KVM for high density on your own hosts.
Kubernetes Agent Sandbox
Open-source Kubernetes controller and CRDs for isolated, stateful sandbox pods for AI agents, with first-class support on GKE.
- gVisor or Kata
- Open source
- Self-hostable
- BYOC
- GPU
- Pause/resume
Why it fits: Apache-2.0 Kubernetes SIG project with warm pools and CRDs; isolation via gVisor or Kata RuntimeClass. Vendor-neutral and production-oriented.
Microsandbox
Open-source, local-first microVM runtime that gives each sandbox its own Linux kernel, with an optional managed cloud.
- MicroVM (libkrun)
- Open source
- Self-hostable
- BYOC
- Snapshots
Why it fits: Apache-2.0 microVM runtime for Linux, macOS and Windows with SDKs in five languages; beta.
OpenSandbox
Apache-2.0 sandbox runtime for agents that starts on Docker, scales on Kubernetes and offers a Firecracker "Fast Sandbox" with pause/resume.
- Containers or Firecracker
- Open source
- Self-hostable
- Pause/resume
Why it fits: Apache-2.0 sandbox API, contributed by Alibaba, that runs from a laptop Docker daemon to a Kubernetes cluster with a Firecracker fast path.
SPACE
Perplexity's open-source sandbox platform that runs code in Firecracker microVMs with pause, suspend-to-snapshot and an E2B compatibility layer.
- Firecracker microVM
- Open source
- Self-hostable
- Pause/resume
Why it fits: Perplexity’s Apache-2.0 Firecracker sandbox control plane with asynchronous lifecycle operations and E2B SDK compatibility.
Isolation primitives and runtimes
The hypervisors, user-space kernels, OS sandboxes and WebAssembly runtimes that sandbox platforms build on.
Firecracker
The KVM-based microVM monitor from AWS that underpins Lambda and Fargate, and the sandboxes of E2B, Vercel, Fly.io, Koyeb and Northflank.
- KVM microVM
- Open source
- Self-hostable
- Pause/resume
Why it fits: The AWS-built microVM monitor that E2B, Vercel Sandbox, Fly.io and Koyeb build on, if you want to build your own.
Local sandboxes for coding agents
Isolation for agents like Claude Code, Codex or Gemini CLI on your own laptop.
Anthropic Sandbox Runtime
Open-source CLI and library (`srt`) that restricts filesystem and network access for any local process at the OS level, without a container or VM.
- OS-level (Seatbelt / bubblewrap)
- Open source
- Self-hostable
Why it fits: Apache-2.0 OS-level sandbox for local agents and CLIs; lightweight but not a VM boundary.
Side by side
| Sandbox | Isolation | Open source | Self-host / BYOC | Cold start (vendor) | Max session | Snapshots / pause | GPU | SDKs |
|---|---|---|---|---|---|---|---|---|
| Anthropic Sandbox Runtime | OS-level (Seatbelt / bubblewrap) | Yes | Yes / Not documented | Process start | Not documented | No / No | Not documented | CLI (srt), TypeScript (npm) |
| Beam Sandboxes | gVisor | Yes | Yes / Yes | ~0.5 s | Configurable | Yes / Yes | Yes | Python, TypeScript |
| Cua | gVisor container or VM | Yes | Yes / No | Not documented | Until destroyed | Yes / Yes | Not documented | Python, JavaScript/TypeScript, Rust, CLI, MCP server |
| CubeSandbox | RustVMM/KVM microVM | Yes | Yes / No | <60 ms (claimed) | Not documented | Yes / Yes | No | Python, JavaScript/TypeScript, Go, REST API, CLI |
| E2B | Firecracker microVM | Yes | Yes / Yes | Not documented | 1 h / 24 h (Pro) | Yes / Yes | No | Python, JavaScript/TypeScript |
| Firecracker | KVM microVM | Yes | Yes / No | <125 ms (spec) | Not documented | Yes / Yes | No | REST API, CLI |
| Kubernetes Agent Sandbox | gVisor or Kata | Yes | Yes / Yes | <1 s (warm pool) | Not documented | Yes / Yes | Yes | Kubernetes CRDs, Python, kubectl |
| Microsandbox | MicroVM (libkrun) | Yes | Yes / Yes | <100 ms | Not documented | Yes / Not documented | No | TypeScript, Python, Rust, Go, Ruby, CLI, MCP server |
| OpenSandbox | Containers or Firecracker | Yes | Yes / No | 64 ms P50 (claimed) | Not documented | Not documented / Yes | Not documented | Python, JavaScript/TypeScript, Java, Kotlin, Go, C#, CLI, MCP server, REST API |
| SPACE | Firecracker microVM | Yes | Yes / No | Not documented | 6 h idle suspend | Yes / Yes | Not documented | Python, REST API, CLI |
| Steel | Isolated Chromium session | Yes | Yes / No | Not documented | 15 min / 1 h / 24 h | No / No | No | Python, JavaScript/TypeScript, Go, Rust, CLI, REST API, MCP server |
Frequently asked questions
Is Daytona still open source?
What are the open-source alternatives to E2B?
Cite this page
Agent Sandboxes. (2026). Choosing an open-source or self-hosted agent sandbox. agentsandboxes.org. Last reviewed November 9, 2026. https://agentsandboxes.org/use-cases/open-source/
Found an error or a missing sandbox? Submit a correction — every entry links to the sources it relies on.