A curated list of projects, tools, and references for running AI agents inside safer execution environments, with a focus on open-source solutions.
AI coding agents are useful precisely because they can read files, run commands, install packages, open network connections, and modify code. That also makes them risky. This list focuses on projects that reduce that risk with OS sandboxes, separate user accounts, virtual machines, containers, policy engines, and related guardrails.
- Host-level sandboxes and local workspace isolation
- Virtual machines and microVM platforms
- Containers, LXC, and packaged runtimes
- Policy, approvals, and audit layers
- Foundational sandbox primitives and low-level tooling
- Profiles, templates, and operational helpers
- Adjacent agent systems and specialized experiments
- References
- cage - Cage runs coding agents in isolated Docker containers on macOS or Linux
- agent-sandbox.nix - Nix wrappers for constrained AI CLI execution with explicit package and network allowances.
- cco - Thin launcher that picks a local sandbox backend rather than implementing one from scratch.
- nixcage - Nix environment sandboxing with
bubblewrapon Linux andsandbox-execon macOS. - Pent - Native OS process sandbox for untrusted commands.
- Sandbox Runtime - OS-level filesystem and network restriction layer without containers.
- sandnix - Nix module for wrapping programs with Landlock or
sandbox-exec. - workmux - Git worktree and
tmuxworkflow isolation; useful alongside a real sandbox, but not a full security boundary by itself. - yoloAI - Multi-backend local runner that can use macOS Seatbelt, Tart, or Docker with review/apply workflow.
- Agent Safehouse - Deny-first macOS Seatbelt profile system for local coding agents.
- opencode-seatbelt - macOS Seatbelt sandbox that confines the OpenCode process so agents can't read secrets matched by
.ocignore. - sandbox-shell - macOS Seatbelt shell wrapper for deny-by-default filesystem access.
- SandVault - Runs agents in a separate macOS user account with
sandbox-exechardening. - vibebox - Fast local macOS sandbox oriented toward AI-agent use.
- yolobox - Local sandbox focused on letting agents work without exposing the full home directory.
- sandlock - Confines untrusted code using Landlock, seccomp-bpf, and seccomp user notification.
- Fence - Native command sandbox for filesystem and network restrictions without containers.
- Matchlock - Linux sandbox aimed at securing AI agent workloads.
- Microbox - Lightweight ephemeral Linux sandboxes.
- Nono - Capability-oriented kernel-backed sandbox for agent execution.
- sandbox-run -
bubblewrap-based wrapper for per-project Linux command isolation. - sandbox-runtime - Lightweight process sandbox for filesystem and network policy enforcement.
- shai - Sandboxing shell for AI coding agents.
- sucoder - Unix-permissions-based approach for containing coding agents.
- treebeard - Ephemeral Git worktree sandbox with copy-on-write handling and optional network restrictions.
- boxed - Code-execution engine for untrusted agent code across Docker, Firecracker, and Wasm.
- boxlite-labs/boxlite - Closely related BoxLite implementation under a different org namespace.
- BoxLite - Embeddable VM-style sandboxing with snapshots and persistent state.
- coderunner - Hosted-style sandbox runner for untrusted AI code.
- K7 - Self-hosted lightweight VM sandbox infrastructure with API and SDK support.
- smolVM - Local microVM manager for ephemeral and persistent isolated workloads.
- Chamber - Ephemeral Tart-based macOS VM runner for Claude or Codex.
- ClodPod - macOS VM workflow that maps host projects into a guest environment.
- lima-devbox - Lima-based VM dev sandbox workflow for Mac.
- agentsafe - Per-task microVM sandbox for AI agents.
- avkcode/firecracker-sandbox - Firecracker-based sandbox experiment.
- bunkervm - Tiny Linux VM environment positioned as a simple safe machine for agents.
- Cleanroom - Self-hosted microVM sandbox with deny-by-default egress and credential proxying.
- hhtpcd/firecracker-sandbox - Another Firecracker sandbox implementation.
- nervos - Firecracker-microVM sandbox for AI agents.
- python-firecracker - Python interface for Firecracker rather than a full agent sandbox product.
- agentbox - Containerized agent sandbox with network firewalling and privilege dropping.
- AIO Sandbox - Full-featured Docker sandbox with shell, browser, files, Jupyter, VS Code server, and MCP.
- Amazing Sandbox - General local sandbox for third-party tools and AI agents.
- claude-code-devcontainer - Hardened devcontainer template rather than a new sandbox primitive.
- ClaudeBox - Docker-based Claude Code environment with persistent state and allowlists.
- codex-lockbox - Docker sandbox focused on running Codex CLI behind firewall rules.
- conch - Wasm/bash-style sandbox approach for agent command execution.
- EdgeBox - Local GUI sandbox that exposes a desktop to the agent.
- Kilntainers - MCP-oriented sandbox runtime backed by Docker, Podman, microVMs, or Wasm.
- packnplay - Docker-backed command sandbox with worktree and dev-container management.
- sandclaude - Opinionated Docker wrapper for Claude Code.
- Sculptor - Desktop tooling for running agents inside isolated containers and testing changes.
- Greywall - Local sandbox with live network-control and visibility features.
- runbox - Minimal container-like sandbox implementation in C.
- sbox - Small isolation-first sandbox project.
- vibebin - Incus/LXC platform for persistent self-hosted coding-agent sandboxes.
- claude-rule-enforcer - Restriction and rules enforcement around Claude Code behavior.
- Cupcake - OPA/Rego-based hook enforcement for coding agents.
- deepclause-sdk - Policy/runtime SDK for DML-style authorization logic.
- nah - Deterministic allow/ask/block guard for Claude Code tool calls.
- predicate-secure - Policy-based authorization and post-run verification for agents.
- punkgo-jack - Audit and receipt layer for agent actions via Merkle-logged hook events.
- shannot - Human-in-the-loop execution and approval flow for LLM agents.
- firewarden - Opens files inside private Firejail sandboxes; more policy wrapper than agent runtime.
- agentfs - Agent-oriented filesystem layer, useful as a constrained I/O substrate rather than a complete sandbox.
- bubblewrap - Core Linux namespace/filesystem sandbox builder.
- bVisor - Embedded bash sandbox inspired by gVisor.
- firecracker-go-sdk - Go SDK for assembling Firecracker-backed runtimes.
- Firejail - Mature Linux desktop/application sandbox using namespaces and seccomp.
- gVisor - User-space kernel / application-kernel boundary used to harden containerized execution.
- island - Landlock-powered Linux sandbox CLI.
- libkrun - Lightweight virtualization runtime frequently used under higher-level sandbox systems.
- Minijail - ChromeOS/Android containment launcher and library.
- sacre_bleu - Seccomp and Landlock policy generation, injection, and enforcement suite for Linux binaries.
- syd - Userspace syscall-intercepting Linux sandbox.
- ansible-firejail - Ansible automation for deploying Firejail profiles.
- bubblewrap-tui - Terminal UI for constructing Bubblewrap command lines.
- firejail-profiles - Profile collection for Firejail-based sandbox setups.
- firetools - GUI companion for working with Firejail sandboxes.
- ash-ai - Hosted agent infrastructure that includes sandboxing among broader API/session concerns.
- bouvet - Rust agent sandbox project; promising, but closer to an early experiment than a mature platform.
- cagent - Related repository mentioned in sandbox-isolation discussion; not clearly positioned as a general-purpose sandbox product.
- co-do - Browser-as-sandbox experiment, useful conceptually but narrower than a general local sandbox.
- construct-cli - Secure loading/execution project for AI agents.
- forgemax - MCP gateway with sandboxed code execution for tool orchestration.
- litterbox - Deep-dive repository about agent sandboxes; more analysis than runtime.
- microsandbox - Sandbox-focused exploration rather than a clearly defined end-user runtime.
- OmniGlass - Sandboxed visual action engine, more specialized than a general code-execution sandbox.
- qonqrete - Local-first multi-agent code-generation system with sandbox claims.
- rcarmo/agentbox - Notes and operational writeup about a personal sandboxing setup, not a standalone runtime.
- selenai - Terminal pair-programming agent with sandboxed Lua tools.
- SkillSandbox - Capability-oriented runtime for agent skills rather than a general process/container boundary.
- smith-core - Secure personal-agent platform combining sandboxing, policy, and observability.
- tsk - Delegation and parallelization tool with sandbox positioning.
- voratiq - Agent-ensemble coding system; sandboxing is secondary to orchestration.
- VTCode - Coding agent with strong shell-safety posture, but not primarily a sandbox runtime.
- YourOwnPersonalJean-Luc - Local coding agent with defense-in-depth positioning.
- zapcode - Sandboxed TypeScript execution engine for AI tools, closer to a specialized runtime than a full workstation sandbox.
- Awesome Agent Sandboxes - Curated list focused on AI/LLM execution sandboxes.
- Awesome Sandbox - Broad survey of sandboxing technologies and platforms.
- Hacker News discussion: Agent Safehouse - Discussion of recent local agent-isolation approaches.
- Hacker News discussion: Let's discuss sandbox isolation - Practitioner thread comparing user accounts, VMs,
bubblewrap, and related approaches. - Hacker News thread 47343927 - Additional discussion on permissions and coarse-grained approval models.
Suggestions and pull requests are welcome. Favor projects that are specifically about isolating, constraining, or safely operating AI agents, especially tools with a clear security model and practical documentation.