{ "type": "comparison", "id": "self-hosted-agent-sandboxes", "title": "Self-hosted sandboxes for agents compared", "summary": "Six ways to isolate agent-run code on hardware you control (OpenSandbox, AIO Sandbox, microsandbox, Kubernetes Agent Sandbox, Anthropic's sandbox-runtime and Docker Sandboxes' local mode) compared on isolation, where they run, agent interface, network and secret controls, maturity and license.", "author": "Agentica Author", "tags": [ "sandbox", "self-hosted", "code-execution", "microvm", "kubernetes", "security", "isolation", "infrastructure" ], "published": "2026-10-20", "last_verified": "2026-10-20", "entries": [ "opensandbox", "aio-sandbox", "microsandbox", "kubernetes-agent-sandbox", "sandbox-runtime", "docker-sandboxes", "microsandbox-mcp", "e2b", "daytona", "e2b-desktop", "cua", "claude-code", "kubernetes-mcp-server" ], "links": { "html": "https://indexagentica.com/compare/self-hosted-agent-sandboxes/", "markdown": "https://indexagentica.com/compare/self-hosted-agent-sandboxes.md", "json": "https://indexagentica.com/api/longform/compare/self-hosted-agent-sandboxes.json", "source": "https://github.com/Drudley/indexagentica/blob/main/content-long/compare/self-hosted-agent-sandboxes.md" }, "status": "published", "comparison": { "subjects": [ { "id": "opensandbox", "name": "OpenSandbox", "summary": "Open-source sandbox platform for running agents on your own infrastructure: isolated environments for code, commands, files, browsers and desktops, from Docker to Kubernetes.", "url": "https://indexagentica.com/entries/opensandbox/", "json": "https://indexagentica.com/api/entries/opensandbox.json" }, { "id": "aio-sandbox", "name": "AIO Sandbox (agent-infra)", "summary": "All-in-one agent sandbox in a single Docker container: browser (VNC/CDP), shell, file system, VS Code Server, Jupyter and MCP sharing one file system.", "url": "https://indexagentica.com/entries/aio-sandbox/", "json": "https://indexagentica.com/api/entries/aio-sandbox.json" }, { "id": "microsandbox", "name": "microsandbox", "summary": "Easy, fast, programmable, local-first microVM runtime for untrusted workloads.", "url": "https://indexagentica.com/entries/microsandbox/", "json": "https://indexagentica.com/api/entries/microsandbox.json" }, { "id": "kubernetes-agent-sandbox", "name": "Agent Sandbox (Kubernetes SIG Apps)", "summary": "Kubernetes CRD and controller for isolated, stateful, singleton sandbox pods for agent runtimes and RL, with templates, claims and warm pools.", "url": "https://indexagentica.com/entries/kubernetes-agent-sandbox/", "json": "https://indexagentica.com/api/entries/kubernetes-agent-sandbox.json" }, { "id": "sandbox-runtime", "name": "Anthropic Sandbox Runtime (srt)", "summary": "Lightweight OS-level sandbox enforcing filesystem and network restrictions on agents, MCP servers and arbitrary processes, without a container.", "url": "https://indexagentica.com/entries/sandbox-runtime/", "json": "https://indexagentica.com/api/entries/sandbox-runtime.json" }, { "id": "docker-sandboxes", "name": "Docker Sandboxes", "summary": "Docker's `sbx` CLI runs coding agents like Claude Code and Codex in isolated microVM sandboxes, locally for free or on metered Docker-managed cloud compute.", "url": "https://indexagentica.com/entries/docker-sandboxes/", "json": "https://indexagentica.com/api/entries/docker-sandboxes.json" } ], "criteria": [ "Isolation boundary", "Runs on", "Agent interface", "Network and secrets", "Maturity", "License" ], "rows": { "opensandbox": { "Isolation boundary": "Docker containers locally; on Kubernetes, the Fast Sandbox runtime uses Firecracker microVMs (README: 64 ms P50 creation, serial) with pause/resume of memory and disk", "Runs on": "Your Docker host to start (uvx opensandbox-server), then Kubernetes through the same lifecycle API, with resource pools and batch creation", "Agent interface": "Lifecycle and execution APIs; SDKs for Python, Java/Kotlin, TypeScript, C#/.NET and Go; osb CLI; MCP server; examples for coding agents, browsers and desktops", "Network and secrets": "Unified ingress gateway, per-sandbox egress policies, Credential Vault so sandboxed code can call services without seeing real credentials", "Maturity": "Latest release tag release-1.1.1 (2026-10-09); release images signed with Cosign; listed in the CNCF Landscape", "License": "Apache-2.0" }, "aio-sandbox": { "Isolation boundary": "One Docker container holding browser, shell, files, VS Code Server, Jupyter and MCP; the README's run commands disable seccomp (--security-opt seccomp=unconfined)", "Runs on": "Any Docker host (ghcr.io/agent-infra/sandbox); for cloud use, keep port 8080 private behind a reverse proxy or Ingress", "Agent interface": "HTTP API (docs at /v1/docs), MCP at /mcp, VNC browser, VS Code Server; SDKs for Python (agent-sandbox), TypeScript (@agent-infra/sandbox) and Go", "Network and secrets": "Optional SANDBOX_API_KEY protects every service (header, bearer or query parameter); without it the services are open; no egress policy documented in the README", "Maturity": "Latest release v1.11.0 (2026-06-23); pin release tags for reproducible deployments", "License": "Apache-2.0" }, "microsandbox": { "Isolation boundary": "Local microVMs; README reports average guest boot under 100 ms (on an M1)", "Runs on": "macOS on Apple Silicon, Linux with KVM, Windows with WHP; the SDK boots a VM as a child process, no server or daemon", "Agent interface": "msb CLI; SDKs for TypeScript, Rust, Python, Go and Ruby; MCP server (microsandbox-mcp); Agent Skills so agents can create their own sandboxes", "Network and secrets": "Per-sandbox host and port allowlists; secrets bound to an allowed host that, per the README, never enter the VM", "Maturity": "Beta: the README warns of breaking changes and rough edges; latest release v0.7.8 (2026-10-09)", "License": "Apache-2.0" }, "kubernetes-agent-sandbox": { "Isolation boundary": "Delegated: a Sandbox is a pod using a RuntimeClass such as gVisor or Kata Containers; the project orchestrates, it does not isolate by itself", "Runs on": "Any Kubernetes cluster (Sandbox CRD and controller under SIG Apps), installed with kubectl apply", "Agent interface": "Kubernetes resources (Sandbox, SandboxTemplate, SandboxClaim, SandboxWarmPool); Go and Python SDKs; optional Sandbox Router HTTP proxy to reach sandbox pods", "Network and secrets": "Stable hostname and network identity per sandbox; network and secret policy is whatever your cluster and runtime enforce", "Maturity": "Latest release v1.0.7 (2026-10-15)", "License": "Apache-2.0" }, "sandbox-runtime": { "Isolation boundary": "OS-level, no container or VM: sandbox-exec (Seatbelt) on macOS, bubblewrap with network namespace removal on Linux, a dedicated local user plus a Windows Filtering Platform fence on Windows", "Runs on": "The developer's own machine, wrapping one process tree (an agent, a local MCP server, a shell command)", "Agent interface": "srt CLI (srt \"command\") and a library; npm install -g @anthropic-ai/sandbox-runtime; can wrap MCP servers in .mcp.json", "Network and secrets": "Network deny-by-default through host proxies with allowedDomains / deniedDomains; writes deny-by-default (allowWrite); reads allowed everywhere unless you add denyRead", "Maturity": "Beta research preview built for Claude Code; latest release v0.0.81 (2026-10-20)", "License": "Apache-2.0" }, "docker-sandboxes": { "Isolation boundary": "microVM per sandbox", "Runs on": "Your machine (free, including commercial use) or Docker-managed cloud compute (metered); sbx move recreates a sandbox's files on the other side", "Agent interface": "sbx CLI with presets for coding agents (Claude Code, Codex, Copilot, Cursor, Gemini, OpenCode and others); MCP gateway; Sandboxes API and SDK for cloud sandboxes", "Network and secrets": "Network policies and credential handling per environment (local and cloud are separate); org-wide network, filesystem and MCP policies are a paid add-on", "Maturity": "Generally available product from Docker", "License": "proprietary" } }, "table": [ { "entry": "opensandbox", "name": "OpenSandbox", "url": "https://indexagentica.com/entries/opensandbox/", "values": { "Isolation boundary": "Docker containers locally; on Kubernetes, the Fast Sandbox runtime uses Firecracker microVMs (README: 64 ms P50 creation, serial) with pause/resume of memory and disk", "Runs on": "Your Docker host to start (uvx opensandbox-server), then Kubernetes through the same lifecycle API, with resource pools and batch creation", "Agent interface": "Lifecycle and execution APIs; SDKs for Python, Java/Kotlin, TypeScript, C#/.NET and Go; osb CLI; MCP server; examples for coding agents, browsers and desktops", "Network and secrets": "Unified ingress gateway, per-sandbox egress policies, Credential Vault so sandboxed code can call services without seeing real credentials", "Maturity": "Latest release tag release-1.1.1 (2026-10-09); release images signed with Cosign; listed in the CNCF Landscape", "License": "Apache-2.0" } }, { "entry": "aio-sandbox", "name": "AIO Sandbox (agent-infra)", "url": "https://indexagentica.com/entries/aio-sandbox/", "values": { "Isolation boundary": "One Docker container holding browser, shell, files, VS Code Server, Jupyter and MCP; the README's run commands disable seccomp (--security-opt seccomp=unconfined)", "Runs on": "Any Docker host (ghcr.io/agent-infra/sandbox); for cloud use, keep port 8080 private behind a reverse proxy or Ingress", "Agent interface": "HTTP API (docs at /v1/docs), MCP at /mcp, VNC browser, VS Code Server; SDKs for Python (agent-sandbox), TypeScript (@agent-infra/sandbox) and Go", "Network and secrets": "Optional SANDBOX_API_KEY protects every service (header, bearer or query parameter); without it the services are open; no egress policy documented in the README", "Maturity": "Latest release v1.11.0 (2026-06-23); pin release tags for reproducible deployments", "License": "Apache-2.0" } }, { "entry": "microsandbox", "name": "microsandbox", "url": "https://indexagentica.com/entries/microsandbox/", "values": { "Isolation boundary": "Local microVMs; README reports average guest boot under 100 ms (on an M1)", "Runs on": "macOS on Apple Silicon, Linux with KVM, Windows with WHP; the SDK boots a VM as a child process, no server or daemon", "Agent interface": "msb CLI; SDKs for TypeScript, Rust, Python, Go and Ruby; MCP server (microsandbox-mcp); Agent Skills so agents can create their own sandboxes", "Network and secrets": "Per-sandbox host and port allowlists; secrets bound to an allowed host that, per the README, never enter the VM", "Maturity": "Beta: the README warns of breaking changes and rough edges; latest release v0.7.8 (2026-10-09)", "License": "Apache-2.0" } }, { "entry": "kubernetes-agent-sandbox", "name": "Agent Sandbox (Kubernetes SIG Apps)", "url": "https://indexagentica.com/entries/kubernetes-agent-sandbox/", "values": { "Isolation boundary": "Delegated: a Sandbox is a pod using a RuntimeClass such as gVisor or Kata Containers; the project orchestrates, it does not isolate by itself", "Runs on": "Any Kubernetes cluster (Sandbox CRD and controller under SIG Apps), installed with kubectl apply", "Agent interface": "Kubernetes resources (Sandbox, SandboxTemplate, SandboxClaim, SandboxWarmPool); Go and Python SDKs; optional Sandbox Router HTTP proxy to reach sandbox pods", "Network and secrets": "Stable hostname and network identity per sandbox; network and secret policy is whatever your cluster and runtime enforce", "Maturity": "Latest release v1.0.7 (2026-10-15)", "License": "Apache-2.0" } }, { "entry": "sandbox-runtime", "name": "Anthropic Sandbox Runtime (srt)", "url": "https://indexagentica.com/entries/sandbox-runtime/", "values": { "Isolation boundary": "OS-level, no container or VM: sandbox-exec (Seatbelt) on macOS, bubblewrap with network namespace removal on Linux, a dedicated local user plus a Windows Filtering Platform fence on Windows", "Runs on": "The developer's own machine, wrapping one process tree (an agent, a local MCP server, a shell command)", "Agent interface": "srt CLI (srt \"command\") and a library; npm install -g @anthropic-ai/sandbox-runtime; can wrap MCP servers in .mcp.json", "Network and secrets": "Network deny-by-default through host proxies with allowedDomains / deniedDomains; writes deny-by-default (allowWrite); reads allowed everywhere unless you add denyRead", "Maturity": "Beta research preview built for Claude Code; latest release v0.0.81 (2026-10-20)", "License": "Apache-2.0" } }, { "entry": "docker-sandboxes", "name": "Docker Sandboxes", "url": "https://indexagentica.com/entries/docker-sandboxes/", "values": { "Isolation boundary": "microVM per sandbox", "Runs on": "Your machine (free, including commercial use) or Docker-managed cloud compute (metered); sbx move recreates a sandbox's files on the other side", "Agent interface": "sbx CLI with presets for coding agents (Claude Code, Codex, Copilot, Cursor, Gemini, OpenCode and others); MCP gateway; Sandboxes API and SDK for cloud sandboxes", "Network and secrets": "Network policies and credential handling per environment (local and cloud are separate); org-wide network, filesystem and MCP policies are a paid add-on", "Maturity": "Generally available product from Docker", "License": "proprietary" } } ], "verdict": "For one developer's coding agent, start with Docker Sandboxes (microVMs, free locally) or microsandbox (microVMs in your own code). sandbox-runtime is the lightest, but it is a process wrapper whose reads are open unless you deny them. For many sandboxes on your own cluster, use OpenSandbox if you want a full platform with egress policies and a credential vault, or Kubernetes Agent Sandbox if you already run gVisor or Kata and want plain Kubernetes resources. Use AIO Sandbox when an agent needs a browser, shell and editor in one place, but treat it as a container with seccomp off, not a VM." }, "entries_detail": [ { "id": "opensandbox", "name": "OpenSandbox", "summary": "Open-source sandbox platform for running agents on your own infrastructure: isolated environments for code, commands, files, browsers and desktops, from Docker to Kubernetes.", "url": "https://indexagentica.com/entries/opensandbox/", "json": "https://indexagentica.com/api/entries/opensandbox.json" }, { "id": "aio-sandbox", "name": "AIO Sandbox (agent-infra)", "summary": "All-in-one agent sandbox in a single Docker container: browser (VNC/CDP), shell, file system, VS Code Server, Jupyter and MCP sharing one file system.", "url": "https://indexagentica.com/entries/aio-sandbox/", "json": "https://indexagentica.com/api/entries/aio-sandbox.json" }, { "id": "microsandbox", "name": "microsandbox", "summary": "Easy, fast, programmable, local-first microVM runtime for untrusted workloads.", "url": "https://indexagentica.com/entries/microsandbox/", "json": "https://indexagentica.com/api/entries/microsandbox.json" }, { "id": "kubernetes-agent-sandbox", "name": "Agent Sandbox (Kubernetes SIG Apps)", "summary": "Kubernetes CRD and controller for isolated, stateful, singleton sandbox pods for agent runtimes and RL, with templates, claims and warm pools.", "url": "https://indexagentica.com/entries/kubernetes-agent-sandbox/", "json": "https://indexagentica.com/api/entries/kubernetes-agent-sandbox.json" }, { "id": "sandbox-runtime", "name": "Anthropic Sandbox Runtime (srt)", "summary": "Lightweight OS-level sandbox enforcing filesystem and network restrictions on agents, MCP servers and arbitrary processes, without a container.", "url": "https://indexagentica.com/entries/sandbox-runtime/", "json": "https://indexagentica.com/api/entries/sandbox-runtime.json" }, { "id": "docker-sandboxes", "name": "Docker Sandboxes", "summary": "Docker's `sbx` CLI runs coding agents like Claude Code and Codex in isolated microVM sandboxes, locally for free or on metered Docker-managed cloud compute.", "url": "https://indexagentica.com/entries/docker-sandboxes/", "json": "https://indexagentica.com/api/entries/docker-sandboxes.json" }, { "id": "microsandbox-mcp", "name": "microsandbox MCP Server", "summary": "MCP server that lets AI agents create lightweight microsandbox sandboxes, execute code, manage files and monitor resources.", "url": "https://indexagentica.com/entries/microsandbox-mcp/", "json": "https://indexagentica.com/api/entries/microsandbox-mcp.json" }, { "id": "e2b", "name": "E2B", "summary": "Open-source, secure cloud sandboxes for AI agents: an isolated machine per agent to run code, browse and use tools.", "url": "https://indexagentica.com/entries/e2b/", "json": "https://indexagentica.com/api/entries/e2b.json" }, { "id": "daytona", "name": "Daytona", "summary": "Secure and elastic infrastructure (sandboxes) for running AI-generated code.", "url": "https://indexagentica.com/entries/daytona/", "json": "https://indexagentica.com/api/entries/daytona.json" }, { "id": "e2b-desktop", "name": "E2B Desktop Sandbox", "summary": "Open-source, isolated virtual Linux desktops for computer-use agents, built on E2B sandboxes, with Python and JavaScript SDKs and desktop streaming.", "url": "https://indexagentica.com/entries/e2b-desktop/", "json": "https://indexagentica.com/api/entries/e2b-desktop.json" }, { "id": "cua", "name": "Cua", "summary": "Open-source computer-use platform: full desktops for agents (Cua Spaces), a desktop-automation driver with MCP, local macOS/Linux VMs (Lume) and Cua Bench.", "url": "https://indexagentica.com/entries/cua/", "json": "https://indexagentica.com/api/entries/cua.json" }, { "id": "claude-code", "name": "Claude Code", "summary": "Anthropic's agentic coding tool that reads your codebase, edits files, runs commands and integrates with dev tools; available in terminal, IDE, desktop and browser.", "url": "https://indexagentica.com/entries/claude-code/", "json": "https://indexagentica.com/api/entries/claude-code.json" }, { "id": "kubernetes-mcp-server", "name": "Kubernetes MCP Server", "summary": "Go-native MCP server for Kubernetes and OpenShift: CRUD on any resource, pods (logs, exec, top), events, Helm, Tekton and KubeVirt, talking to the API server directly.", "url": "https://indexagentica.com/entries/kubernetes-mcp-server/", "json": "https://indexagentica.com/api/entries/kubernetes-mcp-server.json" } ], "related": [ { "type": "comparison", "id": "code-sandboxes", "title": "Code sandboxes for AI agents", "url": "https://indexagentica.com/compare/code-sandboxes/", "json": "https://indexagentica.com/api/longform/compare/code-sandboxes.json" }, { "type": "guide", "id": "run-untrusted-code-in-a-sandbox", "title": "Run agent-generated code safely in a sandbox", "url": "https://indexagentica.com/guides/run-untrusted-code-in-a-sandbox/", "json": "https://indexagentica.com/api/longform/guides/run-untrusted-code-in-a-sandbox.json" }, { "type": "comparison", "id": "coding-agent-harnesses", "title": "Terminal coding agents compared", "url": "https://indexagentica.com/compare/coding-agent-harnesses/", "json": "https://indexagentica.com/api/longform/compare/coding-agent-harnesses.json" }, { "type": "comparison", "id": "devops-mcp-servers", "title": "DevOps and observability MCP servers compared", "url": "https://indexagentica.com/compare/devops-mcp-servers/", "json": "https://indexagentica.com/api/longform/compare/devops-mcp-servers.json" }, { "type": "comparison", "id": "cloud-browsers-for-agents", "title": "Cloud browsers for AI agents", "url": "https://indexagentica.com/compare/cloud-browsers-for-agents/", "json": "https://indexagentica.com/api/longform/compare/cloud-browsers-for-agents.json" }, { "type": "stack", "id": "coding-agent-starter", "title": "Coding agent starter stack", "url": "https://indexagentica.com/stacks/coding-agent-starter/", "json": "https://indexagentica.com/api/longform/stacks/coding-agent-starter.json" }, { "type": "comparison", "id": "mcp-gateways", "title": "MCP gateways compared", "url": "https://indexagentica.com/compare/mcp-gateways/", "json": "https://indexagentica.com/api/longform/compare/mcp-gateways.json" } ], "sources": [ { "title": "OpenSandbox README", "url": "https://github.com/opensandbox-group/OpenSandbox", "accessed": "2026-10-20" }, { "title": "OpenSandbox website", "url": "https://open-sandbox.ai/", "accessed": "2026-10-20" }, { "title": "AIO Sandbox README", "url": "https://github.com/agent-infra/sandbox", "accessed": "2026-10-20" }, { "title": "AIO Sandbox website", "url": "https://sandbox.agent-infra.com/", "accessed": "2026-10-20" }, { "title": "microsandbox README", "url": "https://github.com/superradcompany/microsandbox", "accessed": "2026-10-20" }, { "title": "Kubernetes Agent Sandbox README", "url": "https://github.com/kubernetes-sigs/agent-sandbox", "accessed": "2026-10-20" }, { "title": "Anthropic sandbox-runtime README", "url": "https://github.com/anthropics/sandbox-runtime", "accessed": "2026-10-20" }, { "title": "Docker Sandboxes docs", "url": "https://docs.docker.com/ai/sandboxes/", "accessed": "2026-10-20" }, { "title": "Docker Sandboxes product page", "url": "https://www.docker.com/products/docker-sandboxes/", "accessed": "2026-10-20" } ], "front_matter": { "id": "self-hosted-agent-sandboxes", "type": "comparison", "title": "Self-hosted sandboxes for agents compared", "summary": "Six ways to isolate agent-run code on hardware you control (OpenSandbox, AIO Sandbox, microsandbox, Kubernetes Agent Sandbox, Anthropic's sandbox-runtime and Docker Sandboxes' local mode) compared on isolation, where they run, agent interface, network and secret controls, maturity and license.", "description": "A primary-source comparison of sandboxes you can run yourself, from an OS-level process wrapper to microVMs on a laptop to Kubernetes-scale platforms. It explains which boundary each one actually provides and which defaults to change before an agent uses it. Hosted sandbox services are covered in the code sandboxes comparison.", "author": "Agentica Author", "tags": [ "sandbox", "self-hosted", "code-execution", "microvm", "kubernetes", "security", "isolation", "infrastructure" ], "entries": [ "opensandbox", "aio-sandbox", "microsandbox", "kubernetes-agent-sandbox", "sandbox-runtime", "docker-sandboxes", "microsandbox-mcp", "e2b", "daytona", "e2b-desktop", "cua", "claude-code", "kubernetes-mcp-server" ], "related": [ "code-sandboxes", "run-untrusted-code-in-a-sandbox", "coding-agent-harnesses", "devops-mcp-servers", "cloud-browsers-for-agents", "coding-agent-starter", "mcp-gateways" ], "subjects": [ "opensandbox", "aio-sandbox", "microsandbox", "kubernetes-agent-sandbox", "sandbox-runtime", "docker-sandboxes" ], "criteria": [ "Isolation boundary", "Runs on", "Agent interface", "Network and secrets", "Maturity", "License" ], "rows": { "opensandbox": { "Isolation boundary": "Docker containers locally; on Kubernetes, the Fast Sandbox runtime uses Firecracker microVMs (README: 64 ms P50 creation, serial) with pause/resume of memory and disk", "Runs on": "Your Docker host to start (uvx opensandbox-server), then Kubernetes through the same lifecycle API, with resource pools and batch creation", "Agent interface": "Lifecycle and execution APIs; SDKs for Python, Java/Kotlin, TypeScript, C#/.NET and Go; osb CLI; MCP server; examples for coding agents, browsers and desktops", "Network and secrets": "Unified ingress gateway, per-sandbox egress policies, Credential Vault so sandboxed code can call services without seeing real credentials", "Maturity": "Latest release tag release-1.1.1 (2026-10-09); release images signed with Cosign; listed in the CNCF Landscape", "License": "Apache-2.0" }, "aio-sandbox": { "Isolation boundary": "One Docker container holding browser, shell, files, VS Code Server, Jupyter and MCP; the README's run commands disable seccomp (--security-opt seccomp=unconfined)", "Runs on": "Any Docker host (ghcr.io/agent-infra/sandbox); for cloud use, keep port 8080 private behind a reverse proxy or Ingress", "Agent interface": "HTTP API (docs at /v1/docs), MCP at /mcp, VNC browser, VS Code Server; SDKs for Python (agent-sandbox), TypeScript (@agent-infra/sandbox) and Go", "Network and secrets": "Optional SANDBOX_API_KEY protects every service (header, bearer or query parameter); without it the services are open; no egress policy documented in the README", "Maturity": "Latest release v1.11.0 (2026-06-23); pin release tags for reproducible deployments", "License": "Apache-2.0" }, "microsandbox": { "Isolation boundary": "Local microVMs; README reports average guest boot under 100 ms (on an M1)", "Runs on": "macOS on Apple Silicon, Linux with KVM, Windows with WHP; the SDK boots a VM as a child process, no server or daemon", "Agent interface": "msb CLI; SDKs for TypeScript, Rust, Python, Go and Ruby; MCP server (microsandbox-mcp); Agent Skills so agents can create their own sandboxes", "Network and secrets": "Per-sandbox host and port allowlists; secrets bound to an allowed host that, per the README, never enter the VM", "Maturity": "Beta: the README warns of breaking changes and rough edges; latest release v0.7.8 (2026-10-09)", "License": "Apache-2.0" }, "kubernetes-agent-sandbox": { "Isolation boundary": "Delegated: a Sandbox is a pod using a RuntimeClass such as gVisor or Kata Containers; the project orchestrates, it does not isolate by itself", "Runs on": "Any Kubernetes cluster (Sandbox CRD and controller under SIG Apps), installed with kubectl apply", "Agent interface": "Kubernetes resources (Sandbox, SandboxTemplate, SandboxClaim, SandboxWarmPool); Go and Python SDKs; optional Sandbox Router HTTP proxy to reach sandbox pods", "Network and secrets": "Stable hostname and network identity per sandbox; network and secret policy is whatever your cluster and runtime enforce", "Maturity": "Latest release v1.0.7 (2026-10-15)", "License": "Apache-2.0" }, "sandbox-runtime": { "Isolation boundary": "OS-level, no container or VM: sandbox-exec (Seatbelt) on macOS, bubblewrap with network namespace removal on Linux, a dedicated local user plus a Windows Filtering Platform fence on Windows", "Runs on": "The developer's own machine, wrapping one process tree (an agent, a local MCP server, a shell command)", "Agent interface": "srt CLI (srt \"command\") and a library; npm install -g @anthropic-ai/sandbox-runtime; can wrap MCP servers in .mcp.json", "Network and secrets": "Network deny-by-default through host proxies with allowedDomains / deniedDomains; writes deny-by-default (allowWrite); reads allowed everywhere unless you add denyRead", "Maturity": "Beta research preview built for Claude Code; latest release v0.0.81 (2026-10-20)", "License": "Apache-2.0" }, "docker-sandboxes": { "Isolation boundary": "microVM per sandbox", "Runs on": "Your machine (free, including commercial use) or Docker-managed cloud compute (metered); sbx move recreates a sandbox's files on the other side", "Agent interface": "sbx CLI with presets for coding agents (Claude Code, Codex, Copilot, Cursor, Gemini, OpenCode and others); MCP gateway; Sandboxes API and SDK for cloud sandboxes", "Network and secrets": "Network policies and credential handling per environment (local and cloud are separate); org-wide network, filesystem and MCP policies are a paid add-on", "Maturity": "Generally available product from Docker", "License": "proprietary" } }, "verdict": "For one developer's coding agent, start with Docker Sandboxes (microVMs, free locally) or microsandbox (microVMs in your own code). sandbox-runtime is the lightest, but it is a process wrapper whose reads are open unless you deny them. For many sandboxes on your own cluster, use OpenSandbox if you want a full platform with egress policies and a credential vault, or Kubernetes Agent Sandbox if you already run gVisor or Kata and want plain Kubernetes resources. Use AIO Sandbox when an agent needs a browser, shell and editor in one place, but treat it as a container with seccomp off, not a VM.", "sources": [ { "title": "OpenSandbox README", "url": "https://github.com/opensandbox-group/OpenSandbox", "accessed": "2026-10-20" }, { "title": "OpenSandbox website", "url": "https://open-sandbox.ai/", "accessed": "2026-10-20" }, { "title": "AIO Sandbox README", "url": "https://github.com/agent-infra/sandbox", "accessed": "2026-10-20" }, { "title": "AIO Sandbox website", "url": "https://sandbox.agent-infra.com/", "accessed": "2026-10-20" }, { "title": "microsandbox README", "url": "https://github.com/superradcompany/microsandbox", "accessed": "2026-10-20" }, { "title": "Kubernetes Agent Sandbox README", "url": "https://github.com/kubernetes-sigs/agent-sandbox", "accessed": "2026-10-20" }, { "title": "Anthropic sandbox-runtime README", "url": "https://github.com/anthropics/sandbox-runtime", "accessed": "2026-10-20" }, { "title": "Docker Sandboxes docs", "url": "https://docs.docker.com/ai/sandboxes/", "accessed": "2026-10-20" }, { "title": "Docker Sandboxes product page", "url": "https://www.docker.com/products/docker-sandboxes/", "accessed": "2026-10-20" } ], "last_verified": "2026-10-20", "published": "2026-10-20" }, "markdown": "\n## What this covers\n\nThese sandboxes run on machines you control: a laptop, a server or your own Kubernetes cluster. Hosted services such as [E2B](https://indexagentica.com/entries/e2b/) and [Daytona](https://indexagentica.com/entries/daytona/) are compared in [code sandboxes](https://indexagentica.com/compare/code-sandboxes/). [Run untrusted code in a sandbox](https://indexagentica.com/guides/run-untrusted-code-in-a-sandbox/) explains why an agent needs one at all.\n\nFacts here come from each project's README or docs as of 2026-10-20, plus the release dates on GitHub. Unlike the [DevOps MCP servers comparison](https://indexagentica.com/compare/devops-mcp-servers/), we did not run these sandboxes for this piece. Boot-time figures are each project's own.\n\n## The boundary is the main difference\n\nThe six fall into three groups, from strongest to weakest isolation:\n\n- **A virtual machine per sandbox.** [microsandbox](https://indexagentica.com/entries/microsandbox/), [Docker Sandboxes](https://indexagentica.com/entries/docker-sandboxes/) and [OpenSandbox's](https://indexagentica.com/entries/opensandbox/) Fast Sandbox runtime on Kubernetes give each sandbox its own guest kernel. Code that escapes a process still has to break out of a VM.\n- **Whatever runtime you configure.** [Kubernetes Agent Sandbox](https://indexagentica.com/entries/kubernetes-agent-sandbox/) manages pods and leaves isolation to a `RuntimeClass` such as gVisor or Kata Containers. Its README is explicit that it orchestrates and does not isolate by itself. On the default runtime, a Sandbox is an ordinary container.\n- **A container or a process wrapper.** OpenSandbox's local Docker mode and [AIO Sandbox](https://indexagentica.com/entries/aio-sandbox/) are containers. AIO's documented `docker run` lines add `--security-opt seccomp=unconfined`, which removes Docker's default system-call filter. Anthropic's [sandbox-runtime](https://indexagentica.com/entries/sandbox-runtime/) (`srt`) uses no container at all. It restricts one process tree with Seatbelt on macOS, bubblewrap on Linux, or a dedicated user account and firewall rules on Windows.\n\nChoose the boundary based on what the agent runs. Code the model wrote from untrusted input, such as a web page, an issue or an email, calls for a VM. A trusted coding agent running your own tests can use a process or container wrapper, as long as its files and network are locked down.\n\n## Defaults to change before an agent uses it\n\n- **sandbox-runtime reads are open.** By default, network access and writes are denied, but reads are allowed everywhere. Add `denyRead` entries for places like `~/.ssh` and other credential folders (the README's example blocks `~/.ssh/id_rsa`). Network traffic goes through proxies on the host that enforce `allowedDomains` and `deniedDomains`, covering both HTTP(S) and other TCP traffic.\n- **AIO Sandbox is open without a key.** If `SANDBOX_API_KEY` is not set, the API, MCP endpoint, VNC and Jupyter accept anyone who can reach port 8080. The README binds the port to `127.0.0.1` for that reason. Set the key, and in the cloud put the container behind a reverse proxy or Ingress instead of publishing the port.\n- **Egress is opt-in almost everywhere.** OpenSandbox has per-sandbox egress policies, and microsandbox has host and port allowlists per sandbox. Docker Sandboxes has network policies, with central org policies as a paid add-on. For Kubernetes Agent Sandbox, use your cluster's NetworkPolicies. Without one of these, an agent that reads a malicious page can send your data anywhere.\n- **Keep real secrets out of the sandbox.** OpenSandbox's Credential Vault and microsandbox's host-bound secrets both aim to let sandboxed code call an API without ever holding the real key. Prefer that over passing tokens as environment variables.\n\n## How agents drive them\n\n- **MCP:** OpenSandbox, AIO Sandbox (at `/mcp`) and microsandbox ([microsandbox-mcp](https://indexagentica.com/entries/microsandbox-mcp/)) expose sandboxes as MCP tools, so any MCP client can create one and run code in it. Docker Sandboxes takes the opposite approach: its MCP gateway gives MCP servers to the agent running inside the sandbox.\n- **SDKs:** OpenSandbox (Python, Java/Kotlin, TypeScript, C#/.NET, Go), microsandbox (TypeScript, Rust, Python, Go, Ruby), AIO Sandbox (Python, TypeScript, Go) and Kubernetes Agent Sandbox (Go, Python).\n- **Wrap the whole agent:** Docker Sandboxes' `sbx` and `srt` put the coding agent itself inside the sandbox ([Claude Code](https://indexagentica.com/entries/claude-code/), Codex and others) rather than giving the agent a tool. For the harness side, see [coding agent harnesses compared](https://indexagentica.com/compare/coding-agent-harnesses/).\n- **Desktops and browsers:** AIO Sandbox puts a VNC browser next to the shell with a shared file system. For full desktops, see [E2B Desktop](https://indexagentica.com/entries/e2b-desktop/) and [Cua](https://indexagentica.com/entries/cua/).\n\n## Scale and evaluation workloads\n\nFor many short-lived sandboxes, such as eval runs or RL rollouts, OpenSandbox (resource pools and batch creation) and Kubernetes Agent Sandbox (`SandboxWarmPool` and `SandboxClaim`) both keep warm capacity so agents do not wait for a cold start. The laptop-oriented options (microsandbox, `srt`, local Docker Sandboxes) are built for one developer's machine. Whatever you choose, the agent that manages the cluster should not run inside the same trust boundary as the code it launches. The [DevOps MCP servers comparison](https://indexagentica.com/compare/devops-mcp-servers/) covers giving an agent read-only access to Kubernetes through the [Kubernetes MCP Server](https://indexagentica.com/entries/kubernetes-mcp-server/).\n", "raw": "---\nid: self-hosted-agent-sandboxes\ntype: comparison\ntitle: Self-hosted sandboxes for agents compared\nsummary: \"Six ways to isolate agent-run code on hardware you control (OpenSandbox, AIO Sandbox, microsandbox, Kubernetes Agent Sandbox, Anthropic's sandbox-runtime and Docker Sandboxes' local mode) compared on isolation, where they run, agent interface, network and secret controls, maturity and license.\"\ndescription: \"A primary-source comparison of sandboxes you can run yourself, from an OS-level process wrapper to microVMs on a laptop to Kubernetes-scale platforms. It explains which boundary each one actually provides and which defaults to change before an agent uses it. Hosted sandbox services are covered in the code sandboxes comparison.\"\nauthor: Agentica Author\ntags: [sandbox, self-hosted, code-execution, microvm, kubernetes, security, isolation, infrastructure]\nentries: [opensandbox, aio-sandbox, microsandbox, kubernetes-agent-sandbox, sandbox-runtime, docker-sandboxes, microsandbox-mcp, e2b, daytona, e2b-desktop, cua, claude-code, kubernetes-mcp-server]\nrelated: [code-sandboxes, run-untrusted-code-in-a-sandbox, coding-agent-harnesses, devops-mcp-servers, cloud-browsers-for-agents, coding-agent-starter, mcp-gateways]\nsubjects: [opensandbox, aio-sandbox, microsandbox, kubernetes-agent-sandbox, sandbox-runtime, docker-sandboxes]\ncriteria:\n - Isolation boundary\n - Runs on\n - Agent interface\n - Network and secrets\n - Maturity\n - License\nrows:\n opensandbox:\n Isolation boundary: \"Docker containers locally; on Kubernetes, the Fast Sandbox runtime uses Firecracker microVMs (README: 64 ms P50 creation, serial) with pause/resume of memory and disk\"\n Runs on: \"Your Docker host to start (uvx opensandbox-server), then Kubernetes through the same lifecycle API, with resource pools and batch creation\"\n Agent interface: \"Lifecycle and execution APIs; SDKs for Python, Java/Kotlin, TypeScript, C#/.NET and Go; osb CLI; MCP server; examples for coding agents, browsers and desktops\"\n Network and secrets: \"Unified ingress gateway, per-sandbox egress policies, Credential Vault so sandboxed code can call services without seeing real credentials\"\n Maturity: \"Latest release tag release-1.1.1 (2026-10-09); release images signed with Cosign; listed in the CNCF Landscape\"\n License: \"Apache-2.0\"\n aio-sandbox:\n Isolation boundary: \"One Docker container holding browser, shell, files, VS Code Server, Jupyter and MCP; the README's run commands disable seccomp (--security-opt seccomp=unconfined)\"\n Runs on: \"Any Docker host (ghcr.io/agent-infra/sandbox); for cloud use, keep port 8080 private behind a reverse proxy or Ingress\"\n Agent interface: \"HTTP API (docs at /v1/docs), MCP at /mcp, VNC browser, VS Code Server; SDKs for Python (agent-sandbox), TypeScript (@agent-infra/sandbox) and Go\"\n Network and secrets: \"Optional SANDBOX_API_KEY protects every service (header, bearer or query parameter); without it the services are open; no egress policy documented in the README\"\n Maturity: \"Latest release v1.11.0 (2026-06-23); pin release tags for reproducible deployments\"\n License: \"Apache-2.0\"\n microsandbox:\n Isolation boundary: \"Local microVMs; README reports average guest boot under 100 ms (on an M1)\"\n Runs on: \"macOS on Apple Silicon, Linux with KVM, Windows with WHP; the SDK boots a VM as a child process, no server or daemon\"\n Agent interface: \"msb CLI; SDKs for TypeScript, Rust, Python, Go and Ruby; MCP server (microsandbox-mcp); Agent Skills so agents can create their own sandboxes\"\n Network and secrets: \"Per-sandbox host and port allowlists; secrets bound to an allowed host that, per the README, never enter the VM\"\n Maturity: \"Beta: the README warns of breaking changes and rough edges; latest release v0.7.8 (2026-10-09)\"\n License: \"Apache-2.0\"\n kubernetes-agent-sandbox:\n Isolation boundary: \"Delegated: a Sandbox is a pod using a RuntimeClass such as gVisor or Kata Containers; the project orchestrates, it does not isolate by itself\"\n Runs on: \"Any Kubernetes cluster (Sandbox CRD and controller under SIG Apps), installed with kubectl apply\"\n Agent interface: \"Kubernetes resources (Sandbox, SandboxTemplate, SandboxClaim, SandboxWarmPool); Go and Python SDKs; optional Sandbox Router HTTP proxy to reach sandbox pods\"\n Network and secrets: \"Stable hostname and network identity per sandbox; network and secret policy is whatever your cluster and runtime enforce\"\n Maturity: \"Latest release v1.0.7 (2026-10-15)\"\n License: \"Apache-2.0\"\n sandbox-runtime:\n Isolation boundary: \"OS-level, no container or VM: sandbox-exec (Seatbelt) on macOS, bubblewrap with network namespace removal on Linux, a dedicated local user plus a Windows Filtering Platform fence on Windows\"\n Runs on: \"The developer's own machine, wrapping one process tree (an agent, a local MCP server, a shell command)\"\n Agent interface: \"srt CLI (srt \\\"command\\\") and a library; npm install -g @anthropic-ai/sandbox-runtime; can wrap MCP servers in .mcp.json\"\n Network and secrets: \"Network deny-by-default through host proxies with allowedDomains / deniedDomains; writes deny-by-default (allowWrite); reads allowed everywhere unless you add denyRead\"\n Maturity: \"Beta research preview built for Claude Code; latest release v0.0.81 (2026-10-20)\"\n License: \"Apache-2.0\"\n docker-sandboxes:\n Isolation boundary: \"microVM per sandbox\"\n Runs on: \"Your machine (free, including commercial use) or Docker-managed cloud compute (metered); sbx move recreates a sandbox's files on the other side\"\n Agent interface: \"sbx CLI with presets for coding agents (Claude Code, Codex, Copilot, Cursor, Gemini, OpenCode and others); MCP gateway; Sandboxes API and SDK for cloud sandboxes\"\n Network and secrets: \"Network policies and credential handling per environment (local and cloud are separate); org-wide network, filesystem and MCP policies are a paid add-on\"\n Maturity: \"Generally available product from Docker\"\n License: \"proprietary\"\nverdict: \"For one developer's coding agent, start with Docker Sandboxes (microVMs, free locally) or microsandbox (microVMs in your own code). sandbox-runtime is the lightest, but it is a process wrapper whose reads are open unless you deny them. For many sandboxes on your own cluster, use OpenSandbox if you want a full platform with egress policies and a credential vault, or Kubernetes Agent Sandbox if you already run gVisor or Kata and want plain Kubernetes resources. Use AIO Sandbox when an agent needs a browser, shell and editor in one place, but treat it as a container with seccomp off, not a VM.\"\nsources:\n - {title: OpenSandbox README, url: \"https://github.com/opensandbox-group/OpenSandbox\", accessed: 2026-10-20}\n - {title: OpenSandbox website, url: \"https://open-sandbox.ai/\", accessed: 2026-10-20}\n - {title: AIO Sandbox README, url: \"https://github.com/agent-infra/sandbox\", accessed: 2026-10-20}\n - {title: AIO Sandbox website, url: \"https://sandbox.agent-infra.com/\", accessed: 2026-10-20}\n - {title: microsandbox README, url: \"https://github.com/superradcompany/microsandbox\", accessed: 2026-10-20}\n - {title: Kubernetes Agent Sandbox README, url: \"https://github.com/kubernetes-sigs/agent-sandbox\", accessed: 2026-10-20}\n - {title: Anthropic sandbox-runtime README, url: \"https://github.com/anthropics/sandbox-runtime\", accessed: 2026-10-20}\n - {title: Docker Sandboxes docs, url: \"https://docs.docker.com/ai/sandboxes/\", accessed: 2026-10-20}\n - {title: Docker Sandboxes product page, url: \"https://www.docker.com/products/docker-sandboxes/\", accessed: 2026-10-20}\nlast_verified: 2026-10-20\npublished: 2026-10-20\n---\n\n## What this covers\n\nThese sandboxes run on machines you control: a laptop, a server or your own Kubernetes cluster. Hosted services such as [E2B](https://indexagentica.com/entries/e2b/) and [Daytona](https://indexagentica.com/entries/daytona/) are compared in [code sandboxes](https://indexagentica.com/compare/code-sandboxes/). [Run untrusted code in a sandbox](https://indexagentica.com/guides/run-untrusted-code-in-a-sandbox/) explains why an agent needs one at all.\n\nFacts here come from each project's README or docs as of 2026-10-20, plus the release dates on GitHub. Unlike the [DevOps MCP servers comparison](https://indexagentica.com/compare/devops-mcp-servers/), we did not run these sandboxes for this piece. Boot-time figures are each project's own.\n\n## The boundary is the main difference\n\nThe six fall into three groups, from strongest to weakest isolation:\n\n- **A virtual machine per sandbox.** [microsandbox](https://indexagentica.com/entries/microsandbox/), [Docker Sandboxes](https://indexagentica.com/entries/docker-sandboxes/) and [OpenSandbox's](https://indexagentica.com/entries/opensandbox/) Fast Sandbox runtime on Kubernetes give each sandbox its own guest kernel. Code that escapes a process still has to break out of a VM.\n- **Whatever runtime you configure.** [Kubernetes Agent Sandbox](https://indexagentica.com/entries/kubernetes-agent-sandbox/) manages pods and leaves isolation to a `RuntimeClass` such as gVisor or Kata Containers. Its README is explicit that it orchestrates and does not isolate by itself. On the default runtime, a Sandbox is an ordinary container.\n- **A container or a process wrapper.** OpenSandbox's local Docker mode and [AIO Sandbox](https://indexagentica.com/entries/aio-sandbox/) are containers. AIO's documented `docker run` lines add `--security-opt seccomp=unconfined`, which removes Docker's default system-call filter. Anthropic's [sandbox-runtime](https://indexagentica.com/entries/sandbox-runtime/) (`srt`) uses no container at all. It restricts one process tree with Seatbelt on macOS, bubblewrap on Linux, or a dedicated user account and firewall rules on Windows.\n\nChoose the boundary based on what the agent runs. Code the model wrote from untrusted input, such as a web page, an issue or an email, calls for a VM. A trusted coding agent running your own tests can use a process or container wrapper, as long as its files and network are locked down.\n\n## Defaults to change before an agent uses it\n\n- **sandbox-runtime reads are open.** By default, network access and writes are denied, but reads are allowed everywhere. Add `denyRead` entries for places like `~/.ssh` and other credential folders (the README's example blocks `~/.ssh/id_rsa`). Network traffic goes through proxies on the host that enforce `allowedDomains` and `deniedDomains`, covering both HTTP(S) and other TCP traffic.\n- **AIO Sandbox is open without a key.** If `SANDBOX_API_KEY` is not set, the API, MCP endpoint, VNC and Jupyter accept anyone who can reach port 8080. The README binds the port to `127.0.0.1` for that reason. Set the key, and in the cloud put the container behind a reverse proxy or Ingress instead of publishing the port.\n- **Egress is opt-in almost everywhere.** OpenSandbox has per-sandbox egress policies, and microsandbox has host and port allowlists per sandbox. Docker Sandboxes has network policies, with central org policies as a paid add-on. For Kubernetes Agent Sandbox, use your cluster's NetworkPolicies. Without one of these, an agent that reads a malicious page can send your data anywhere.\n- **Keep real secrets out of the sandbox.** OpenSandbox's Credential Vault and microsandbox's host-bound secrets both aim to let sandboxed code call an API without ever holding the real key. Prefer that over passing tokens as environment variables.\n\n## How agents drive them\n\n- **MCP:** OpenSandbox, AIO Sandbox (at `/mcp`) and microsandbox ([microsandbox-mcp](https://indexagentica.com/entries/microsandbox-mcp/)) expose sandboxes as MCP tools, so any MCP client can create one and run code in it. Docker Sandboxes takes the opposite approach: its MCP gateway gives MCP servers to the agent running inside the sandbox.\n- **SDKs:** OpenSandbox (Python, Java/Kotlin, TypeScript, C#/.NET, Go), microsandbox (TypeScript, Rust, Python, Go, Ruby), AIO Sandbox (Python, TypeScript, Go) and Kubernetes Agent Sandbox (Go, Python).\n- **Wrap the whole agent:** Docker Sandboxes' `sbx` and `srt` put the coding agent itself inside the sandbox ([Claude Code](https://indexagentica.com/entries/claude-code/), Codex and others) rather than giving the agent a tool. For the harness side, see [coding agent harnesses compared](https://indexagentica.com/compare/coding-agent-harnesses/).\n- **Desktops and browsers:** AIO Sandbox puts a VNC browser next to the shell with a shared file system. For full desktops, see [E2B Desktop](https://indexagentica.com/entries/e2b-desktop/) and [Cua](https://indexagentica.com/entries/cua/).\n\n## Scale and evaluation workloads\n\nFor many short-lived sandboxes, such as eval runs or RL rollouts, OpenSandbox (resource pools and batch creation) and Kubernetes Agent Sandbox (`SandboxWarmPool` and `SandboxClaim`) both keep warm capacity so agents do not wait for a cold start. The laptop-oriented options (microsandbox, `srt`, local Docker Sandboxes) are built for one developer's machine. Whatever you choose, the agent that manages the cluster should not run inside the same trust boundary as the code it launches. The [DevOps MCP servers comparison](https://indexagentica.com/compare/devops-mcp-servers/) covers giving an agent read-only access to Kubernetes through the [Kubernetes MCP Server](https://indexagentica.com/entries/kubernetes-mcp-server/).\n", "html": "

What this covers

\n

These sandboxes run on machines you control: a laptop, a server or your own Kubernetes cluster. Hosted services such as E2B and Daytona are compared in code sandboxes. Run untrusted code in a sandbox explains why an agent needs one at all.

\n

Facts here come from each project's README or docs as of 2026-10-20, plus the release dates on GitHub. Unlike the DevOps MCP servers comparison, we did not run these sandboxes for this piece. Boot-time figures are each project's own.

\n

The boundary is the main difference

\n

The six fall into three groups, from strongest to weakest isolation:

\n\n

Choose the boundary based on what the agent runs. Code the model wrote from untrusted input, such as a web page, an issue or an email, calls for a VM. A trusted coding agent running your own tests can use a process or container wrapper, as long as its files and network are locked down.

\n

Defaults to change before an agent uses it

\n\n

How agents drive them

\n\n

Scale and evaluation workloads

\n

For many short-lived sandboxes, such as eval runs or RL rollouts, OpenSandbox (resource pools and batch creation) and Kubernetes Agent Sandbox (SandboxWarmPool and SandboxClaim) both keep warm capacity so agents do not wait for a cold start. The laptop-oriented options (microsandbox, srt, local Docker Sandboxes) are built for one developer's machine. Whatever you choose, the agent that manages the cluster should not run inside the same trust boundary as the code it launches. The DevOps MCP servers comparison covers giving an agent read-only access to Kubernetes through the Kubernetes MCP Server.

" }