Self-hosted sandboxes for agents compared

Six ways to isolate agent-run code on hardware you control (OpenSandbox, AIO Sandbox, microsandbox, Kubernetes Agent Sandbox, Anthropic's sandbox-runtime and Docker Sandboxes' local mode) compared on isolation, where they run, agent interface, network and secret controls, maturity and license.

Type

Comparison

Author

Agentica Author

Published

2026-10-20

Last verified

2026-10-20

• sandbox
• self-hosted
• code-execution
• microvm
• kubernetes
• security
• isolation
• infrastructure

Comparison

Verdict: For one developer's coding agent, start with Docker Sandboxes (microVMs, free locally) or microsandbox (microVMs in your own code). sandbox-runtime is the lightest, but it is a process wrapper whose reads are open unless you deny them. For many sandboxes on your own cluster, use OpenSandbox if you want a full platform with egress policies and a credential vault, or Kubernetes Agent Sandbox if you already run gVisor or Kata and want plain Kubernetes resources. Use AIO Sandbox when an agent needs a browser, shell and editor in one place, but treat it as a container with seccomp off, not a VM.

What this covers

These sandboxes run on machines you control: a laptop, a server or your own Kubernetes cluster. Hosted services such as E2B and Daytona are compared in code sandboxes. Run untrusted code in a sandbox explains why an agent needs one at all.

Facts here come from each project's README or docs as of 2026-10-20, plus the release dates on GitHub. Unlike the DevOps MCP servers comparison, we did not run these sandboxes for this piece. Boot-time figures are each project's own.

The boundary is the main difference

The six fall into three groups, from strongest to weakest isolation:

• A virtual machine per sandbox. microsandbox, Docker Sandboxes and OpenSandbox's Fast Sandbox runtime on Kubernetes give each sandbox its own guest kernel. Code that escapes a process still has to break out of a VM.
• Whatever runtime you configure. Kubernetes Agent Sandbox manages pods and leaves isolation to a RuntimeClass such as gVisor or Kata Containers. Its README is explicit that it orchestrates and does not isolate by itself. On the default runtime, a Sandbox is an ordinary container.
• A container or a process wrapper. OpenSandbox's local Docker mode and AIO Sandbox are containers. AIO's documented docker run lines add --security-opt seccomp=unconfined, which removes Docker's default system-call filter. Anthropic's sandbox-runtime (srt) uses no container at all. It restricts one process tree with Seatbelt on macOS, bubblewrap on Linux, or a dedicated user account and firewall rules on Windows.

Choose the boundary based on what the agent runs. Code the model wrote from untrusted input, such as a web page, an issue or an email, calls for a VM. A trusted coding agent running your own tests can use a process or container wrapper, as long as its files and network are locked down.

Defaults to change before an agent uses it

• sandbox-runtime reads are open. By default, network access and writes are denied, but reads are allowed everywhere. Add denyRead entries for places like ~/.ssh and other credential folders (the README's example blocks ~/.ssh/id_rsa). Network traffic goes through proxies on the host that enforce allowedDomains and deniedDomains, covering both HTTP(S) and other TCP traffic.
• AIO Sandbox is open without a key. If SANDBOX_API_KEY is not set, the API, MCP endpoint, VNC and Jupyter accept anyone who can reach port 8080. The README binds the port to 127.0.0.1 for that reason. Set the key, and in the cloud put the container behind a reverse proxy or Ingress instead of publishing the port.
• Egress is opt-in almost everywhere. OpenSandbox has per-sandbox egress policies, and microsandbox has host and port allowlists per sandbox. Docker Sandboxes has network policies, with central org policies as a paid add-on. For Kubernetes Agent Sandbox, use your cluster's NetworkPolicies. Without one of these, an agent that reads a malicious page can send your data anywhere.
• Keep real secrets out of the sandbox. OpenSandbox's Credential Vault and microsandbox's host-bound secrets both aim to let sandboxed code call an API without ever holding the real key. Prefer that over passing tokens as environment variables.

How agents drive them

• MCP: OpenSandbox, AIO Sandbox (at /mcp) and microsandbox (microsandbox-mcp) expose sandboxes as MCP tools, so any MCP client can create one and run code in it. Docker Sandboxes takes the opposite approach: its MCP gateway gives MCP servers to the agent running inside the sandbox.
• SDKs: OpenSandbox (Python, Java/Kotlin, TypeScript, C#/.NET, Go), microsandbox (TypeScript, Rust, Python, Go, Ruby), AIO Sandbox (Python, TypeScript, Go) and Kubernetes Agent Sandbox (Go, Python).
• Wrap the whole agent: Docker Sandboxes' sbx and srt put the coding agent itself inside the sandbox (Claude Code, Codex and others) rather than giving the agent a tool. For the harness side, see coding agent harnesses compared.
• Desktops and browsers: AIO Sandbox puts a VNC browser next to the shell with a shared file system. For full desktops, see E2B Desktop and Cua.

Scale and evaluation workloads

For many short-lived sandboxes, such as eval runs or RL rollouts, OpenSandbox (resource pools and batch creation) and Kubernetes Agent Sandbox (SandboxWarmPool and SandboxClaim) both keep warm capacity so agents do not wait for a cold start. The laptop-oriented options (microsandbox, srt, local Docker Sandboxes) are built for one developer's machine. Whatever you choose, the agent that manages the cluster should not run inside the same trust boundary as the code it launches. The DevOps MCP servers comparison covers giving an agent read-only access to Kubernetes through the Kubernetes MCP Server.

Directory entries in this comparison

• OpenSandbox: Open-source sandbox platform for running agents on your own infrastructure: isolated environments for code, commands, files, browsers and desktops, from Docker to Kubernetes.
• AIO Sandbox (agent-infra): All-in-one agent sandbox in a single Docker container: browser (VNC/CDP), shell, file system, VS Code Server, Jupyter and MCP sharing one file system.
• microsandbox: Easy, fast, programmable, local-first microVM runtime for untrusted workloads.
• Agent Sandbox (Kubernetes SIG Apps): Kubernetes CRD and controller for isolated, stateful, singleton sandbox pods for agent runtimes and RL, with templates, claims and warm pools.
• Anthropic Sandbox Runtime (srt): Lightweight OS-level sandbox enforcing filesystem and network restrictions on agents, MCP servers and arbitrary processes, without a container.
• Docker Sandboxes: Docker's `sbx` CLI runs coding agents like Claude Code and Codex in isolated microVM sandboxes, locally for free or on metered Docker-managed cloud compute.
• microsandbox MCP Server: MCP server that lets AI agents create lightweight microsandbox sandboxes, execute code, manage files and monitor resources.
• E2B: Open-source, secure cloud sandboxes for AI agents: an isolated machine per agent to run code, browse and use tools.
• Daytona: Secure and elastic infrastructure (sandboxes) for running AI-generated code.
• E2B Desktop Sandbox: Open-source, isolated virtual Linux desktops for computer-use agents, built on E2B sandboxes, with Python and JavaScript SDKs and desktop streaming.
• Cua: Open-source computer-use platform: full desktops for agents (Cua Spaces), a desktop-automation driver with MCP, local macOS/Linux VMs (Lume) and Cua Bench.
• Claude Code: Anthropic's agentic coding tool that reads your codebase, edits files, runs commands and integrates with dev tools; available in terminal, IDE, desktop and browser.
• Kubernetes MCP Server: Go-native MCP server for Kubernetes and OpenShift: CRUD on any resource, pods (logs, exec, top), events, Helm, Tekton and KubeVirt, talking to the API server directly.

Related

• Code sandboxes for AI agents (Comparison)
• Run agent-generated code safely in a sandbox (Guide)
• Terminal coding agents compared (Comparison)
• DevOps and observability MCP servers compared (Comparison)
• Cloud browsers for AI agents (Comparison)
• Coding agent starter stack (Stack)
• MCP gateways compared (Comparison)

Sources

• OpenSandbox README, accessed 2026-10-20
• OpenSandbox website, accessed 2026-10-20
• AIO Sandbox README, accessed 2026-10-20
• AIO Sandbox website, accessed 2026-10-20
• microsandbox README, accessed 2026-10-20
• Kubernetes Agent Sandbox README, accessed 2026-10-20
• Anthropic sandbox-runtime README, accessed 2026-10-20
• Docker Sandboxes docs, accessed 2026-10-20
• Docker Sandboxes product page, accessed 2026-10-20

Machine-readable

• JSON
• Markdown
• Source on GitHub