OpenSandbox lets you run AI agents in isolated sandboxes on your own infrastructure, starting locally with Docker and deploying on Kubernetes through a unified sandbox API. It creates sandboxes from container images so agents can execute commands and manage files securely.
Project overview
Firecracker-based sandbox creation is reported at 64 ms P50 serially and 125.4 ms P99 with 10 concurrent creations, and the same API path covers local Docker and Kubernetes deployments.
Project type
AI Agent · Infrastructure
Use cases
Automation
Deployment
Refer to project documentation
License
Apache-2.0
Best for
AI engineers and developers who want to run AI agents in isolated sandboxes on their own infrastructure.
Teams that want to start locally with Docker and move to Kubernetes with one sandbox API.
Key capabilities
Create sandboxes from container images and execute commands, write and read files via SDKs.
Terminal CLI to create sandboxes, run commands, move files, inspect diagnostics, and manage egress policy.
Exposes sandbox creation, command execution, and text file operations to MCP-capable clients such as Claude Code and Cursor.
Limitations and risks
Docker and a running sandbox server are prerequisites before using the SDK, making initial setup medium difficulty.
Working with the project requires coding ability; there is no documented no-code path.
Getting started
Setup is rated medium difficulty: it requires Docker and running a sandbox server before using the SDK, and coding is required to work with the project.
Evidence and sources
README: Run AI agents in sandboxes on your own infrastructure. OpenSandbox gives AI applications isolated environments to execute code, run commands, manage files, and operate browsers or…
README: Create a sandbox from an `alpine` image and execute commands and scripts.
README: OpenSandbox also provides `osb`, a terminal CLI for the common sandbox workflow: create sandboxes, run commands, move files, inspect diagnostics, and manage runtime egress policy.
README: The OpenSandbox MCP server exposes sandbox creation, command execution, and text file operations to MCP-capable clients such as Claude Code and Cursor.