What is OpenSandbox?
OpenSandbox is a server and set of SDKs for creating isolated environments where an AI agent can run commands, edit files, execute generated code or drive a browser or desktop. You start it locally on Docker and move to Kubernetes through the same lifecycle API, with SDKs for Python, TypeScript, Java/Kotlin, C#/.NET and Go, a CLI called osb, and an MCP server for clients such as Claude Code and Cursor.
It began at Alibaba (the packages still carry com.alibaba and @alibaba-group names) and is now a project of the Agentic AI Foundation, under the opensandbox-group organisation. Version 1.1.1 shipped on 9 October 2026 and 1.2.0 is at its second release candidate.
Isolation is configurable rather than fixed: plain containers by default, with gVisor, Kata Containers or Firecracker as secure runtimes, per-sandbox egress policies, and a Credential Vault that injects secrets into outbound requests so the workload never sees them.
Is OpenSandbox worth it?
OpenSandbox solves a different problem from Anthropic's srt or NVIDIA's OpenShell. Those confine an agent running on your machine; OpenSandbox hands out fresh, disposable machines to agents running anywhere, through an API. It is the self-hosted counterpart to the hosted code sandboxes many agent products rent by the second, and it has gathered about 16,200 GitHub stars in ten months.
The headline numbers are the maintainers' own, and they publish the method with them. On a two-node Alibaba Cloud Kubernetes cluster with 192 CPUs per node, warm Firecracker sandboxes from a pre-built snapshot reached readiness in 64 ms at the median in a serial run and 125.4 ms at p99 with ten concurrent creates. At 20 concurrent creates against a 20-slot pool only 51 of 100 attempts succeeded, which the report states plainly. These are warm-path figures with artifacts cached; first use costs more.
The security model rewards care and punishes defaults. Without a secure runtime a sandbox is an ordinary container, so a kernel exploit in generated code reaches the host; gVisor, Kata or Firecracker close that gap but each needs its own node setup. If server.api_key is empty the server runs with no authentication at all, and in Docker or Kubernetes you have to set OPENSANDBOX_INSECURE_SERVER=YES to allow that, which at least makes the choice deliberate. Release images are signed with Cosign, and the docs ask you to pin them by digest.
The project moves quickly: 153 open issues and pull requests, a 1.2 release candidate two weeks after 1.1.1, and a protocol spec designed for others to build runtimes against. For a team already running Kubernetes and paying per-second sandbox bills for agent evaluations or reinforcement-learning rollouts, that pace is an asset; for a single coding agent on a laptop it is far more machinery than the job needs.
Where it earns its place
An ML team running nightly agent evaluations with Harbor
Give each of several thousand trials its own clean environment
Use resource pools and batch creation on Kubernetes so each trial gets a fresh sandbox that is destroyed afterwards. The cost is your cluster's nodes rather than per-second fees to a hosted sandbox vendor.
A SaaS company adding a code interpreter to its customer-facing agent
Run model-written Python for many tenants without one escaping to another
Run sandboxes under Firecracker or gVisor, set per-sandbox egress policies, and inject API keys through the Credential Vault. Set server.api_key before exposing the server; it is open by default.
A developer trying Claude Code or Codex CLI in isolation
Let a coding agent work on a repository inside a throwaway container
Start the server with uvx opensandbox-server on Docker and follow the Claude Code example; minutes to a first sandbox, though srt does this job on one laptop with far less setup.
Before you commit
- Setup
- Needs Docker and Python 3.10+: uvx opensandbox-server init-config ~/.sandbox.toml --example docker, then uvx opensandbox-server and pip install opensandbox. Kubernetes uses an operator; Firecracker needs nodes with virtualisation.
- Integrations
- Python, TypeScript, Java/Kotlin, C#/.NET and Go SDKs, the osb CLI, an MCP server (pip install opensandbox-mcp) with sandbox, command and file tools, and examples for Claude Code, Codex CLI, Playwright, Chrome, desktops and Harbor.
- Data and privacy
- Runs on your own infrastructure under Apache 2.0; OpenTelemetry metrics export is optional; images signed with Cosign with provenance; no published security advisories on GitHub.
- Cost at scale
- Software is free; cost is your nodes. The maintainers' benchmark used two Kubernetes nodes with 192 CPUs and about 742 GiB of memory each to run a 20-slot Firecracker pool.
- Limits
- Secure runtimes, ingress and egress need separate configuration; secureAccess endpoint credentials only work with the Kubernetes ingress gateway; success fell to 51 of 100 creates when concurrency matched pool size.
What's good
- Same API from local Docker to a Kubernetes cluster
- Firecracker, gVisor or Kata isolation, plus pause and resume
- Credential Vault keeps real secrets out of the sandbox
- SDKs in five languages, a CLI and an MCP server
What's not
- Plain containers unless you configure a secure runtime
- Server runs unauthenticated if no API key is set
- Fast-path speed figures are the maintainers' own, on large nodes
- Kubernetes and Firecracker setup is real operations work
Best for
Platform teams running agent evaluations, RL rollouts or multi-tenant code execution who want sandboxes on their own infrastructure.
OpenSandbox alternatives
OpenSandbox: common questions
- Is OpenSandbox worth it?
- A self-hosted answer to hosted code sandboxes, worth the Kubernetes work when you need thousands of short-lived agent environments on your own machines. We rate it 4.1 out of 5.
- How much does OpenSandbox cost?
- Free and open source under Apache 2.0; no paid edition from the maintainers.
- What are the downsides of OpenSandbox?
- Plain containers unless you configure a secure runtime; server runs unauthenticated if no API key is set; fast-path speed figures are the maintainers' own, on large nodes; kubernetes and Firecracker setup is real operations work.
- Who is OpenSandbox best for?
- Platform teams running agent evaluations, RL rollouts or multi-tenant code execution who want sandboxes on their own infrastructure.
- How much does OpenSandbox cost for a team or in production?
- Software is free; cost is your nodes. The maintainers' benchmark used two Kubernetes nodes with 192 CPUs and about 742 GiB of memory each to run a 20-slot Firecracker pool.
- Is OpenSandbox safe for company data?
- Runs on your own infrastructure under Apache 2.0; OpenTelemetry metrics export is optional; images signed with Cosign with provenance; no published security advisories on GitHub.
- What are the best OpenSandbox alternatives?
- The closest alternatives we have reviewed are NVIDIA OpenShell and Anthropic Sandbox Runtime (srt).
Answers checked Oct 26, 2026.
Make OpenSandbox? Show this rating on your site
