OpenSandbox is a sandbox platform for AI applications: it provides multi-language SDKs, a unified sandbox API, and Docker and Kubernetes runtimes for running coding agents, GUI agents, agent evaluation, AI code execution, and reinforcement-learning training workloads in isolated environments.
A sandbox protocol defines lifecycle management and execution APIs as OpenAPI specs, so custom runtimes can be added behind the same interface. A Python FastAPI server implements the lifecycle API over Docker for local use or Kubernetes for distributed scheduling; an execution daemon inside each sandbox handles commands and file operations. Built-in environments include Command, Filesystem, and a Code Interpreter, and examples show Claude Code, Gemini CLI, Codex CLI, OpenCode, Qwen Code, and Kimi CLI running inside sandboxes, plus Chromium with VNC and DevTools, Playwright, a full desktop, and code-server.
You reach the platform from Python, Java/Kotlin, JavaScript/TypeScript, C#/.NET, or Go SDKs, from the osb CLI, or from an MCP server that exposes sandbox creation, command execution, and text file operations to clients such as Claude Code and Cursor. Networking is governed by an ingress gateway with several routing strategies and per-sandbox egress controls, and a credential vault injects secrets into outbound requests without exposing them to the workload. For stronger isolation the runtimes support gVisor, Kata Containers, and Firecracker microVMs. Release images are published to Docker Hub, GitHub Container Registry, and Alibaba Cloud Container Registry, signed keylessly with Cosign and carrying provenance attestations.
Features
- SDKs: Python, Java/Kotlin, JavaScript/TypeScript, C#/.NET, and Go clients for sandbox lifecycle, commands, and files
- Code Interpreter SDK: create an interpreter in a sandbox and run code by language, with stdout logs and result values
- CLI: osb for config, sandbox creation, command execution, file transfer, diagnostics, and egress policy
- MCP server: opensandbox-mcp over stdio for MCP-capable coding agents
- Runtimes: Docker for local runs and Kubernetes for large-scale scheduling, with an integration for kubernetes-sigs/agent-sandbox
- Network policy: ingress gateway routing strategies and per-sandbox egress control
- Credential vault: secret injection into outbound requests without exposing real credentials
- Secure runtimes: gVisor, Kata Containers, and Firecracker microVM isolation
- Volumes: Docker named volumes, OSSFS, and Kubernetes PVC mounts for persistent or shared storage
- Evaluation and training: Harbor agent evaluation with one sandbox per trial, and RL training workloads
- Signed releases: Cosign-signed images with provenance attestations in three registries
