OpenSandbox gives AI applications isolated environments where they execute code, run shell commands, manage files, and operate browsers or desktops. It runs on your own infrastructure: a sandbox server starts locally on Docker and deploys to Kubernetes behind the same lifecycle API.
Each sandbox is provisioned, monitored, renewed, paused, resumed, and terminated through standardized lifecycle and execution protocols. On Kubernetes, the Fast Sandbox runtime creates high-density Firecracker sandboxes and preserves memory and disk state across pause and resume. Resource pools and batch creation support agent evaluation and reinforcement-learning workloads.
Typical uses include running coding agents such as Claude Code and Codex in isolation, executing model-generated code through a Code Interpreter SDK, automating Chrome and Playwright sessions, hosting VS Code Web and desktop environments, and giving each evaluation trial its own sandbox. Access is through SDKs, the osb terminal CLI, or an MCP server for MCP-capable clients.
| Fast Sandbox metric | Value |
|---|---|
| Firecracker creation, serial | 64 ms P50 |
| Firecracker creation, 10 concurrent | 125.4 ms P99 |
Features
- Agent working environments: built-in APIs to execute commands, manage files, run code, expose ports, and stream logs and metrics
- Fast Sandbox runtime: high-density Firecracker sandboxes on Kubernetes with pause and resume that keeps memory and disk state
- Network access control: a unified ingress gateway for inbound traffic and per-sandbox egress policies for outbound access
- Credential Vault: agents call external services without the real credentials being exposed to sandbox workloads
- Local to cluster: the same lifecycle API on Docker locally and on Kubernetes, with resource pools and batch creation
- Multi-language SDKs: Python, Java/Kotlin, JavaScript/TypeScript, C#/.NET, and Go
- osb CLI: creates sandboxes, runs commands, moves files, inspects diagnostics, and manages egress policy from the terminal
- MCP server: exposes sandbox creation, command execution, and text file operations to MCP clients
- Extensible protocol: defined lifecycle and execution APIs for building custom runtime integrations
- Signed images: release container images are signed with Cosign and carry provenance attestations
