Opensandbox
Secure, Fast, and Extensible Sandbox runtime for AI agents.
Last verified:
What is Opensandbox?
OpenSandbox is a general-purpose sandbox platform for AI applications that provides secure, isolated execution environments for running untrusted code, AI agents, and machine learning workloads. It offers multi-language SDKs (Python, Java/Kotlin, JavaScript/TypeScript, C#/.NET, Go), unified sandbox APIs, and supports both Docker and Kubernetes runtimes for scenarios including Coding Agents, GUI Agents, Agent Evaluation, AI Code Execution, and Reinforcement Learning Training.
Key features include built-in Command, Filesystem, and Code Interpreter implementations; support for coding agents like Claude Code, Gemini CLI, OpenAI Codex, Qwen Code, and Kimi CLI; browser automation with Chrome and Playwright; desktop environments with VNC and VS Code Web; strong isolation using secure container runtimes like gVisor, Kata Containers, and Firecracker microVM; network policy controls with per-sandbox egress management; and a production-grade FastAPI-based server for sandbox lifecycle management.
OpenSandbox is designed for AI developers, ML engineers, and teams building AI agents who need safe environments to execute model-generated code, run reinforcement learning tasks, automate browser workflows, or create secure cloud development environments. It is now listed in the CNCF Landscape and is open source under the Apache 2.0 License.
Opensandbox pricing
Pricing model: Freemium
OpenSandbox is completely free and open source under the Apache 2.0 License. There are no paid tiers or subscription plans. The platform can be self-hosted on your own infrastructure using Docker or Kubernetes. All SDKs, the server, CLI tool, and MCP server are available for free installation via pip, npm, Maven/Gradle, dotnet, or go get. You only pay for your own infrastructure costs (server hardware, cloud VMs, Kubernetes cluster).
Opensandbox pros
- Open source under Apache 2.0 License - completely free to use
- Multi-language SDKs covering Python, Java/Kotlin, JavaScript/TypeScript, C#/.NET, and Go
- Supports both Docker and Kubernetes runtimes for local and distributed deployments
- Strong isolation with gVisor, Kata Containers, and Firecracker microVM support
- Built-in Code Interpreter SDK for Python, JavaScript, and other languages
- Native integration with Claude Code, Gemini CLI, OpenAI Codex, Qwen Code, Kimi CLI
- Browser automation support with Chrome and Playwright headless browsers
- Desktop environments available via VNC and VS Code Web (code-server)
- Per-sandbox egress network policy controls for security
- Real-time output streaming via Server-Sent Events (SSE)
- Complete file operations including read, write, search, delete, and permissions
- Sandbox lifecycle management with pause, resume, renew, and snapshot capabilities
- CLI tool (osb) for terminal-based sandbox workflow management
- MCP server integration for Claude Code and Cursor clients
- Listed in CNCF Landscape as recognized infrastructure
- 10.8k GitHub stars indicating strong community adoption
- Configurable resource limits with Kubernetes-style CPU/memory/GPU specs
Opensandbox cons
- Requires Docker installed for local execution - not truly standalone
- Requires Python 3.10+ for examples and local runtime
- API key authentication must be manually configured for production use
- Secure container runtimes (gVisor/Kata/Firecracker) require additional system setup
- Egress sidecar image must be explicitly configured when using networkPolicy
- Docker runtime only supports host or bridge networking modes
- Informer-enabled Kubernetes cache is still in beta status
- Windows support requires WSL2 for development
Frequently asked questions about Opensandbox
What is OpenSandbox?
OpenSandbox is a general-purpose sandbox platform for AI applications that provides safe, isolated runtime environments to execute LLM-related capabilities such as command execution, file operations, code execution, browser automation, and more. It offers multi-language SDKs, a unified sandbox protocol, and multiple sandbox runtime implementations to help developers run tools, plugins, or agents in controlled environments.
Is OpenSandbox free to use?
Yes, OpenSandbox is completely free and open source under the Apache 2.0 License. All SDKs, the server, CLI, and MCP server can be installed and used without any cost. You only need to provide your own infrastructure (Docker host or Kubernetes cluster) to run the sandboxes.
What programming languages does OpenSandbox support?
OpenSandbox provides SDKs for Python, Java/Kotlin, JavaScript/TypeScript, C#/.NET, and Go. The Code Interpreter SDK supports executing code in Python, JavaScript, and other languages within sandbox environments.
How do I install OpenSandbox?
For Python: run 'pip install opensandbox' or 'uv add opensandbox'. For the CLI: 'pip install opensandbox-cli' or 'uv tool install opensandbox-cli'. For JavaScript/TypeScript: 'npm install @alibaba-group/opensandbox'. For Java/Kotlin, add the dependency via Maven or Gradle. For C#/.NET: 'dotnet add package Alibaba.OpenSandbox'. For Go: 'go get github.com/alibaba/OpenSandbox/sdks/sandbox/go'.
What runtime backends does OpenSandbox support?
OpenSandbox supports Docker Engine 20.10+ and Kubernetes 1.21.1+ as runtime backends. The Docker runtime is production-ready and supports host or bridge networking. The Kubernetes runtime is also production-ready and supports large-scale distributed scheduling with optional informer-based caching.
How does OpenSandbox ensure security and isolation?
OpenSandbox provides strong isolation through secure container runtimes including gVisor (user-space kernel), Kata Containers (VM-level isolation), and Firecracker microVM. It also supports API key authentication, per-sandbox egress network policies, capability dropping, seccomp profiles, and optional read-only root filesystems.
Can I run AI coding agents in OpenSandbox?
Yes, OpenSandbox supports running coding agents including Claude Code, Gemini CLI, OpenAI Codex CLI, Qwen Code, and Kimi CLI inside isolated sandboxes. There are ready-to-run integration examples for each of these agents in the examples/ directory.
How do I manage sandbox lifecycle?
OpenSandbox provides lifecycle APIs for creating, listing, querying, pausing, resuming, renewing, and deleting sandbox instances. Sandboxes have configurable TTL/timeout with explicit renewal via API. States transition from Pending → Running → (optional Paused) → Stopping → Terminated or Failed.
What browser automation capabilities are available?
OpenSandbox supports browser automation through Chrome (Chromium with VNC and DevTools access) and Playwright (headless Chromium for scraping and testing). Both are available as example sandboxes with VNC access for debugging and DevTools port exposure for remote debugging.
How do I configure network policies for sandboxes?
Network policies are configured via the networkPolicy parameter when creating a sandbox, specifying defaultAction (allow/deny) and egress rules with targets. The egress.image must be configured in the server config when using networkPolicy. The egress sidecar manages iptables rules to enforce the policy.