microsandbox
Easy, fast, local microVMs for untrusted workloads like AI agents, user code, plugins, and CI jobs.
- Source repo
- superradcompany/microsandbox
- Stars
- ★ 8.7k
- Last updated
- today
- License
- Apache-2.0
- Primary language
- Rust
- FA score
- 61/100 · Some gaps
At a glance
- How it runs
- Works with
- Platform-specificClaude CodeChatGPT · Codex (Partial support)
- Cost
- Free, no paid service needed
- Setup effort
- Medium · a few setup steps
- You'll need
- Typical use
- Developers of AI agents that need to execute untrusted code often use the microsandbox SDK to spawn sandboxes on demand, ensuring agent actions are isolated and safe.
- Not a fit if
- Environments that must run fully offline without pre-cached images
- Users on Intel Macs, Linux without KVM, or Windows without WHP
- Teams needing deep Docker or Kubernetes orchestration integration
- Source review
- 61/100 · Some gaps
What does this agent do, and when should you use it?
microsandbox is a local-first microVM runtime and library that runs untrusted workloads in hardware-isolated microVMs, combining the security of VMs with the ease of containers. It is cross-platform (Linux, macOS, Windows) and OCI-compatible, allowing you to run standard container images from Docker Hub, GHCR, or any OCI registry. The project provides SDKs in Rust, Python, TypeScript, Go, and Ruby, plus a CLI named msb for managing sandboxes, images, and volumes. It also offers Agent Skills and an MCP server that let AI agents create and manage sandboxes programmatically. The software is in beta, licensed under Apache 2.0, and backed by Y Combinator.
microsandbox runs untrusted workloads inside lightweight microVMs, providing hardware-level isolation. The workflow begins by creating a sandbox via SDK calls like Sandbox::builder("name").image("python").cpus(1).memory(512).create() (or equivalent), which boots a microVM as a child process. You can then execute commands, e.g., sandbox.exec("python", ["-c", "print('Hello from a microVM!')"]), and capture stdout. The CLI offers msb run debian to run an image, msb create/msb exec/msb stop/msb rm for named sandboxes, msb pull/msb image ls/msb image rm for image management, and msb ls/msb ps/msb inspect/msb metrics for status. It supports OCI images, network restriction (e.g., allowed_hosts, allowed_ports), and secret injection (e.g., secrets with allowed_host). Agent Skills (npx skills add superradcompany/skills) add skill definitions for coding agents, and the MCP server (microsandbox-mcp) enables MCP-compatible agents to call tools for sandbox lifecycle, command execution, filesystem access, volumes, and monitoring.
- Developers of AI agents that need to execute untrusted code often use the microsandbox SDK to spawn sandboxes on demand, ensuring agent actions are isolated and safe.
- Platform teams running user-generated scripts or plugins in production use microVM isolation to contain malicious behavior.
- CI/CD engineers needing isolated, reproducible build environments per job with low resource overhead leverage microsandbox to avoid heavyweight VMs.
- Developers looking for a Docker-like experience for running containerized apps locally without a daemon can use the
msbCLI to quickly spin up disposable environments. - Users of AI coding agents like Claude Code integrate Agent Skills or MCP server to let the agent run code in standalone sandboxes, preventing accidental host modifications.
How do you install or deploy this agent?
Install SDKs: Rust cargo add microsandbox, Python uv add microsandbox, TypeScript npm i microsandbox, Go go get github.com/superradcompany/microsandbox/sdk/go, Ruby gem install microsandbox. Install CLI: quick try npx microsandbox run debian; global install via curl -fsSL https://install.microsandbox.dev | sh (macOS/Linux) or irm https://install.microsandbox.dev/windows | iex (Windows). Package managers: brew install superradcompany/tap/microsandbox, npm i -g microsandbox, uv tool install microsandbox, cargo install microsandbox. Requirements: macOS Apple Silicon, Linux with KVM enabled, Windows with WHP enabled.
How do you use this agent?
After installing, run msb run python -- python3 -c "print('Hello from a microVM!')" to execute a command. For named sandboxes, msb create --name app python, then msb exec app -- python -c "import this". Manage images: msb pull python, msb image ls, msb image rm python. Stop/start: msb stop app, msb start app. Inspect: msb ls, msb ps app, msb inspect app, msb metrics app. In code, use the Rust SDK: Sandbox::builder("my-sandbox").image("python").cpus(1).memory(512).create().await?, then exec and stop(). Python example: Sandbox.create("my-sandbox", image="python", cpus=1, memory=512) with asyncio. TypeScript: Sandbox.builder("my-sandbox").image("python").create(). Go: microsandbox.CreateSandbox(ctx, "my-sandbox", microsandbox.WithImage("python"), microsandbox.WithCPUs(1), microsandbox.WithMemory(512)).
What are this agent's strengths and limitations?
- Hardware-level isolation using microVM technology offers a stronger security boundary than containers.
- OCI-compatible, so you can run standard container images from Docker Hub or GHCR without rebuilding.
- Multi-language SDKs (Rust, Python, TypeScript, Go, Ruby) make integration straightforward.
- Fast startup (under 100ms on M1) is ideal for frequently creating/destroying sandboxes.
- Embeddable: boots VMs as child processes without needing a server or long-running daemon.
- Supports long-running sandboxes in detached mode, suitable for persistent sessions.
- Secrets injection and network restrictions prevent secret leakage even if the VM is compromised.
- Beta software: breaking changes, missing features, and rough edges are expected.
- Specific host requirements: Apple Silicon on macOS, KVM on Linux, WHP on Windows, which may exclude some hardware or cloud instances.
- First image pull can take time and requires network connectivity; offline environments need pre-caching.
- Limited integration with existing orchestration (Docker/Kubernetes); custom code needed for multi-sandbox management.
- Documentation may be incomplete for advanced configuration (e.g., network restrictions, secret injection details).
- Installation via multiple package managers may be inconsistent; CLI install requires a shell script or curl, which might be a security concern for some users.
How does this agent compare with similar options?
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| microsandbox This agent | 61 · Some gaps | CLIFree | ★ 8.7k | today | Rust | Claude Code |
| h5i — A Security-First Headless Browser for AI Agents | 84 · Good | CLIFree | ★ 788 | today | Rust | Codex · Claude Code |
| BoxLite: Micro-VM Engine for AI Agents | 57 · Major gaps | Library / SDKFree | ★ 2.6k | today | TypeScript | — |
| Open Browser | 47 · Major gaps | CLIFree + model costs | ★ 9.6k | 6mo ago | TypeScript | ChatGPT · Claude.ai · OpenAI API · Claude API |
How does FollowAgents rate this agent?
Why each dimension lost points
Evidence shows: project provides microVM isolation, supports network policies and secret binding, but lacks explicit default least privilege or user confirmation mechanisms. Data flow transparency is limited; sensitive data handling has secret binding but not detailed. Dependencies are pinned, security policy exists. External effects include VM creation and network access, but rollback mechanism is not explicit. Source attribution has author and repository info. Deductions: lack of explicit user confirmation and rollback evidence.
Evidence shows: CI and tests exist, dependencies pinned, error messages have examples. Deductions: no detailed failure recovery or dependency availability documentation.
Evidence shows: targets AI agents and developers, provides multiple SDKs and CLI, supports multiple platforms. Capability boundaries have network policies and secret binding. Trigger precision is high, environment fit has clear requirements. Deductions: not all scenario boundaries detailed.
Evidence shows: README, install instructions, examples, license, and contributing guide exist. Version number exists but no changelog. Maintenance responsibility has authors and community. Deductions: missing changelog and detailed known limitations.
Evidence shows: output usable, provides SDK and CLI, marginal value high, cost-benefit reasonable. Deductions: no performance benchmarks or cost analysis.
Evidence shows: README claims partially supported, but lacks independent verification. Facts and inferences clearly separated. Deductions: insufficient cross-source corroboration.
- Project is beta, breaking changes expected.
- Install script via curl pipe, supply chain risk.
- No explicit rollback mechanism.
- User confirmation mechanism unclear.
Recent releases
Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.
-
Release notes excerpt
<!-- Release notes generated using configuration in .github/release.yml at v0.7.8 --> What's Changed Features * feat(network): scope secret substitution to specific header fields by @jbms in https://github.com/superradcompany/microsandbox/pull/1639 * feat(cli): add --mount-disk to msb restore by @0xpolarzero in https://github.com/superradcompany/microsandbox/pull/1733 * feat(exec): add runtime-owned detached jobs by @appcypher in https://github.com/superradcompany/microsandbox/pull/1774 …View on GitHub ↗ -
Release notes excerpt
<!-- Release notes generated using configuration in .github/release.yml at v0.7.7 --> What's Changed Breaking changes * build(ruby)!: parallelize builds for supported ruby versions by @toksdotdev in https://github.com/superradcompany/microsandbox/pull/1728 Features * feat(network): add HTTP CONNECT outbound proxy by @m42e in https://github.com/superradcompany/microsandbox/pull/1508 * feat(runtime): add option to disable guest clock sync by @skorfmann in https://github.com/superradcompany/microsandbox/pull/1707 …View on GitHub ↗ -
Release notes excerpt
<!-- Release notes generated using configuration in .github/release.yml at v0.7.6 --> What's Changed Maintenance * chore: refresh lockfiles after v0.7.5 by @github-actions[bot] in https://github.com/superradcompany/microsandbox/pull/1715 * chore(release): bump microsandbox to 0.7.6 by @appcypher in https://github.com/superradcompany/microsandbox/pull/1721 Full Changelog: https://github.com/superradcompany/microsandbox/compare/v0.7.5...v0.7.6View on GitHub ↗
FAQ
How does microsandbox differ from Docker?
Can I use my own Docker images?
What hardware virtualization support is needed on Linux?
Can sandboxes access the network? Can I restrict it?
allowed_hosts and allowed_ports (e.g., Python example). This lets you restrict sandboxes to only reach specific hosts and ports.How does secret injection work?
secrets: [{ env: "OPENAI_API_KEY", value: ..., allowed_host: "api.openai.com" }]. The secret is available inside the sandbox as an environment variable, but only usable for the allowed host, preventing exfiltration.