microsandbox
Easy, fast, local microVMs for untrusted workloads like AI agents, user code, plugins, and CI jobs.
Evidence shows: project provides microVM isolation, supports network policies and secret binding, but lacks explicit default least privilege or user confirmation mechanisms. Data flow transparency is limited; sensitive data handling has secret binding but not detailed. Dependencies are pinned, security policy exists. External effects include VM creation and network access, but rollback mechanism is not explicit. Source attribution has author and repository info. Deductions: lack of explicit user confirmation and rollback evidence.
Evidence shows: CI and tests exist, dependencies pinned, error messages have examples. Deductions: no detailed failure recovery or dependency availability documentation.
Evidence shows: targets AI agents and developers, provides multiple SDKs and CLI, supports multiple platforms. Capability boundaries have network policies and secret binding. Trigger precision is high, environment fit has clear requirements. Deductions: not all scenario boundaries detailed.
Evidence shows: README, install instructions, examples, license, and contributing guide exist. Version number exists but no changelog. Maintenance responsibility has authors and community. Deductions: missing changelog and detailed known limitations.
Evidence shows: output usable, provides SDK and CLI, marginal value high, cost-benefit reasonable. Deductions: no performance benchmarks or cost analysis.
Evidence shows: README claims partially supported, but lacks independent verification. Facts and inferences clearly separated. Deductions: insufficient cross-source corroboration.
- Project is beta, breaking changes expected.
- Install script via curl pipe, supply chain risk.
- No explicit rollback mechanism.
- User confirmation mechanism unclear.
What does this agent do, and when should you use it?
microsandbox is a local-first microVM runtime and library that runs untrusted workloads in hardware-isolated microVMs, combining the security of VMs with the ease of containers. It is cross-platform (Linux, macOS, Windows) and OCI-compatible, allowing you to run standard container images from Docker Hub, GHCR, or any OCI registry. The project provides SDKs in Rust, Python, TypeScript, Go, and Ruby, plus a CLI named `msb` for managing sandboxes, images, and volumes. It also offers Agent Skills and an MCP server that let AI agents create and manage sandboxes programmatically. The software is in beta, licensed under Apache 2.0, and backed by Y Combinator.
microsandbox runs untrusted workloads inside lightweight microVMs, providing hardware-level isolation. The workflow begins by creating a sandbox via SDK calls like Sandbox::builder("name").image("python").cpus(1).memory(512).create() (or equivalent), which boots a microVM as a child process. You can then execute commands, e.g., sandbox.exec("python", ["-c", "print('Hello from a microVM!')"]), and capture stdout. The CLI offers msb run debian to run an image, msb create/msb exec/msb stop/msb rm for named sandboxes, msb pull/msb image ls/msb image rm for image management, and msb ls/msb ps/msb inspect/msb metrics for status. It supports OCI images, network restriction (e.g., allowed_hosts, allowed_ports), and secret injection (e.g., secrets with allowed_host). Agent Skills (npx skills add superradcompany/skills) add skill definitions for coding agents, and the MCP server (microsandbox-mcp) enables MCP-compatible agents to call tools for sandbox lifecycle, command execution, filesystem access, volumes, and monitoring.
- Developers of AI agents that need to execute untrusted code often use the microsandbox SDK to spawn sandboxes on demand, ensuring agent actions are isolated and safe.
- Platform teams running user-generated scripts or plugins in production use microVM isolation to contain malicious behavior.
- CI/CD engineers needing isolated, reproducible build environments per job with low resource overhead leverage microsandbox to avoid heavyweight VMs.
- Developers looking for a Docker-like experience for running containerized apps locally without a daemon can use the
msbCLI to quickly spin up disposable environments. - Users of AI coding agents like Claude Code integrate Agent Skills or MCP server to let the agent run code in standalone sandboxes, preventing accidental host modifications.
What are this agent's strengths and limitations?
- Hardware-level isolation using microVM technology offers a stronger security boundary than containers.
- OCI-compatible, so you can run standard container images from Docker Hub or GHCR without rebuilding.
- Multi-language SDKs (Rust, Python, TypeScript, Go, Ruby) make integration straightforward.
- Fast startup (under 100ms on M1) is ideal for frequently creating/destroying sandboxes.
- Embeddable: boots VMs as child processes without needing a server or long-running daemon.
- Supports long-running sandboxes in detached mode, suitable for persistent sessions.
- Secrets injection and network restrictions prevent secret leakage even if the VM is compromised.
- Beta software: breaking changes, missing features, and rough edges are expected.
- Specific host requirements: Apple Silicon on macOS, KVM on Linux, WHP on Windows, which may exclude some hardware or cloud instances.
- First image pull can take time and requires network connectivity; offline environments need pre-caching.
- Limited integration with existing orchestration (Docker/Kubernetes); custom code needed for multi-sandbox management.
- Documentation may be incomplete for advanced configuration (e.g., network restrictions, secret injection details).
- Installation via multiple package managers may be inconsistent; CLI install requires a shell script or curl, which might be a security concern for some users.
How do you install or deploy this agent?
Install SDKs: Rust cargo add microsandbox, Python uv add microsandbox, TypeScript npm i microsandbox, Go go get github.com/superradcompany/microsandbox/sdk/go, Ruby gem install microsandbox. Install CLI: quick try npx microsandbox run debian; global install via curl -fsSL https://install.microsandbox.dev | sh (macOS/Linux) or irm https://install.microsandbox.dev/windows | iex (Windows). Package managers: brew install superradcompany/tap/microsandbox, npm i -g microsandbox, uv tool install microsandbox, cargo install microsandbox. Requirements: macOS Apple Silicon, Linux with KVM enabled, Windows with WHP enabled.
How do you use this agent?
After installing, run msb run python -- python3 -c "print('Hello from a microVM!')" to execute a command. For named sandboxes, msb create --name app python, then msb exec app -- python -c "import this". Manage images: msb pull python, msb image ls, msb image rm python. Stop/start: msb stop app, msb start app. Inspect: msb ls, msb ps app, msb inspect app, msb metrics app. In code, use the Rust SDK: Sandbox::builder("my-sandbox").image("python").cpus(1).memory(512).create().await?, then exec and stop(). Python example: Sandbox.create("my-sandbox", image="python", cpus=1, memory=512) with asyncio. TypeScript: Sandbox.builder("my-sandbox").image("python").create(). Go: microsandbox.CreateSandbox(ctx, "my-sandbox", microsandbox.WithImage("python"), microsandbox.WithCPUs(1), microsandbox.WithMemory(512)).
FAQ
How does microsandbox differ from Docker?
Can I use my own Docker images?
What hardware virtualization support is needed on Linux?
Can sandboxes access the network? Can I restrict it?
allowed_hosts and allowed_ports (e.g., Python example). This lets you restrict sandboxes to only reach specific hosts and ports.How does secret injection work?
secrets: [{ env: "OPENAI_API_KEY", value: ..., allowed_host: "api.openai.com" }]. The secret is available inside the sandbox as an environment variable, but only usable for the allowed host, preventing exfiltration.