sandboxd
A self-hosted engine that lets coding agents build live apps in isolated Docker sandboxes.
- Source repo
- tastyeffectco/sandboxd
- Stars
- ★ 946
- Last updated
- 26d ago
- License
- MIT
- Primary language
- Go
- FA score
- 50/100 · Major gaps
At a glance
- Works with
- Portable with changesClaude Code
- You'll need
- Typical use
- A team building an AI app-builder product that needs an isolated, URL-addressable preview environment for each customer or project.
- Main limitation
- The project is explicitly Beta 0.x and warns of possible breaking changes before 1.0, so adopters should pin versions and upgrade deliberately.
- Source review
- 50/100 · Major gaps
What does this agent do, and when should you use it?
sandboxd is an open-source, self-hosted AI app-building engine that creates an isolated container and preview URL for each application on your own server. Its documented core is one Go program driving Docker, with Traefik for URL routing and SQLite for state, without Kubernetes, a separate database, or a queue. The product exposes a scriptable /v1 HTTP API and an optional web console that acts as a pure API client. In the console, users can create apps, chat with a coding agent, view a live preview, edit files, inspect Git diffs, and commit or push changes. Idle sandboxes sleep and wake on demand; the repository describes the project as single-server Beta 0.x software.
A caller creates a sandbox through the API with ports such as 3000, then posts a prompt and agent name to /v1/sandboxes/$ID/tasks. sandboxd starts a Docker container with its own filesystem and limits, runs the coding agent inside it, and produces a live preview URL for the resulting app. The console can also start React/Vite, Next.js, and FastAPI presets, import a public Git repository, or launch curated open-source apps. Documented built-in agents are OpenCode and Claude Code; credentials are injected by a proxy on the wire rather than placed in the sandbox. The product also documents checkpointed and revertible tasks, snapshots, fork and restore, process logs, activity history, browser file editing, and Git commit/push workflows.
- A team building an AI app-builder product that needs an isolated, URL-addressable preview environment for each customer or project.
- A developer-platform team integrating the /v1 API so a coding agent can create and iterate on apps from product prompts.
- An engineering team creating per-branch or temporary preview environments that can sleep while idle.
- A self-hosting user who wants to launch curated applications such as Ghost, n8n, or Grafana from a browser instead of assembling each container workflow manually.
- A developer importing a public Git repository, asking an agent to modify it, reviewing the diff, and committing or pushing from the console.
How do you install or deploy this agent?
On a Linux host with Docker, the Docker Compose plugin, and Git, run:
curl -fsSL https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/install.sh | bashThe installer builds images, starts the stack with the web console, and prints a console URL and generated login. The default API is http://127.0.0.1:9090; verify it with curl http://127.0.0.1:9090/healthz. The console is available at http://console.localhost, and ./console-login.sh displays the login again. The README documents native amd64 and arm64 support; macOS through Docker Desktop is best-effort.
How do you use this agent?
Connect an agent in the console under Settings, or configure Claude Code credentials through the API. The following documented sequence creates a sandbox exposing port 3000 and asks OpenCode to build a todo app; replace sk-ant-... with a valid key:
API=http://127.0.0.1:9090
curl -s -XPOST $API/v1/agents/claude-code/api-key -d '{"api_key":"sk-ant-..."}'
ID=$(curl -s -XPOST $API/sandbox -d '{"ports":[3000]}' | sed -E 's/.*"id":"([^"]+)".*/\1/')
curl -s -XPOST $API/v1/sandboxes/$ID/tasks -d '{"prompt":"build a todo app on port 3000","agent":"opencode"}'Open the result at http://s-$ID-3000.preview.localhost. For headless operation, disable the console with SANDBOXD_CONSOLE=0 or --no-console.
What are this agent's strengths and limitations?
- Each app receives a distinct Docker container and live preview URL, which directly supports multi-app and multi-user workflows.
- Idle sandbox sleep and on-demand wake behavior is designed to let one ordinary server host many apps.
- The same engine is available through a /v1 API and an optional no-code web console, allowing either product integration or hands-on use.
- It documents an end-to-end iteration workflow: files, Git diffs, commits and pushes, snapshots, fork/restore, task undo, activity history, and process logs.
- The documented credential design keeps agent credentials out of sandboxes by injecting them through a proxy.
- The project is explicitly Beta 0.x and warns of possible breaking changes before 1.0, so adopters should pin versions and upgrade deliberately.
- Isolation is container-based rather than VM-based, requiring additional hardening before use with untrusted multi-tenancy.
- API authentication is off by default, and the project explicitly advises tightening the deployment before exposing it to untrusted users.
- It is a single-server deployment that requires Linux, Docker, the Docker Compose plugin, and Git; macOS support via Docker Desktop is best-effort.
- The supplied evidence documents OpenCode and Claude Code only; it does not document setup paths for other coding-agent or model providers.
How does this agent compare with similar options?
The README positions sandboxd as the self-hosted engine behind the kind of prompt-to-running-site experience associated with Lovable, Bolt, v0, and Replit. Its stated distinction is that the infrastructure, code, and data run on your server, with management through its API or local console rather than being described as a hosted product boundary.
Key facts side by side with the most closely related agents.
| Agent | Source review | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|
| sandboxd This agent | 50 · Major gaps | ★ 946 | 26d ago | Go | Claude Code |
| Claudex | 69 · Some gaps | ★ 93 | 3mo ago | JavaScript | Claude Code |
| ToolJet | 50 · Major gaps | ★ 41k | 5d ago | JavaScript | — |
| amux Agent Control Plane | 77 · Good | ★ 492 | 1d ago | Rust | Codex · Claude Code |
How does FollowAgents rate this agent?
Why each dimension lost points
Evidence: README clearly states sandbox isolation, proxy-injected credentials, API auth disabled by default, control plane mounts Docker socket (SECURITY.md). Deductions: no detailed least-privilege configuration, user confirmation mechanism not explicit, data flow transparency only partial, dependency security lacks scanning evidence, external effects (e.g., egress) not detailed, rollback only for upgrades, source attribution only via README claims.
Evidence: CI includes unit and e2e tests, README consistent. Deductions: dependency availability not locked or checksummed, failure messages not documented in detail.
Evidence: README clearly defines target users (multi-sandbox) and boundaries (not for single container), supports multiple run scenarios. Deductions: trigger precision (e.g., API calls) not detailed, environment fit (e.g., macOS) only best-effort.
Evidence: README well-structured, install notes detailed, examples and FAQ links, known limitations explicit (beta, API auth off), MIT license. Deductions: naming stability not explicit, versioning/changelog not provided, maintenance responsibility not clear (publisher unverified).
Evidence: Output usability (preview URLs, API) clear, marginal value (self-hosted, multi-app) prominent, cost-benefit (single server, many apps) reasonable. Deductions: no actual run evidence, cost-benefit based on description only.
Evidence: README claims consistent with code structure, but no independent verification. Deductions: claim traceability limited, cross-source corroboration insufficient, fact vs inference not clearly separated.
- API auth is disabled by default; enable authentication before exposing beyond loopback.
- Control plane mounts Docker socket, effectively host-root; run only on a host you control.
- Agents run with --dangerously-skip-permissions; containment boundary is the container, not the agent.
- Publisher identity unverified; review install scripts and binaries yourself.