sandboxd
A self-hosted engine that lets coding agents build live apps in isolated Docker sandboxes.
- Source repo
- tastyeffectco/sandboxd
- Stars
- ★ 982
- Last updated
- today
- License
- MIT
- Primary language
- Go
- FA score
- 79/100 · Good
At a glance
- How it runs
- Works with
- Portable with changesClaude Code
- Cost
- Free software; you pay for model usage
- Setup effort
- Medium · a few setup steps
- You'll need
- Typical use
- A team building an AI app-builder product that needs an isolated, URL-addressable preview environment for each customer or project.
- Not a fit if
- Individuals who just need one or two containers for themselves
- Teams needing VM-level isolation or untrusted multi-tenancy
- Teams unwilling to run and maintain a Linux Docker server
- Source review
- 79/100 · Good
What does this agent do, and when should you use it?
sandboxd is an open-source, self-hosted AI app-building engine that creates an isolated container and preview URL for each application on your own server. Its documented core is one Go program driving Docker, with Traefik for URL routing and SQLite for state, without Kubernetes, a separate database, or a queue. The product exposes a scriptable /v1 HTTP API and an optional web console that acts as a pure API client. In the console, users can create apps, chat with a coding agent, view a live preview, edit files, inspect Git diffs, and commit or push changes. Idle sandboxes sleep and wake on demand; the repository describes the project as single-server Beta 0.x software.
A caller creates a sandbox through the API with ports such as 3000, then posts a prompt and agent name to /v1/sandboxes/$ID/tasks. sandboxd starts a Docker container with its own filesystem and limits, runs the coding agent inside it, and produces a live preview URL for the resulting app. The console can also start React/Vite, Next.js, and FastAPI presets, import a public Git repository, or launch curated open-source apps. Documented built-in agents are OpenCode and Claude Code; credentials are injected by a proxy on the wire rather than placed in the sandbox. The product also documents checkpointed and revertible tasks, snapshots, fork and restore, process logs, activity history, browser file editing, and Git commit/push workflows.
- A team building an AI app-builder product that needs an isolated, URL-addressable preview environment for each customer or project.
- A developer-platform team integrating the /v1 API so a coding agent can create and iterate on apps from product prompts.
- An engineering team creating per-branch or temporary preview environments that can sleep while idle.
- A self-hosting user who wants to launch curated applications such as Ghost, n8n, or Grafana from a browser instead of assembling each container workflow manually.
- A developer importing a public Git repository, asking an agent to modify it, reviewing the diff, and committing or pushing from the console.
How do you install or deploy this agent?
On a Linux host with Docker, the Docker Compose plugin, and Git, run:
curl -fsSL https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/install.sh | bashThe installer builds images, starts the stack with the web console, and prints a console URL and generated login. The default API is http://127.0.0.1:9090; verify it with curl http://127.0.0.1:9090/healthz. The console is available at http://console.localhost, and ./console-login.sh displays the login again. The README documents native amd64 and arm64 support; macOS through Docker Desktop is best-effort.
How do you use this agent?
Connect an agent in the console under Settings, or configure Claude Code credentials through the API. The following documented sequence creates a sandbox exposing port 3000 and asks OpenCode to build a todo app; replace sk-ant-... with a valid key:
API=http://127.0.0.1:9090
curl -s -XPOST $API/v1/agents/claude-code/api-key -d '{"api_key":"sk-ant-..."}'
ID=$(curl -s -XPOST $API/sandbox -d '{"ports":[3000]}' | sed -E 's/.*"id":"([^"]+)".*/\1/')
curl -s -XPOST $API/v1/sandboxes/$ID/tasks -d '{"prompt":"build a todo app on port 3000","agent":"opencode"}'Open the result at http://s-$ID-3000.preview.localhost. For headless operation, disable the console with SANDBOXD_CONSOLE=0 or --no-console.
What are this agent's strengths and limitations?
- Each app receives a distinct Docker container and live preview URL, which directly supports multi-app and multi-user workflows.
- Idle sandbox sleep and on-demand wake behavior is designed to let one ordinary server host many apps.
- The same engine is available through a /v1 API and an optional no-code web console, allowing either product integration or hands-on use.
- It documents an end-to-end iteration workflow: files, Git diffs, commits and pushes, snapshots, fork/restore, task undo, activity history, and process logs.
- The documented credential design keeps agent credentials out of sandboxes by injecting them through a proxy.
- The project is explicitly Beta 0.x and warns of possible breaking changes before 1.0, so adopters should pin versions and upgrade deliberately.
- Isolation is container-based rather than VM-based, requiring additional hardening before use with untrusted multi-tenancy.
- API authentication is off by default, and the project explicitly advises tightening the deployment before exposing it to untrusted users.
- It is a single-server deployment that requires Linux, Docker, the Docker Compose plugin, and Git; macOS support via Docker Desktop is best-effort.
- The supplied evidence documents OpenCode and Claude Code only; it does not document setup paths for other coding-agent or model providers.
How does this agent compare with similar options?
The README positions sandboxd as the self-hosted engine behind the kind of prompt-to-running-site experience associated with Lovable, Bolt, v0, and Replit. Its stated distinction is that the infrastructure, code, and data run on your server, with management through its API or local console rather than being described as a hosted product boundary.
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| sandboxd This agent | 79 · Good | Self-hosted serviceFree + model costs | ★ 982 | today | Go | Claude Code |
| Coven | 66 · Some gaps | CLIFree | ★ 75 | today | Rust | Codex · Claude Code |
| opencode-rust | 50 · Major gaps | — | ★ 39 | 8d ago | Rust | OpenAI API · Claude API |
| Claudex | 49 · Major gaps | CLIFree | ★ 97 | 4mo ago | JavaScript | Claude Code |
How does FollowAgents rate this agent?
Why each dimension lost points
The materials describe sandbox isolation, API authentication options, host-level Docker socket privilege, credential proxying, and encrypted storage. Data deletion on uninstall requires confirmation, and upgrades describe backup and rollback on failure. Deductions: agents run with --dangerously-skip-permissions and the container is the main isolation boundary; README and SECURITY.md conflict on the API-auth default, and source attribution is mostly repository self-description.
The CI file lists Go, console, installer, and Docker lifecycle checks; the docs also describe health checks and failure fallbacks. Deduction: AGENTS.md says authentication is on by default, while SECURITY.md says API_AUTH_DISABLED defaults to true. The static packet does not resolve this conflict, and some safeguards are documented claims rather than independently verified behavior.
The materials identify platform builders serving multiple users and sandboxes as the target, and describe an alternative for personal use. They document API, console, desktop, presets, runtime manifests, and their boundaries. Deductions: defaults favor a single local host, macOS is described as best-effort, and public or multi-tenant deployment needs additional hardening.
README, AGENTS.md, and focused docs provide organized installation, operation, uninstall, examples, troubleshooting, and limitations. The MIT license is clear, and the 0.x docs warn of breaking changes. Deductions: version signals include 0.x, 1.0 release messaging, and code version constants; maintainer identity and long-term maintenance commitments are not independently established.
The product is presented as turning prompts into running apps, with previews, code editing, Git, snapshot restore, and API automation. Deductions: use requires operating a Docker host and managing model or proxy credentials and runtime costs; cost guidance and deployment-scale guidance are limited.
Several claims are tied to API, configuration, CI workflow, and implementation files, and the security policy discloses key trust boundaries. Deductions: many security behaviors are supported by project statements or test configuration, not execution in this static review; the README and security policy conflict on the authentication default, so claims need careful qualification.
- Check the effective API-auth configuration before deployment; the materials disagree about its default.
- The control plane mounts the Docker socket and is documented as having near host-root authority. Do not treat this as VM-grade isolation or expose an unhardened setup to untrusted multi-tenancy.
- The install and upgrade materials describe image-signature verification, backups, and rollback, but these flows were not executed or verified in this review.
Maintain this project? Add the FARS badge to your README
[](https://followagents.com/en/agents/sandboxd)<a href="https://followagents.com/en/agents/sandboxd"><img src="https://followagents.com/badge/sandboxd.svg" alt="FARS review"></a>Recent releases
Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.
-
Release notes excerpt
Desktop 0.3.27 preview with the v0.3.26 engine. These builds are unsigned, so Windows SmartScreen and macOS will warn on first launch. New since 0.3.26 - Engine updates now go through. Installing a new desktop app over an older one updates the engine on the next launch. 0.3.26 always rolled back, because the engine's settings still named the previous release's images. It also retries when the connection to the image registry drops. Your database and settings are backed up first, and it goes back to the previous engine if the update fails. Tested on Windows: v0.3.25 → v0.3.26 wi …View on GitHub ↗ -
Release notes excerpt
Added - OpenClaw joins Hermes on the Agents page. Add it with your model connection, chat with it in sandboxd, and ask it to build or change apps through the same tools (no deleting, at most 10 new apps a day). It runs from its official image under the same protections as Hermes and uses up to 3 GB of memory; the Agents page shows each agent's download and memory before you add it. Fixed - Updating the desktop app now updates its engine. The app installs its engine once; until now an app update kept the old engine, so new features …View on GitHub ↗ -
Release notes excerpt
Added - Agents, starting with Hermes. Add Nous Research's Hermes assistant from the new Agents page, chat with it there or on Telegram, and ask it to build apps: it creates and changes apps on your sandboxd (at most 10 new apps a day, no deleting, every action in the app's activity log). Hermes runs in its own container from its official image, pinned, as a non-root user with no Linux capabilities and a read-only root; it reaches its model through your model connection and sandboxd's tools through its own secret, never seeing a …View on GitHub ↗
FAQ
Is sandboxd free to use?
Can it run without the web console?
Is the default deployment ready for untrusted public users?
Which CPU architectures are documented?
Thanks — we use this to improve the page.