OpenSandbox review
OpenSandbox is a sandbox runtime that gives AI agents isolated environments to run code, commands, files, browsers, and desktops on your own infrastructure.
TL;DR
OpenSandbox runs AI agents in isolated sandboxes on your own infrastructure. It starts locally with Docker and deploys on Kubernetes through one sandbox API. It is for teams building coding agents, code execution, browser automation, or agent evaluation. It offers SDKs in five languages, a CLI, and an MCP server.
- 16.3kGitHub stars
- +216new stars, week of Oct 25
- 328.9kdownloads a week, +68% vs 4-week avg
- #1in Sandboxes and runtimes this week
OpenSandbox at a glance
- Category
- Sandboxes and runtimes
- Maintained by
- opensandbox-group (organization, @opensandbox-group on GitHub)
- License
- Apache 2.0
- Language
- Python, Go, Kotlin
- Repository
- github.com/opensandbox-group/OpenSandbox
- Website
- open-sandbox.ai
- PyPI package
- opensandbox 1.1.1
- Latest release
- release-1.2.0-rc.1 on GitHub, Oct 15, 2026
- First published
- Dec 17, 2025
What OpenSandbox does
- OpenSandbox executes shell commands, manages files, and runs code inside isolated sandboxes through built-in APIs.
- OpenSandbox provisions, monitors, renews, pauses, resumes, and terminates sandbox instances on Docker and Kubernetes runtimes.
- OpenSandbox routes inbound traffic through an ingress gateway and controls outbound access with per-sandbox egress policies.
- OpenSandbox's Credential Vault lets agents call external services without exposing real credentials to sandbox workloads.
- OpenSandbox's Fast Sandbox runtime uses Firecracker sandboxes on Kubernetes that support pause/resume with memory and disk state preserved.
- OpenSandbox supports resource pools and batch creation for agent evaluation and RL training workloads.
- OpenSandbox can host VS Code Web and desktop-like environments for remote development.
How it works
You run the OpenSandbox server locally with Docker or deploy it on Kubernetes. Applications talk to it through SDKs for Python, Java/Kotlin, TypeScript/JavaScript, C#/.NET, or Go. The osb CLI covers the same workflow from a terminal. An MCP server exposes sandbox creation, command execution, and text file operations to MCP clients such as Claude Code and Cursor.
How to install and start using OpenSandbox
Start the sandbox server
uvx opensandbox-server init-config ~/.sandbox.toml --example dockerPython SDK
pip install opensandboxCLI
pip install opensandbox-cliRequirements
- Docker is required for local execution.
- Python 3.10 or later is required for examples and the local runtime.
- Kubernetes is needed for cluster deployment and the Fast Sandbox runtime.
First steps
- Create a config file with uvx opensandbox-server init-config ~/.sandbox.toml --example docker, then start the server with uvx opensandbox-server.
- Install the Python SDK with uv pip install opensandbox.
- Create a sandbox from the alpine image with Sandbox.create and run a command using sandbox.commands.run.
- Call sandbox.destroy() when finished to clean up the sandbox.
Who OpenSandbox is for
- Teams running coding agents such as Claude Code or Codex CLI in isolated environments.
- Applications that execute model-generated code and need isolated, reproducible environments.
- Browser and desktop automation with Playwright or Chrome under controlled networking.
- Agent evaluation and RL training that need a separate sandbox per trial.
Limitations to know
- OpenSandbox is self-hosted: you run the server on your own Docker or Kubernetes infrastructure.
- OpenSandbox's Fast Sandbox runtime with Firecracker targets Kubernetes, not local Docker setups.
- OpenSandbox 1.1.0 server installs from PyPI fail at import time; release notes say users should upgrade to 1.1.1.
- In 1.2.0-rc.2, fast sandboxes reject port-scoped network rules until enforcement lands.
Is OpenSandbox growing? Usage data
In the week of Oct 25–31, 2026, OpenSandbox ranked #59 on the Devtoolwatch Board and #1 in Sandboxes and runtimes, with a momentum score of 74 out of 100. Its main package had 328.9k downloads that week, +68% against its own 4-week average.
Show the weekly numbers
| Week of | New stars |
|---|---|
| Aug 9, 2026 | 1.2k |
| Aug 16, 2026 | 1k |
| Aug 23, 2026 | 244 |
| Aug 30, 2026 | 176 |
| Sep 6, 2026 | 161 |
| Sep 13, 2026 | 266 |
| Sep 20, 2026 | 124 |
| Sep 27, 2026 | 138 |
| Oct 4, 2026 | 129 |
| Oct 11, 2026 | 159 |
| Oct 18, 2026 | 213 |
| Oct 25, 2026 | 216 |
The Board ranks tools by four signals each week: new stars, new stars for the repo's size, added downloads and download growth beyond the market. How the ranking works.
OpenSandbox alternatives
Other AI sandboxes and runtimes on the Board in the week of Oct 25–31, 2026, by momentum:
| Rank | Tool | Stars | Downloads/wk |
|---|---|---|---|
| #2 | microsandboxmicrosandbox is a local-first microVM runtime and library for running untrusted workloads like AI agents, user code, and CI jobs in… | 8.9k | 26.8k |
| #3 | E2BE2B is open-source infrastructure for running AI-generated code in secure, isolated cloud sandboxes, controlled through JavaScript and… | 14.6k | 5M |
| #4 | Agent Sandboxagent-sandbox enables easy management of isolated, stateful, singleton workloads, ideal for use cases like AI agent runtimes and… | 4.5k | – |
| #5 | Trigger.devTrigger.dev is an open-source TypeScript platform for building and deploying durable AI agents, workflows, and long-running background… | 16.7k | 1.7M |
| #6 | InngestInngest is a workflow orchestration platform for running durable step functions, background jobs, and AI workflows on serverless,… | 6k | 3.7M |
| #7 | Cloudflare Sandbox SDKCloudflare Sandbox SDK runs untrusted or generated code in per-user Linux sandboxes built on Cloudflare Durable Objects and Containers. | 1.2k | 1.2M |
Recent OpenSandbox releases
- release-1.2.0-rc.2 (pre-release), Oct 21, 2026
- release-1.2.0-rc.1, Oct 15, 2026
- release-1.1.1, Oct 9, 2026
- release-1.1.1-rc.1, Sep 28, 2026
- release-1.1.0, Sep 21, 2026
OpenSandbox FAQ
Is OpenSandbox free and open source?
Yes. OpenSandbox's source code is on GitHub (opensandbox-group/OpenSandbox) under the Apache 2.0 license, so you can use it for free.
How do I install OpenSandbox?
Run uvx opensandbox-server init-config ~/.sandbox.toml --example docker. The opensandbox package needs Python 3.10 or newer. The install section above has the other options from the project's README.
Is OpenSandbox still maintained?
Yes. The opensandbox-group/OpenSandbox repository was last updated on Oct 21, 2026, and the latest release, release-1.2.0-rc.1 on GitHub, came out on Oct 15, 2026.
How popular is OpenSandbox?
OpenSandbox has 16.3k GitHub stars as of Nov 1, 2026. It gained 216 new stars in the week of Oct 25–31, 2026, against a 12-week average of 334 a week. Its main package had 328.9k downloads that week, +68% against its own 4-week average. That made it #1 among AI sandboxes and runtimes on the Devtoolwatch Board.
What are the best alternatives to OpenSandbox?
Other AI sandboxes and runtimes on the Devtoolwatch Board in the week of Oct 25–31, 2026, by momentum: microsandbox (#2), E2B (#3), Agent Sandbox (#4), Trigger.dev (#5), Inngest (#6). The alternatives table above has their numbers.
Can OpenSandbox run VS Code?
Yes. OpenSandbox can host VS Code Web and desktop-like environments for remote development workflows. The example catalog includes remote development environments.
Does OpenSandbox work with MCP clients like Claude Code and Cursor?
Yes. OpenSandbox ships an MCP server, opensandbox-mcp, that exposes sandbox creation, command execution, and text file operations to MCP-capable clients such as Claude Code and Cursor.
Which languages does OpenSandbox have SDKs for?
OpenSandbox has SDKs for Python, Java/Kotlin, JavaScript/TypeScript, C#/.NET, and Go. They are built on standardized lifecycle and execution protocols.
Can OpenSandbox pause and resume sandboxes?
Yes. OpenSandbox's Firecracker sandboxes support pause/resume with memory and disk state preserved. The 1.2.0 release candidates add opt-in auto-pause and wake-on-access for fast sandboxes.
How does OpenSandbox protect credentials?
OpenSandbox's Credential Vault lets agents call external services without exposing real credentials to sandbox workloads. Outbound access is also governed by per-sandbox egress policies.
Sources
OpenSandbox README badge
Maintainers can show the tool's weekly Board rank in their README:
[](https://index.devtoolwatch.com/tools/opensandbox-group-opensandbox/)How this page is made: Devtoolwatch writes each review from the project's README, releases, package metadata and website, with an AI model, then checks every claim against the source it cites and drops what the sources don't support. The numbers come from Devtoolwatch's daily GitHub snapshots, GitHub's stargazer history, and the npm and PyPI download APIs. Spotted an error? Email [email protected].