Devtoolwatch BoardGet it every Monday

OpenSandbox review

OpenSandbox is a sandbox runtime that gives AI agents isolated environments to run code, commands, files, browsers, and desktops on your own infrastructure.

Updated Nov 1, 2026. Review written Oct 22, 2026 from the project's own sources; usage data refreshed every Monday.

TL;DR

OpenSandbox runs AI agents in isolated sandboxes on your own infrastructure. It starts locally with Docker and deploys on Kubernetes through one sandbox API. It is for teams building coding agents, code execution, browser automation, or agent evaluation. It offers SDKs in five languages, a CLI, and an MCP server.

OpenSandbox at a glance

Category
Sandboxes and runtimes
Maintained by
opensandbox-group (organization, @opensandbox-group on GitHub)
License
Apache 2.0
Language
Python, Go, Kotlin
Repository
github.com/opensandbox-group/OpenSandbox
Website
open-sandbox.ai
PyPI package
opensandbox 1.1.1
Latest release
release-1.2.0-rc.1 on GitHub, Oct 15, 2026
First published
Dec 17, 2025

What OpenSandbox does

  • OpenSandbox executes shell commands, manages files, and runs code inside isolated sandboxes through built-in APIs.
  • OpenSandbox provisions, monitors, renews, pauses, resumes, and terminates sandbox instances on Docker and Kubernetes runtimes.
  • OpenSandbox routes inbound traffic through an ingress gateway and controls outbound access with per-sandbox egress policies.
  • OpenSandbox's Credential Vault lets agents call external services without exposing real credentials to sandbox workloads.
  • OpenSandbox's Fast Sandbox runtime uses Firecracker sandboxes on Kubernetes that support pause/resume with memory and disk state preserved.
  • OpenSandbox supports resource pools and batch creation for agent evaluation and RL training workloads.
  • OpenSandbox can host VS Code Web and desktop-like environments for remote development.

How it works

You run the OpenSandbox server locally with Docker or deploy it on Kubernetes. Applications talk to it through SDKs for Python, Java/Kotlin, TypeScript/JavaScript, C#/.NET, or Go. The osb CLI covers the same workflow from a terminal. An MCP server exposes sandbox creation, command execution, and text file operations to MCP clients such as Claude Code and Cursor.

How to install and start using OpenSandbox

Start the sandbox server

uvx opensandbox-server init-config ~/.sandbox.toml --example docker

Python SDK

pip install opensandbox

CLI

pip install opensandbox-cli

Requirements

  • Docker is required for local execution.
  • Python 3.10 or later is required for examples and the local runtime.
  • Kubernetes is needed for cluster deployment and the Fast Sandbox runtime.

First steps

  1. Create a config file with uvx opensandbox-server init-config ~/.sandbox.toml --example docker, then start the server with uvx opensandbox-server.
  2. Install the Python SDK with uv pip install opensandbox.
  3. Create a sandbox from the alpine image with Sandbox.create and run a command using sandbox.commands.run.
  4. Call sandbox.destroy() when finished to clean up the sandbox.

Who OpenSandbox is for

  • Teams running coding agents such as Claude Code or Codex CLI in isolated environments.
  • Applications that execute model-generated code and need isolated, reproducible environments.
  • Browser and desktop automation with Playwright or Chrome under controlled networking.
  • Agent evaluation and RL training that need a separate sandbox per trial.

Limitations to know

  • OpenSandbox is self-hosted: you run the server on your own Docker or Kubernetes infrastructure.
  • OpenSandbox's Fast Sandbox runtime with Firecracker targets Kubernetes, not local Docker setups.
  • OpenSandbox 1.1.0 server installs from PyPI fail at import time; release notes say users should upgrade to 1.1.1.
  • In 1.2.0-rc.2, fast sandboxes reject port-scoped network rules until enforcement lands.

Is OpenSandbox growing? Usage data

In the week of Oct 25–31, 2026, OpenSandbox ranked #59 on the Devtoolwatch Board and #1 in Sandboxes and runtimes, with a momentum score of 74 out of 100. Its main package had 328.9k downloads that week, +68% against its own 4-week average.

New GitHub stars per week for OpenSandbox12 weeks from Aug 9, 2026: 1.2k, 1k, 244, 176, 161, 266, 124, 138, 129, 159, 213, 216 new stars, an average of 334 a week.Aug 9week of Oct 25
New GitHub stars per week for the last 12 weeks, from GitHub's stargazer history (today's stargazers by the week they starred).
Show the weekly numbers
New GitHub stars per week for OpenSandbox
Week ofNew stars
Aug 9, 20261.2k
Aug 16, 20261k
Aug 23, 2026244
Aug 30, 2026176
Sep 6, 2026161
Sep 13, 2026266
Sep 20, 2026124
Sep 27, 2026138
Oct 4, 2026129
Oct 11, 2026159
Oct 18, 2026213
Oct 25, 2026216

The Board ranks tools by four signals each week: new stars, new stars for the repo's size, added downloads and download growth beyond the market. How the ranking works.

OpenSandbox alternatives

Other AI sandboxes and runtimes on the Board in the week of Oct 25–31, 2026, by momentum:

Sandboxes and runtimes ranked by momentum, the week of Oct 25–31, 2026
RankToolStarsDownloads/wk
#2microsandboxmicrosandbox is a local-first microVM runtime and library for running untrusted workloads like AI agents, user code, and CI jobs in…8.9k26.8k
#3E2BE2B is open-source infrastructure for running AI-generated code in secure, isolated cloud sandboxes, controlled through JavaScript and…14.6k5M
#4Agent Sandboxagent-sandbox enables easy management of isolated, stateful, singleton workloads, ideal for use cases like AI agent runtimes and…4.5k–
#5Trigger.devTrigger.dev is an open-source TypeScript platform for building and deploying durable AI agents, workflows, and long-running background…16.7k1.7M
#6InngestInngest is a workflow orchestration platform for running durable step functions, background jobs, and AI workflows on serverless,…6k3.7M
#7Cloudflare Sandbox SDKCloudflare Sandbox SDK runs untrusted or generated code in per-user Linux sandboxes built on Cloudflare Durable Objects and Containers.1.2k1.2M

All AI sandboxes and runtimes, ranked

Recent OpenSandbox releases

OpenSandbox FAQ

Is OpenSandbox free and open source?

Yes. OpenSandbox's source code is on GitHub (opensandbox-group/OpenSandbox) under the Apache 2.0 license, so you can use it for free.

How do I install OpenSandbox?

Run uvx opensandbox-server init-config ~/.sandbox.toml --example docker. The opensandbox package needs Python 3.10 or newer. The install section above has the other options from the project's README.

Is OpenSandbox still maintained?

Yes. The opensandbox-group/OpenSandbox repository was last updated on Oct 21, 2026, and the latest release, release-1.2.0-rc.1 on GitHub, came out on Oct 15, 2026.

How popular is OpenSandbox?

OpenSandbox has 16.3k GitHub stars as of Nov 1, 2026. It gained 216 new stars in the week of Oct 25–31, 2026, against a 12-week average of 334 a week. Its main package had 328.9k downloads that week, +68% against its own 4-week average. That made it #1 among AI sandboxes and runtimes on the Devtoolwatch Board.

What are the best alternatives to OpenSandbox?

Other AI sandboxes and runtimes on the Devtoolwatch Board in the week of Oct 25–31, 2026, by momentum: microsandbox (#2), E2B (#3), Agent Sandbox (#4), Trigger.dev (#5), Inngest (#6). The alternatives table above has their numbers.

Can OpenSandbox run VS Code?

Yes. OpenSandbox can host VS Code Web and desktop-like environments for remote development workflows. The example catalog includes remote development environments.

Does OpenSandbox work with MCP clients like Claude Code and Cursor?

Yes. OpenSandbox ships an MCP server, opensandbox-mcp, that exposes sandbox creation, command execution, and text file operations to MCP-capable clients such as Claude Code and Cursor.

Which languages does OpenSandbox have SDKs for?

OpenSandbox has SDKs for Python, Java/Kotlin, JavaScript/TypeScript, C#/.NET, and Go. They are built on standardized lifecycle and execution protocols.

Can OpenSandbox pause and resume sandboxes?

Yes. OpenSandbox's Firecracker sandboxes support pause/resume with memory and disk state preserved. The 1.2.0 release candidates add opt-in auto-pause and wake-on-access for fast sandboxes.

How does OpenSandbox protect credentials?

OpenSandbox's Credential Vault lets agents call external services without exposing real credentials to sandbox workloads. Outbound access is also governed by per-sandbox egress policies.

Sources

  1. opensandbox-group/OpenSandbox on GitHub
  2. OpenSandbox README
  3. opensandbox on PyPI
  4. OpenSandbox website
  5. Release release-1.2.0-rc.2 (Oct 21, 2026)
  6. Release release-1.2.0-rc.1 (Oct 15, 2026)
  7. Release release-1.1.1 (Oct 9, 2026)
  8. Devtoolwatch Board, the week of Oct 25–31, 2026

OpenSandbox README badge

Maintainers can show the tool's weekly Board rank in their README:

Devtoolwatch badge for OpenSandbox

[![Devtoolwatch](https://index.devtoolwatch.com/badge/opensandbox-group-opensandbox.svg)](https://index.devtoolwatch.com/tools/opensandbox-group-opensandbox/)

How this page is made: Devtoolwatch writes each review from the project's README, releases, package metadata and website, with an AI model, then checks every claim against the source it cites and drops what the sources don't support. The numbers come from Devtoolwatch's daily GitHub snapshots, GitHub's stargazer history, and the npm and PyPI download APIs. Spotted an error? Email [email protected].