Which sandbox should you actually trust?
There are now hundreds of projects promising to make AI coding agents safe. Most of them are wrappers around the same five primitives. This guide sorts the ecosystem by what each thing genuinely protects, separates interesting technology from technology you would depend on today, and tells you which weekends not to waste.
What this site is for
If you have looked at the sandbox ecosystem for more than an hour you have noticed the problem: a new agent sandbox ships roughly every other day, most of them are a shell script around Docker or bubblewrap, and the ones that look most impressive are frequently the ones nobody has actually run. Meanwhile the answer that keeps working is very old and very boring.
This guide exists to answer four questions with evidence:
- What am I actually protecting against? Three different threats — accidents, prompt-injection exfiltration, and hostile code — need three different boundaries. A tool that solves one is often useless for the others.
- What does each technology really contain? Not the marketing claim. The specific thing it stops, the specific thing it does not, and the bypasses that are on public record.
- Which repositories are trustworthy enough to build on? Using an adoption-risk method that looks at longitudinal failure patterns, maintainer behaviour and complaint rates relative to real usage, not star counts.
- What should I stop trying to install? This is the question nobody answers, and the one that saves the most time.
What a sandbox is actually for
Sandbox talk goes wrong when people argue about tools before agreeing on threats. This guide uses three tiers, borrowed from the dataset behind please do not escape and extended with the evidence from the security literature.
Tier 1 is where the real damage happens
The thing most likely to ruin your week is not an exotic escape. It is an agent doing exactly what it was told, in the wrong directory, without a backup. Worktree isolation and snapshots fix this almost completely, and they are nearly free.
Tier 2 is where the surprise lives
Published attack-success rates against tool-using agents under realistic indirect prompt injection cluster in the tens of percent, and spike far higher with adaptive attacks. Any secret the agent can read is a secret an attacker might read through the agent.
Tier 3 is rare but decisive
Actual sandbox escapes are mostly misconfiguration rather than novel exploitation. When they are novel, only a separate kernel helps. That is the entire argument for VMs and microVMs, and it is a good one — just not the first problem to solve.
The short verdicts
Full reasoning lives in the repo assessments. This is the executive summary you can argue with.
| Question | Our answer |
|---|---|
| Should I just use Docker? | Use Podman rootless if you are choosing today; use Docker if you already have it, and audit the template. Both share your kernel, so neither is tier-3 isolation. |
| Is rootless enough? | For tier 1 and much of tier 2, usually yes. It changes what an escape gets you, not whether an escape is possible. |
| Should agents run inside a VM? | If you can afford the setup cost, yes. On Windows you may already be there via WSL2 and not know it. |
| Is a microVM worth the hassle? | On Linux, yes if you need a hypervisor boundary and container startup speed. On a laptop without KVM, no. |
| Which repos are actually mature? | Podman, Firecracker, Cloud Hypervisor, QEMU/KVM, gVisor, Kata, Incus, Lima, bubblewrap, Wasmtime, mitmproxy, Vault. See Recommended. |
| Which should I stop trying to install? | Stalled single-author wrappers, GPL desktop shells with no releases, and anything whose README warns you it is not a boundary. See Skip for Now. |
| What should I do this afternoon? | Move your credentials out of the agent's environment. It is a two-hour change with more security value than switching runtimes. |
How to read this guide
The chapters
The Landscape explains why there are hundreds of these projects and what the seven real families are. The next six chapters take one family each — containers, process sandboxes, microVMs, full VMs, Windows and computer use — and end with what each one is genuinely good at.
The controls
Secrets, filesystem isolation and network isolation are cross-cutting: they apply no matter which runtime you chose, and they are where the real security wins are. Reality Check is the chapter to send to someone who claims containers are secure.
The verdicts
Recommended, Risk Ratings, Watch and Skip are the repository assessments. Every rating is prose with evidence attached, because a number out of ten would be a lie dressed as precision.
Build and browse
Sandbox Stacks gives six complete compositions with the trade-offs spelled out. Directory is the filterable list of everything examined, including the projects that did not earn a chapter of their own.
Two pages are deliberately not part of the evidence base. Field Notes is one person's hands-on notes, labelled as anecdote, and the method page explains why it is ranked last on purpose.