Field guide · 174 repositories examined

Which sandbox should you actually trust?

There are now hundreds of projects promising to make AI coding agents safe. Most of them are wrappers around the same five primitives. This guide sorts the ecosystem by what each thing genuinely protects, separates interesting technology from technology you would depend on today, and tells you which weekends not to waste.

HOST AGENT FULL VM QEMU/KVM · Incus · Lima · Hyper-V · Apple container MICROVM Firecracker · Cloud Hypervisor · libkrun APP KERNEL gVisor · Hyperlight · NanVix CONTAINER Podman · Docker · namespaces · cgroups PROCESS bubblewrap · Landlock · seccomp · Seatbelt CONTROLS credential broker · egress allowlist · policy hooks BOUNDARIES
The whole field in one picture. You pick one or more bands, then decide who holds the credentials. Most of the argument in this guide is about how strong each band really is, and where the walls leak.
174
repositories examined
29
repos given a full risk assessment
7
architectural families
5
verdict categories (plus a marker for "not a boundary"), no fake scores

What this site is for

If you have looked at the sandbox ecosystem for more than an hour you have noticed the problem: a new agent sandbox ships roughly every other day, most of them are a shell script around Docker or bubblewrap, and the ones that look most impressive are frequently the ones nobody has actually run. Meanwhile the answer that keeps working is very old and very boring.

This guide exists to answer four questions with evidence:

  1. What am I actually protecting against? Three different threats — accidents, prompt-injection exfiltration, and hostile code — need three different boundaries. A tool that solves one is often useless for the others.
  2. What does each technology really contain? Not the marketing claim. The specific thing it stops, the specific thing it does not, and the bypasses that are on public record.
  3. Which repositories are trustworthy enough to build on? Using an adoption-risk method that looks at longitudinal failure patterns, maintainer behaviour and complaint rates relative to real usage, not star counts.
  4. What should I stop trying to install? This is the question nobody answers, and the one that saves the most time.
The one-paragraph version Use rootless Podman for fast, cheap isolation and accept that it shares your kernel. When you want a real boundary, use a VM — on Windows that already means WSL2, and the comfortable desktop tools are Lima, Incus, UTM and Apple's container runtime (Lima runs on Linux hosts as well as macOS, and WSL2 is the equivalent on Windows). Reach for a microVM (Cloud Hypervisor, Firecracker, Kata, or a packaged OCI-in-a-VM runtime such as BoxLite) when you need container ergonomics with a hypervisor boundary and you are willing to do the assembly work. Put the credentials outside the sandbox and hand the agent placeholders — that single change matters more than which runtime you picked. And remember that no sandbox replaces review: everything the agent produces should arrive as a diff you can read.
If you only read one chapter Read Secrets. Credential brokering is the highest-value, lowest-cost change available to almost everybody, and it is the one piece of agent-sandbox engineering that has improved dramatically in the last year.

What a sandbox is actually for

Sandbox talk goes wrong when people argue about tools before agreeing on threats. This guide uses three tiers, borrowed from the dataset behind please do not escape and extended with the evidence from the security literature.

TIER 1 · ACCIDENTS The agent runs rm -rf in the wrong tree, rewrites history, deletes a database, force-pushes. Needs: a workspace that is not the original. worktree · container · snapshot TIER 2 · EXFILTRATION A poisoned README, issue, web page or dependency tells the agent to ship your keys or your source somewhere. Needs: no ambient secrets, plus egress you control. broker · allowlist · proxy TIER 3 · HOSTILE CODE Code that is genuinely trying to get out: kernel exploits, runtime CVEs, socket tricks, metadata-service probing. Needs: its own kernel. A container is not enough. VM · microVM · app kernel
Most arguments about sandboxes are people solving different tiers with different tools and both being right. Decide your tier first; the tool list falls out of it.

Tier 1 is where the real damage happens

The thing most likely to ruin your week is not an exotic escape. It is an agent doing exactly what it was told, in the wrong directory, without a backup. Worktree isolation and snapshots fix this almost completely, and they are nearly free.

Tier 2 is where the surprise lives

Published attack-success rates against tool-using agents under realistic indirect prompt injection cluster in the tens of percent, and spike far higher with adaptive attacks. Any secret the agent can read is a secret an attacker might read through the agent.

Tier 3 is rare but decisive

Actual sandbox escapes are mostly misconfiguration rather than novel exploitation. When they are novel, only a separate kernel helps. That is the entire argument for VMs and microVMs, and it is a good one — just not the first problem to solve.

The short verdicts

Full reasoning lives in the repo assessments. This is the executive summary you can argue with.

What we would do, in one line each. Ratings are explained in Repo Risk Ratings.
QuestionOur answer
Should I just use Docker?Use Podman rootless if you are choosing today; use Docker if you already have it, and audit the template. Both share your kernel, so neither is tier-3 isolation.
Is rootless enough?For tier 1 and much of tier 2, usually yes. It changes what an escape gets you, not whether an escape is possible.
Should agents run inside a VM?If you can afford the setup cost, yes. On Windows you may already be there via WSL2 and not know it.
Is a microVM worth the hassle?On Linux, yes if you need a hypervisor boundary and container startup speed. On a laptop without KVM, no.
Which repos are actually mature?Podman, Firecracker, Cloud Hypervisor, QEMU/KVM, gVisor, Kata, Incus, Lima, bubblewrap, Wasmtime, mitmproxy, Vault. See Recommended.
Which should I stop trying to install?Stalled single-author wrappers, GPL desktop shells with no releases, and anything whose README warns you it is not a boundary. See Skip for Now.
What should I do this afternoon?Move your credentials out of the agent's environment. It is a two-hour change with more security value than switching runtimes.

How to read this guide

The chapters

The Landscape explains why there are hundreds of these projects and what the seven real families are. The next six chapters take one family each — containers, process sandboxes, microVMs, full VMs, Windows and computer use — and end with what each one is genuinely good at.

The controls

Secrets, filesystem isolation and network isolation are cross-cutting: they apply no matter which runtime you chose, and they are where the real security wins are. Reality Check is the chapter to send to someone who claims containers are secure.

The verdicts

Recommended, Risk Ratings, Watch and Skip are the repository assessments. Every rating is prose with evidence attached, because a number out of ten would be a lie dressed as precision.

Build and browse

Sandbox Stacks gives six complete compositions with the trade-offs spelled out. Directory is the filterable list of everything examined, including the projects that did not earn a chapter of their own.

Two pages are deliberately not part of the evidence base. Field Notes is one person's hands-on notes, labelled as anecdote, and the method page explains why it is ranked last on purpose.

A warning about freshness Repository figures on this site were captured from the GitHub API on the date in the footer, and the ecosystem moves weekly. Anything labelled beta may have become stable, and anything that was active may have stopped. The reasoning and the security claims age more slowly than the numbers — but check the date on a stalled project before you assume it is still stalled, and check whether a project you were about to trust has changed its licence or gone closed-source. That happened to a very large name in this space during 2026.