The sandbox landscape: seven families, one spectrum
Hundreds of repositories, but only a handful of underlying ideas. Once you can place a project on the isolation spectrum, most of its claims and most of its limitations become predictable.
The isolation spectrum
Every sandbox in this guide is somewhere on a single axis: how much of the host machine does the workload share? The further right you go, the stronger the boundary and the more it costs you in startup time, memory, ergonomics and file-sharing convenience.
The seven families
1 · Container sandboxes
Podman · Docker · Incus · LXC · Sysbox · devcontainers
OCI containers built from namespaces, cgroups, seccomp and LSMs, with an image as the unit of reproducibility. The default answer for local agent isolation because everything supports it, it starts in milliseconds, and it has an ecosystem. The boundary is a namespace, not a hypervisor.
2 · Process sandboxes
bubblewrap · Landlock · seccomp · Seatbelt · firejail · nsjail
The kernel's own primitives, applied to one process tree. No image, no daemon, near-zero overhead. This is what Codex, Claude Code, Gemini CLI and most wrappers actually use underneath. Strong on filesystem policy, weak on network unless you add a proxy or a namespace.
3 · MicroVMs
Firecracker · Cloud Hypervisor · crosvm · libkrun · Kata · BoxLite
A stripped-down VMM with a tiny device model that boots a real kernel in tens to hundreds of milliseconds. The strongest isolation you can get with container-like economics, at the cost of assembling a kernel, a rootfs and file-sharing yourself.
4 · Full VMs
QEMU/KVM · Hyper-V · Apple Virtualization · Incus · Lima · UTM
Boring, complete, and remarkably hard to argue with. A VM does not care how clever the agent is. The cost is memory, boot time and file-sharing speed — and on Windows and macOS you may already have one running. Lima and Incus both belong here even though both also speak container: the instances that matter are the VMs, which have their own kernel.
5 · Application kernels
gVisor · Hyperlight · NanVix · unikernels
Reimplement or remove the kernel interface rather than virtualising it. gVisor intercepts syscalls in user space; unikernels compile the application into a kernel. Narrow host surface, awkward workload compatibility, excellent security measurement record.
6 · WASM and language isolates
Wasmtime · Wasmer · Deno · V8 isolates · Workers
Capability-based sandboxing at the runtime layer: the module reaches only the handles you give it. Millisecond starts, thousands of tenants per machine, and a fundamental mismatch with code that expects a shell. Ideal for tool execution and plugins, wrong for a coding agent.
7 · Agent-specific wrappers
Claude Code · Codex · nono · Greywall · Fence · yoloAI
Purpose-built layers around a particular agent or threat model, usually composing one of the families above plus an approval model and, increasingly, credential brokering. Where the interesting new ideas live — and where most of the abandoned projects also live.
Cross-cutting: the controls
Three things sit beside the runtime rather than inside it, and they are where most of the security
value is: credential brokering, egress policy, and
filesystem strategy. A container with brokered credentials and a tight
allowlist is often safer in practice than a VM with your .env file mounted into it.
Why there are suddenly hundreds of these
Four forces produced the current pile, and understanding them tells you which projects are likely to survive.
1 · The problem rewards a weekend of work and punishes neglect
A working wrapper is a Dockerfile and a shell script. A genuinely good one is a research project: network mediation that fails closed, credential brokering, snapshot semantics, cleanup after crashes, path-traversal resistance, and platform parity. The gap between the two is where the abandoned repositories live.
2 · There is no standard, and the stakeholders disagree
One agent needs SSH but not rm; another needs filesystem writes but not network. Attempts
to standardise have produced policy schemas (Microsoft's MXC), taxonomies (the awesome lists), and
credential-broker drafts at the IETF — but nothing that a tool can simply adopt and be correct.
3 · First-party absorption is already happening
Codex ships a Landlock/bubblewrap sandbox on by default. Claude Code ships a sandbox-plus-container story. Docker shipped Sandboxes, Cloudflare shipped a sandbox SDK, Google shipped an agent sandbox for Kubernetes. Every time a platform absorbs the primitive, a cohort of wrappers loses its reason to exist — which is the strongest argument for building on the boring substrate instead of the newest wrapper.
4 · The threat is moving faster than the tooling
Measured cyber-capability of frontier models is scaling with inference compute with no observed plateau, and container-escape benchmarks show frontier models succeeding in the tens of percent on scenarios built from known CVEs and common misconfigurations — and near zero on novel memory-corruption scenarios. That combination says the correct target is not "beat a determined expert", it is "stop the realistic attack that is now cheap to automate".
Abandonment after launch. One of the most thorough first-wave projects stopped development two days after its launch thread; its blocklists are now rotting in place. Frozen dependencies. A popular container-free tool has not had a commit since October 2025, pinned to a Landlock ABI the kernel has since moved well past. Silent pivots. A very large platform built its reputation on being open source, then closed the production code and left the public repo unmaintained. The maintenance tail. "None of these sandboxes is a set-and-forget dependency" is the honest summary from practitioners: budget to revisit the choice annually, not once.
Projects with a funding or governance parent (Firecracker at AWS, gVisor and crosvm at Google, Cloud Hypervisor with Intel and the Linux Foundation, Incus at Linux Containers, Podman at Red Hat, Lima in the CNCF), projects that are the substrate other people build on, and projects whose maintainers publish their own limitations in the README. The last one is a surprisingly strong predictor: tools that tell you exactly what they do not protect are usually the ones worth reading closely.
How to place any new project in five minutes
| Question | What a good answer looks like |
|---|---|
| Where does it sit on the spectrum? | The README names the primitive, not the vibe. "rootless Podman container" beats "secure isolated environment". |
| What is the network story? | Either a kernel-level namespace plus a proxy, or an explicit admission that allowlisting depends on the process cooperating. |
| Who holds the credentials? | Ideally a broker outside the sandbox. "Mounted read-only" is a weaker but honest answer. "Ambient" means anything the agent reads is fair game. |
| What is the last-commit date and the release count? | Active within weeks, with tagged releases. A hundred stars and no releases is a weekend project with a README. |
| How many people maintain it? | More than one, ideally an organisation. Bus factor matters more than star count for anything you will depend on. |
| Does the documentation admit limits? | Look for a security model page, a known-issues section, or a disclaimer. Absence of limits language is a red flag, not a good sign. |
| Does it fail open or closed? | Grep the source for the fallback path. A sandbox that degrades to "no sandbox" when a component is missing is not a sandbox. |
This is a compressed version of the method used for the 173 repositories that received a full assessment in Repo Risk Ratings. The full procedure is documented in How This Guide Was Researched.