E2B core ↗
E2B presents a developer platform for running code and tools in cloud sandboxes. It is the useful starting point if the goal is an API-first sandbox service and a separate deployment evaluation.
Verdicts · new leads
New sandbox leads
A compact reading list for projects that surfaced after the main research pass. These are direct links and starting points, not fresh ratings or an endorsement.
How to use this page
Start with a project’s threat model, host requirements, network defaults and persistence model. A fast demo is useful evidence, but it is not evidence of containment. Links go to the project itself or its documentation; there are no affiliate or synthetic referral parameters.
E2B is the lead worth a dedicated look
E2B Desktop ↗
The desktop-oriented layer is the relevant branch of the E2B ecosystem for browser or GUI agent work, where the display, downloads and interactive credentials become part of the boundary design.
Other projects to put on the evaluation board
ZeroBoot ↗
Copy-on-write VM forking aimed at fast, concurrent agent sandboxes.
VMTREE ↗
Self-hosted ephemeral VM provisioning; relevant for a host-side pool or template workflow.
Microsoft Quicksand ↗
QEMU-based VM automation with a Python API, desktop-oriented controls and checkpoint-oriented workflows.
Buildkite Cleanroom ↗
Policy-controlled microVM workloads and reproducible repository execution.
CubeSandbox ↗
A multi-tenant, lightweight sandbox project for agent workloads.
Matchlock ↗
Linux sandboxing focused on securing agent workloads.
Anthropic sandbox-runtime ↗
OS-level filesystem and network restrictions without requiring a container.
NVIDIA OpenShell ↗
A private runtime for autonomous agents. Documentation ↗
stereOS ↗
A Linux system positioned as hardened and purpose-built for AI agents.
Awesome Agent Runtime Security ↗
A broader discovery list for runtime-security research rather than a sandbox implementation.
Where this fits the local experiment
For a Windows-first desktop product, separate the user-facing orchestration experience from the workload boundary. A practical early comparison is: an Incus container for dense, trusted task isolation; an Incus VM or a KVM microVM for a separate kernel; and an API-hosted model such as E2B where the product needs remote execution. The Sandbox Stacks chapter explains the boundary layers that still need to sit around each option.