Recommended repositories

Permission flags on every capability, deny by default. The clearest demonstration that the runtime itself can enforce policy.

Docker Engine. Unbeatable ecosystem, but the root daemon and docker socket are a real escalation surface. → full assessment

The building block under most home-made credential brokers and egress inspectors. → full assessment

Vulnerability, misconfiguration and secret scanning for the images your agent runs in.

AWS's KVM microVM monitor. The most proven microVM in existence, and the one with the worst ergonomics (no virtio-fs). → full assessment

WireGuard mesh with identity. A practical way to give a sandbox one reachable host and nothing else.

A vault, not a broker. Excellent at issuing short-lived credentials; it still hands the plaintext to whoever asks.

QEMU with a good GUI. If you want a VM and you want to see it, start here.

Daemonless, rootless-first OCI container engine. The boring default that works on every platform you care about. → full assessment

Registry with signing and scanning. Relevant to image supply chain, which is now an agent supply chain.

Secret scanning for repositories. Pair with pre-commit hooks so an agent cannot commit a key.

Verified secret detection. Good as a second pass after gitleaks.

eBPF networking and policy. Where cluster-scale agent egress control actually lives.

Encrypted config in Git. Solves secrets at rest, not secrets at runtime.

Linux VMs on macOS and on Linux hosts, CNCF incubating, with vz/QEMU/krunkit drivers, and the substrate under Colima, Rancher Desktop, Finch and Podman Desktop. A real VM, not a container. Windows hosts are supported only through Lima's own experimental wsl2 and hcs drivers; on a Linux host without a hypervisor backend it falls back to very slow TCG emulation. → full assessment

The container plumbing everything else sits on.

A user-space kernel that intercepts every syscall. Production-hardened by Google Cloud Run, and the closest thing to a workload that cannot escape its own kernel. → full assessment

The reference WASI runtime. Genuinely capability-based, genuinely fast, and a poor fit for code that expects a shell. → full assessment

Self-hosted cloud development environments. Boring, scalable, and increasingly sold as agent infrastructure.

Kubernetes in Docker. Relevant because GKE's agent sandboxes and Nested Pod Sandboxing are where this goes at scale.

The reference emulator. Two million lines of C: the biggest attack surface in this guide and also the most capable. → full assessment

The OCI runtime whose escape CVEs (2019, 2024, three in 2025) define the container threat model.

Fast vulnerability scanner for container images and filesystems.

CLI for models. Useful for fanning the same prompt across providers, which is the non-sandbox half of that workflow.

A tiny init for containers. Boring plumbing that fixes zombie processes.

Ubuntu VMs in one command on all three platforms. Underrated as a cheap hard boundary.

The unprivileged namespace sandbox that backs Flatpak and half the agent sandboxes on this site.

The V8 isolate runtime behind Cloudflare Workers. Thousands of tenants per machine, no OS to escape.

Bash test framework. Included because the sandbox is only as good as the tests you point at it.

Intel-led Rust VMM. virtio-fs, hotplug, vhost-user, and a coordinated CVE response. The microVM to pick when you need features. → full assessment

System containers, full VMs, snapshots and projects in one tool. The best Linux power-user option for persistent agent machines. → full assessment

The dev container standard. A container with a friendly config file is still a container.

OpenSSF security health metrics. One input to an adoption decision, never the whole answer.

The low-level system-container library Incus is built on.

Advisories and proof-of-concept exploits. Where you should look after a sandbox vendor claims something is fixed.

Entropy-plus-pattern detection designed to run in hooks.

A fast C OCI runtime with an optional libkrun handler, which is how Podman grows a microVM mode.

Google's namespace+seccomp jail. Small, solid, widely deployed inside bigger systems.

Mature Docker-based local dev environments. A reminder that containers are the normal answer for dev tooling.

The spec that defines what a container even is. Worth reading before you trust a claim about one.

Cloud Native Buildpacks. A cleaner way to build the image your agent runs in than hand-rolled Dockerfiles.

Syscall filtering. A layer, never a boundary on its own.

The OCI runtime monitor that keeps your container's stdio and exit status honest.

ChromeOS/Android's seccomp launcher. Boring, hardened, and still maintained.

OS keyring integration for Azure Artifacts. Included to show what 'credentials in the keychain' looks like.

OpenCode. Huge adoption, no built-in strong sandbox; it is the payload most sandbox wrappers target.

Built-in sandboxed Bash tool. Optional, and it has been bypassed more than once. → full assessment

Ships a Landlock+seccomp sandbox on Linux, Seatbelt on macOS, restricted tokens on Windows. Which mode you get depends on your host. → full assessment

The most popular browser agent, and the source of both a critical domain-allowlist bypass and a good security paper.

Seatbelt or a container image you supply. Thin and honest about it.

The MCP server collection. Every server you add is a new capability grant you should be auditing.

Goose, an open agent framework. Fifty thousand stars and no sandbox of its own; it is a client of the layers in this guide.

Terminal pair programmer. Historically run unsandboxed, which is exactly the habit this site is arguing against.

The Zig compiler, whose repository moved to Codeberg. A pointed reminder that a GitHub mirror is not always upstream.

A real Hyper-V VM with a real kernel, and an interop channel that hands execution straight back to Windows as your user. → full assessment

Agent framework with a Sandbox-API integration. Not an isolation layer; it is where you would plug one in.

Secrets platform whose Agent Vault is one of the cleanest open-source credential brokers: placeholder in, real key swapped at egress. → full assessment

Local encrypted database with an SSH agent and browser integration. KeePassXC-Browser is how many people gate browser credentials.

Qwen's CLI agent, with a pluggable sandbox. Included for completeness rather than proof.

Open-source drivers, cross-OS fleets, macOS VM tooling and computer-use benchmarks. The biggest name in the category. → full assessment

A WASM runtime now explicitly marketed at agent sandboxing, with a broader runtime surface than WASI alone.

The reference hosted agent sandbox: Firecracker microVMs, sub-200ms starts, SDKs everywhere. Self-hosting is real but experimental. → full assessment

Ephemeral cloud dev environments. AGPL core, heavy self-host story.

Wayland/X11 for WSL2, so Linux GUI apps land on the Windows desktop. The nicest cross-boundary GUI story that exists.

The WSL2 kernel source. Useful when you need to know exactly which security features your 'isolated' Linux has.

Runtime detection, and the origin story of the 'denylist fails against reasoning adversaries' argument.

OCI-compatible containers that each get their own microVM. Real production use at IBM Cloud; two-to-four months of integration work before your first workload.

System-call and syscall-activity observation. Useful for watching an agent, not for containing one.

A tiny interpreter. Interesting for embedded and for trivially auditable sandboxes.

Mature SUID desktop sandbox. Excellent for humans, awkward for agents because setuid binaries and user namespaces interact badly.

The MPL-licensed fork of Vault, for teams who do not want a BUSL dependency.

Container and Kubernetes desktop stack on top of Lima/WSL. A good place to see the platform plumbing.

Cirrus Labs' Apple-Silicon VM tool, widely used for ephemeral CI and agent VMs.

Anthropic's OS-native sandbox library (Seatbelt/bubblewrap) plus a network proxy. The reference implementation of 'two walls'. → full assessment

eBPF runtime enforcement and observability for workloads, including agent containers.

Landlock/seccomp/Seatbelt sandbox whose real innovation is phantom-token credential injection. Pre-1.0, with a 2026 sandbox-escape CVE already behind it. → full assessment

Per-agent containerised worktrees over MCP, with Git branch review. Clever composition from Dagger. → full assessment

Runs systemd, Docker-in-Docker and nested user namespaces inside a rootless container by removing the container's kernel-surface advantage in a controlled way.

Paravirtualised Windows drivers for QEMU/KVM. The boring dependency behind decent Windows-in-a-VM performance.

Process isolation as a library, by Red Hat. Powers podman --runtime krun, krunkit, smolvm, boxlite and microsandbox. Cheap to embed, no engine-side seccomp.

Fly Machines are the general-purpose layer under Fly Sprites: Firecracker microVMs with ~300ms checkpoint/restore.

Google's Rust VMM, shipped in ChromeOS for Linux (Crostini) and Android (ARCVM) guests and now used in Android's Terminal app, Cuttlefish and Windows — an adoption signal for the VMM itself, not proof that it is a drop-in agent sandbox. It supports vendor hypervisor backends used by Android's virtualization framework, including Qualcomm's Gunyah. Snapshot support is documented as highly experimental.

Rust CLI that drives apps through accessibility trees instead of pixels. Reliable, token-efficient, macOS-only. → full assessment

EDR-style egress monitoring for GitHub Actions. The closest thing to a runtime audit trail in CI.

Dockerised Claude Code with allowlists. Popular, and the author is upfront that it is a convenience wrapper.

Sandboxed environments on Cloudflare's edge, with backup/restore and a documented overlayfs EXDEV footgun.

Audited-by-a-security-firm devcontainer for running Claude Code in bypass mode. Small, focused, and one of the few agent sandboxes with a real review behind it.

Go bindings for the Firecracker API; quiet since February 2026.

gVisor-based sandboxes with GPUs and memory snapshots. Fully proprietary; the pricing multipliers are the trap.

Docker's purpose-built microVM sandbox CLI for coding agents, with a host-side credential proxy. Closed source, early access, fast-moving.

Prebuilt Arch images for VMs. Supply-chain relevant: whatever you boot is what you trust.

The desktop app for running parallel agents in isolated containers. The best GUI prior art and the closest thing to a competing product. → full assessment

Firecracker sandboxes with filesystem snapshots and credential brokering built into Vercel's platform.