# OpenSandbox

> General-purpose sandbox platform that runs AI-generated code in isolated containers

- Category: Agents & Automation / Code Sandboxes & Isolation
- Language: Python
- Licence: Apache-2.0
- Repository: https://github.com/opensandbox-group/OpenSandbox
- Website: https://open-sandbox.ai
- Canonical page: https://ai-tldr.dev/tools/opensandbox/

## In short

OpenSandbox is an open-source platform that gives AI applications a safe, isolated place to run code and shell commands. It exposes one unified sandbox API and ships SDKs for Python, Java/Kotlin, JavaScript/TypeScript, C#/.NET, and Go, so you can plug it into almost any stack. It sits in the Code Sandboxes & Isolation category of the Agents & Automation tools and is open-source, written in Python and licensed Apache-2.0.

## Overview

OpenSandbox is an open-source platform that gives AI applications a safe, isolated place to run code and shell commands. It exposes one unified sandbox API and ships SDKs for Python, Java/Kotlin, JavaScript/TypeScript, C#/.NET, and Go, so you can plug it into almost any stack.

It is built for the work agents actually do: coding agents, GUI agents, agent evaluation, AI code execution, and reinforcement-learning training. Under the hood it runs on Docker for local use and a high-performance Kubernetes runtime for large-scale, distributed scheduling.

Each sandbox comes with built-in Command, Filesystem, and Code Interpreter tools, plus network controls and a credential vault. For tighter isolation between workloads and the host, it supports secure container runtimes like gVisor, Kata Containers, and Firecracker microVMs.

## What it does

- Multi-language SDKs for Python, Java/Kotlin, JavaScript/TypeScript, C#/.NET, and Go over one unified sandbox API
- Docker runtime for local runs and a high-performance Kubernetes runtime for large-scale distributed scheduling
- Built-in Command, Filesystem, and Code Interpreter environments, plus examples for coding agents, browser automation, and desktop (VNC, VS Code)
- Network policy with a unified Ingress Gateway and per-sandbox egress controls
- Credential Vault that injects secrets into outbound requests without exposing real credentials to the workload
- Strong isolation via secure container runtimes including gVisor, Kata Containers, and Firecracker microVM

## Getting started

You need Docker (for local execution) and Python 3.10+ for the examples and local runtime. Install the SDK or CLI, start a local sandbox server, then create a sandbox and run code inside it.

1. Install the Python SDK

   Add the OpenSandbox SDK to your project. SDKs are also available for JavaScript/TypeScript, Java/Kotlin, C#/.NET, and Go.

```bash
pip install opensandbox
```

2. Start the local sandbox server

   Generate a Docker example config and launch the server with uvx (no separate clone needed).

```bash
uvx opensandbox-server init-config ~/.sandbox.toml --example docker
uvx opensandbox-server
```

3. Create a sandbox and run a command

   Create a sandbox, then execute a shell command inside it and read the output.

```python
import asyncio
from datetime import timedelta
from opensandbox import Sandbox

async def main() -> None:
    sandbox = await Sandbox.create(
        "opensandbox/code-interpreter:v1.1.0",
        entrypoint=["/opt/code-interpreter/code-interpreter.sh"],
        timeout=timedelta(minutes=10),
    )
    async with sandbox:
        execution = await sandbox.commands.run("echo 'Hello OpenSandbox!'")
        print(execution.logs.stdout[0].text)
    await sandbox.kill()

asyncio.run(main())
```

4. Drive sandboxes from the terminal

   The osb CLI handles the common workflow: configure a connection, create a sandbox, and run commands.

```bash
pip install opensandbox-cli
osb config init
osb sandbox create --image python:3.12 --timeout 30m -o json
osb command run <sandbox-id> -o raw -- python -c "print(1 + 1)"
```

## When to use it

- Letting a coding agent (such as Claude Code) install dependencies, run commands, and edit files in an isolated environment instead of on the host
- Safely executing AI-generated or untrusted code in apps, with strong isolation via gVisor, Kata Containers, or Firecracker
- Running browser-automation and GUI tasks inside sandboxes using built-in Chrome, Playwright, VNC, and VS Code examples
- Spinning up many isolated environments on Kubernetes for agent evaluation and reinforcement-learning training workloads