A lightweight sandboxing tool for enforcing filesystem and network restrictions on arbitrary processes at the OS level, without requiring a container.
fencesandbox/fence
Lightweight, container-free sandbox for running commands with network and filesystem restrictions
Landlock: unprivileged access control — The Linux Kernel documentation
The goal of Landlock is to enable restriction of ambient rights (e.g. global filesystem or network access) for a set of processes. Because Landlock is a stackable LSM, it makes it possible to create safe security sandboxes as new security layers in addition to the existing system-wide access-controls. This kind of sandbox is expected to help mitigate the security impact of bugs or unexpected/malicious behaviors in user space applications. Landlock empowers any process, including unprivileged ones, to securely restrict themselves.
Sprites - Stateful sandboxes
Persistent, hardware-isolated execution environments for arbitrary code. Run AI agents, untrusted code, and more in secure sandbox environments with checkpoint & restore.
perplexityai/SPACE
Sandboxed Platform for Agentic Code Execution: pluggable-runtime sandboxes for running agent and user code in isolation.
perplexityai/SPACE
Sandboxed Platform for Agentic Code Execution: pluggable-runtime sandboxes for running agent and user code in isolation.
Vercel Sandbox
Vercel Sandbox allows you to run arbitrary code in isolated, ephemeral Linux VMs.
Moving Beyond Containers - Introducing Boxer by Daniel Phillips @Wasm I/O 2025
agentOS — A faster, lighter, cheaper alternative to sandboxes
A portable open-source operating system for agents. Stateful runtime, universal agent interface, and secure code execution. One SDK, deploy anywhere.
Dancing mad with sandboxing
Kefka is a Go-native shell sandbox with coreutils, Python via WebAssembly, and more. Learn the works of madness that went into making this happen!
linuxkit/linuxkit
A toolkit for building secure, portable and lean operating systems for containers
libkrun/libkrun
A dynamic library providing Virtualization-based process isolation capabilities
Composable, fast, and secure dev environments | Workshop | Ubuntu
Launch agent-ready, sandboxed development environments with a single command. Define them via simple YAML configs, share them to recreate on different machines.
Ephemeral-AI-Lab/layerfs
LayerFS gives every agent an isolated, disposable filesystem fork without copying the shared base. Useful states become durable, deduplicated checkpoints with workspace-scoped tool history—ready to branch, rewind, or reuse across parallel development, environment experiments, and MCTS-style rollouts.
microsandbox - Every agent deserves its own machine
Run lightweight microVMs locally. Programmable networking, custom filesystems, secrets that never leak.