opensandbox-group/OpenSandbox

Sandboxed code execution for AI agents typically means picking one runtime and living with its constraints. OpenSandbox takes a different structural approach: it defines a sandbox protocol layer first — separating lifecycle management APIs from execution APIs — and then builds runtimes on top of it. The practical consequence is that Docker and Kubernetes are interchangeable backends; the SDK surface stays the same whether you're running on a laptop or a distributed cluster.

The feature set is genuinely broad. There's an ingress gateway with multiple routing strategies, per-sandbox egress controls, and a credential vault that injects secrets into outbound requests without exposing them to the workload itself. That last piece matters for agent scenarios where the sandbox needs to call external APIs but you don't want the agent to see raw credentials. The isolation story is serious: gVisor, Kata Containers, and Firecracker microVM are all listed as supported secure container runtimes.

SDK coverage spans Python, Java/Kotlin, TypeScript/JavaScript, C#/.NET, and Go, with separate Code Interpreter SDKs layered on top of the base sandbox SDKs. The MCP server integration means Claude Code and Cursor can talk to it directly without custom tooling. The osb CLI handles the common workflow: create a sandbox, run a command, move files, inspect egress policy.

The examples directory is where the ambition becomes concrete. Integrations are documented for Claude Code, Gemini CLI, OpenAI Codex CLI, Qwen Code, LangGraph, and Google ADK. Browser automation via Playwright and Chromium is covered, as is a full desktop environment with VNC access and VS Code running inside a sandbox. There's a reinforcement learning training example using Harbor agent evaluation, one sandbox per trial.

The Alibaba provenance is visible in the Maven group ID (com.alibaba.opensandbox) and the Alibaba Cloud container registry listing, but the Apache 2.0 license and CNCF Landscape inclusion suggest genuine open governance intent. Release images are signed with Cosign and include provenance attestations — the verification guide is linked directly from the README. Architecture documentation and per-component READMEs for the ingress proxy, egress controller, execution daemon, and lifecycle server are all linked from the project structure table for operators who need deployment depth.