gVisor

Active

GitHub Go Apache-2.0

Description

Google's user-space kernel sandbox that intercepts container syscalls.

Key Features

User-space kernel — runsc intercepts syscalls
Strong isolation — Container decoupled from host kernel
Kubernetes integration — runsc as a runtime
Low overhead — Lighter than VMs
Multi-platform — Go runtime portable

Use Cases

💡 Kernel-level isolation in multi-tenant containers.

💡 Secure sandbox for untrusted workloads.

💡 Strong-isolation containers on GKE/Cloud Run.

Strengths & Limitations

✅ Strengths

• Actively maintained, recent updates
• High community interest (19.2k stars)
• Permissive open-source license (Apache-2.0)

Quick Start

# Install and run
docker run --runtime=runsc -it alpine
# Verify the service is up

Visit GitHub

Related Projects

landrun

2.3k · Go

Normal A

landrun is a lightweight, Landlock-based Linux process sandbox that runs any program under tight capability isolation without requiring root.

sandboxlandlocklinux +2

· Landlock kernel isolation - leverages Linux 5.13+ Landlock LSM for filesystem access control
· No-root deployment - regular users can launch sandboxes without sudo or privileged containers
· Fine-grained policy - declare readable, writable, and executable directory sets from the CLI

View on GitHub

Wuying AgentBay SDK

1.1k · Python

Normal A

Wuying AgentBay SDK is a cloud sandbox built for AI agents, providing secure isolated execution environments for agents to safely run code and operations in the cloud, suitable for production-grade agent applications requiring sandboxed execution.

sandboxcloud-executionsecurity +1

· On-demand cloud sandboxes with second-level startup — create, use, and destroy isolated environments instantly
· Four capability modes: browser automation, desktop app control, mobile UI testing, and code execution
· Multi-language SDKs: Python, TypeScript, Golang, and Java — full coverage

View on GitHub

OpenSandbox

14.9k · Go

Active A

OpenSandbox is an open-source, secure, fast, and extensible sandbox runtime for AI agents, developed by Alibaba.

sandboxai-infrastructurekubernetes +2

· Multi-language SDKs: Python, Java/Kotlin, JavaScript/TypeScript, C#/.NET, and Go with unified sandbox APIs
· Docker and Kubernetes runtimes: built-in lifecycle management for both local development and large-scale distributed scheduling
· Strong isolation: supports gVisor, Kata Containers, and Firecracker microVM secure container runtimes

View full details → View on GitHub

E2B

13.7k · Python

Active A+

E2B provides secure cloud sandboxes for AI agents, supporting code execution, file operations, and isolated compute as an execution layer for coding and automation workflows.

sandboxcode-executionsecurity +1

· Secure Cloud Sandboxes: Provides isolated cloud execution environment for AI agents
· Code Execution: Supports JavaScript/Python SDK to run AI-generated code
· File Operations: Perform file read/write and management within sandboxes

View full details → View on GitHub

sandbox-executionmicrovmfirecracker

Sandboxing Code Execution in AI Agents: From Docker to microVMs, a Decision Matrix

A side-by-side comparison of five sandbox technologies, weighing latency, security, and ops cost.