# Agent Sandbox

agent-sandbox enables easy management of isolated, stateful, singleton workloads, ideal for use cases like AI agent runtimes and reinforcement learning (RL).

Source: https://wheredoirunthis.com/products/agent-sandbox · JSON: https://wheredoirunthis.com/api/products/agent-sandbox · Read on 2026-10-08

## At a glance

- Type: Sandbox
- Kind: Open source tool
- Isolation: Kata / gVisor
- Free tier: Not documented
- Starting price: Not disclosed
- GPU: Not documented
- Regions: Not disclosed
- Coverage: 14 of 61 assessed capabilities supported
- Agent readiness: read 7 of 10 signals, drive 8 of 9 signals

## Links

- Homepage: https://agent-sandbox.sigs.k8s.io/
- Docs: https://agent-sandbox.sigs.k8s.io/docs/
- Repository: https://github.com/kubernetes-sigs/agent-sandbox

## Runtime

- **BYOC (Bring your own cloud)**: na — "Self-host only, no vendor-operated BYOC tier." [source](https://raw.githubusercontent.com/kubernetes-sigs/agent-sandbox/main/README.md) (confidence: high)
- **Secrets management**: Kubernetes Secrets — "kubectl create secret generic openhands-session-key" [source](https://raw.githubusercontent.com/kubernetes-sigs/agent-sandbox/main/clients/integrations/openhands/README.md) (confidence: high)
- **Supported workloads**: AI agent runtimes, reinforcement learning, stateful singleton workloads — "agent-sandbox enables easy management of isolated, stateful, singleton workloads, ideal for use cases like AI agent runtimes and reinforcement learning (RL)." [source](https://raw.githubusercontent.com/kubernetes-sigs/agent-sandbox/main/README.md) (confidence: high)
- **Persistence**: Kubernetes persistent volume claims — "volumeClaimTemplates" [source](https://raw.githubusercontent.com/kubernetes-sigs/agent-sandbox/main/examples/containarium-ssh-sandbox/README.md) (confidence: high)
- **Data jurisdiction**: na — "Chosen by cluster operator, not a hosted jurisdiction." [source](https://raw.githubusercontent.com/kubernetes-sigs/agent-sandbox/main/README.md) (confidence: high)
- **Resource limits & quotas**: Cluster and namespace resource limits; no vendor quota — "Kubernetes pod template and lifecycle API" [source](https://raw.githubusercontent.com/kubernetes-sigs/agent-sandbox/main/docs/api.md) (confidence: high)
- **SDK languages**: Python, Go, TypeScript — "Python/Go docs captured; TypeScript in v1.0.5 release notes." [source](https://raw.githubusercontent.com/kubernetes-sigs/agent-sandbox/main/clients/python/agentic-sandbox-client/README.md) (confidence: high)
- **Network & egress controls**: Operator-configured NetworkPolicy and enforcing CNI — "Network policy is the primary, defense-in-depth control for tenant isolation." [source](https://raw.githubusercontent.com/kubernetes-sigs/agent-sandbox/main/docs/security/threat_model.md) (confidence: high)
- **Snapshots & forks**: Conditional: GKE PodSnapshot memory and filesystem restore — "GKE Autopilot cluster with a gVisor node pool" [source](https://raw.githubusercontent.com/kubernetes-sigs/agent-sandbox/main/site/content/docs/sandbox/snapshots/_index.md) (confidence: high)
- **Deployment methods**: cli, api, sdk — "kubectl, Kubernetes API and client libraries" [source](https://raw.githubusercontent.com/kubernetes-sigs/agent-sandbox/main/README.md) (confidence: high)
- **Isolation**: Kata / gVisor — "Delegates isolation to runtimes like gVisor or Kata via RuntimeClass; not a guaranteed default." [source](https://raw.githubusercontent.com/kubernetes-sigs/agent-sandbox/main/README.md) (confidence: high)

## Capabilities

### AI & agents

| Capability | Status | Evidence |
| --- | --- | --- |
| Agent skills | Supported | "# k8s-agent-sandbox-mcp" [source](https://raw.githubusercontent.com/kubernetes-sigs/agent-sandbox/main/clients/integrations/mcp-server/skill/README.md) |
| AI app builder | Not supported | [source](https://github.com/kubernetes-sigs/agent-sandbox) |
| Autonomous QA agent | Not supported | [source](https://github.com/kubernetes-sigs/agent-sandbox) |
| Built-in coding agent | Not supported | [source](https://github.com/kubernetes-sigs/agent-sandbox) |
| BYOK for LLMs | Not supported | [source](https://github.com/kubernetes-sigs/agent-sandbox) |
| Credential-injection proxy | Not supported | [source](https://github.com/kubernetes-sigs/agent-sandbox) |
| LLM gateway | Not supported | [source](https://github.com/kubernetes-sigs/agent-sandbox) |
| MCP client | Not supported | [source](https://github.com/kubernetes-sigs/agent-sandbox) |
| MCP-server hosting | Supported | "# MCP Sandbox" [source](https://raw.githubusercontent.com/kubernetes-sigs/agent-sandbox/main/examples/mcp-server-sandbox/README.md) |
| MCP server | Supported | "This MCP (Model Context Protocol) server provides tools to interact with Kubernetes Agent Sandbox" [source](https://raw.githubusercontent.com/kubernetes-sigs/agent-sandbox/main/clients/integrations/mcp-server/README.md) |
| Model inference API (first-party) | Not applicable | [source](https://raw.githubusercontent.com/kubernetes-sigs/agent-sandbox/main/README.md) |
| Preinstalled coding agent | Partially supported | "the pod is already Running and the agent-server already healthy" [source](https://raw.githubusercontent.com/kubernetes-sigs/agent-sandbox/main/clients/integrations/openhands/README.md) |

### Networking & delivery

| Capability | Status | Evidence |
| --- | --- | --- |
| Automatic HTTPS | Not supported | [source](https://github.com/kubernetes-sigs/agent-sandbox) |
| Custom domains | Not supported | [source](https://github.com/kubernetes-sigs/agent-sandbox) |
| Direct public IPv6 | Not supported | [source](https://github.com/kubernetes-sigs/agent-sandbox) |
| Edge KV store | Not supported | [source](https://github.com/kubernetes-sigs/agent-sandbox) |
| Egress controls | Partially supported | "Network policy is the primary, defense-in-depth control for tenant isolation." [source](https://raw.githubusercontent.com/kubernetes-sigs/agent-sandbox/main/docs/security/threat_model.md) |
| Email send / receive | Not supported | [source](https://github.com/kubernetes-sigs/agent-sandbox) |
| Public preview URLs | Not supported | [source](https://github.com/kubernetes-sigs/agent-sandbox) |
| Private networking | Supported | "For Service DNS, set `spec.service: true`" [source](https://raw.githubusercontent.com/kubernetes-sigs/agent-sandbox/main/clients/python/agentic-sandbox-client/README.md) |
| Built-in reverse proxy | Supported | "The [Sandbox Router](sandbox-router/) is an HTTP reverse proxy that routes traffic from SDKs and external clients to sandbox pods." [source](https://raw.githubusercontent.com/kubernetes-sigs/agent-sandbox/main/README.md) |

### Organisation & security

| Capability | Status | Evidence |
| --- | --- | --- |
| Built-in auth | Not supported | [source](https://github.com/kubernetes-sigs/agent-sandbox) |
| BYOC | Not applicable | [source](https://raw.githubusercontent.com/kubernetes-sigs/agent-sandbox/main/README.md) |
| Deploy into customers' VPCs | Not applicable | [source](https://raw.githubusercontent.com/kubernetes-sigs/agent-sandbox/main/README.md) |
| Secrets management | Partially supported | "kubectl create secret generic openhands-session-key" [source](https://raw.githubusercontent.com/kubernetes-sigs/agent-sandbox/main/clients/integrations/openhands/README.md) |
| Self-host / OSS core | Supported | "Apache-2.0" [source](https://raw.githubusercontent.com/kubernetes-sigs/agent-sandbox/main/README.md) |
| Sharing | Not supported | [source](https://github.com/kubernetes-sigs/agent-sandbox) |
| SSO / SAML | Not supported | [source](https://github.com/kubernetes-sigs/agent-sandbox) |
| Teams | Not supported | [source](https://github.com/kubernetes-sigs/agent-sandbox) |
| Workload identity | Partially supported | "serviceAccountName: your-custom-sa" [source](https://raw.githubusercontent.com/kubernetes-sigs/agent-sandbox/main/examples/sandbox-ksa/README.md) |

### Developer access

| Capability | Status | Evidence |
| --- | --- | --- |
| CLI | Supported | "kubectl" [source](https://raw.githubusercontent.com/kubernetes-sigs/agent-sandbox/main/README.md) |
| E2B-compatible API | Partially supported | "envd exposes an E2B-compatible REST and gRPC API on port 49983" [source](https://raw.githubusercontent.com/kubernetes-sigs/agent-sandbox/main/examples/envd-sandbox/README.md) |
| Filesystem API | Supported | "Filesystem transfers** are served over **REST" [source](https://raw.githubusercontent.com/kubernetes-sigs/agent-sandbox/main/packages/sandboxd/USER_GUIDE.md) |
| Git deploy | Not supported | [source](https://github.com/kubernetes-sigs/agent-sandbox) |
| HTTP data API | Not supported | [source](https://github.com/kubernetes-sigs/agent-sandbox) |
| OpenAPI spec | Supported | "openapi: 3.0.3" [source](https://raw.githubusercontent.com/kubernetes-sigs/agent-sandbox/main/packages/sandboxd/spec/filesystem/v1/filesystem.yaml) |
| Private container registry | Not supported | [source](https://github.com/kubernetes-sigs/agent-sandbox) |
| Public API | Supported | "# API Reference" [source](https://raw.githubusercontent.com/kubernetes-sigs/agent-sandbox/main/docs/api.md) |
| SDK | Supported | "# Agentic Sandbox Client" [source](https://raw.githubusercontent.com/kubernetes-sigs/agent-sandbox/main/clients/python/agentic-sandbox-client/README.md) |
| SSH access | Partially supported | "Every SSH session is pinned by a forced command" [source](https://raw.githubusercontent.com/kubernetes-sigs/agent-sandbox/main/examples/containarium-ssh-sandbox/README.md) |

### Compute & storage

| Capability | Status | Evidence |
| --- | --- | --- |
| Cloud-init / ignition config | Not supported | [source](https://github.com/kubernetes-sigs/agent-sandbox) |
| Desktop / computer-use sandbox | Partially supported | "VNC, VSCode, Jupyter and Terminal in one unified environment." [source](https://raw.githubusercontent.com/kubernetes-sigs/agent-sandbox/main/examples/aio-sandbox/README.md) |
| GPU compute | Not supported | [source](https://github.com/kubernetes-sigs/agent-sandbox) |
| Live-state (memory) snapshots | Partially supported | "preserve the exact state of a session-including filesystem changes and memory state" [source](https://raw.githubusercontent.com/kubernetes-sigs/agent-sandbox/main/site/content/docs/sandbox/snapshots/_index.md) |
| Multi-region | Not supported | [source](https://github.com/kubernetes-sigs/agent-sandbox) |
| Object storage | Not supported | [source](https://github.com/kubernetes-sigs/agent-sandbox) |
| Persistent disk | Supported | "persistent workspace via `volumeClaimTemplates`" [source](https://raw.githubusercontent.com/kubernetes-sigs/agent-sandbox/main/examples/containarium-ssh-sandbox/README.md) |
| Sandbox templates / custom images | Supported | "template/pool manifests" [source](https://raw.githubusercontent.com/kubernetes-sigs/agent-sandbox/main/clients/integrations/openhands/README.md) |
| Scale to zero | Partially supported | "SandboxWarmPool` **down to zero**" [source](https://raw.githubusercontent.com/kubernetes-sigs/agent-sandbox/main/examples/keda-scale-to-zero/README.md) |
| Selectable isolation runtime | Supported | "via `RuntimeClass`" [source](https://raw.githubusercontent.com/kubernetes-sigs/agent-sandbox/main/README.md) |
| Snapshots / forking | Partially supported | "A GKE Autopilot cluster with a gVisor node pool and necessary CRDs applied." [source](https://raw.githubusercontent.com/kubernetes-sigs/agent-sandbox/main/site/content/docs/sandbox/snapshots/_index.md) |

### Data

| Capability | Status | Evidence |
| --- | --- | --- |
| Database branching | Not supported | [source](https://github.com/kubernetes-sigs/agent-sandbox) |
| Ephemeral instant DB (no-signup) | Not supported | [source](https://github.com/kubernetes-sigs/agent-sandbox) |
| First-party database | Not supported | [source](https://github.com/kubernetes-sigs/agent-sandbox) |
| Vector search | Not supported | [source](https://github.com/kubernetes-sigs/agent-sandbox) |

### Platform & operations

| Capability | Status | Evidence |
| --- | --- | --- |
| Managed CI/CD runners | Not applicable | [source](https://raw.githubusercontent.com/kubernetes-sigs/agent-sandbox/main/README.md) |
| Built-in observability | Partially supported | "new observability metrics" [source](https://github.com/kubernetes-sigs/agent-sandbox/releases/tag/v1.0.5) |
| Preview environments | Not supported | [source](https://github.com/kubernetes-sigs/agent-sandbox) |
| Scheduled tasks | Not supported | [source](https://github.com/kubernetes-sigs/agent-sandbox) |
| Project template marketplace | Not supported | [source](https://github.com/kubernetes-sigs/agent-sandbox) |
| Durable workflows | Not supported | [source](https://github.com/kubernetes-sigs/agent-sandbox) |

## Agent readiness

### Read: 7 of 10 signals present

7/10 signals (5 full, 2 partial)

- Llms txt: fail — "https://agent-sandbox.sigs.k8s.io/llms.txt and /docs/llms.txt: 404."
- Llms full txt: fail — "https://agent-sandbox.sigs.k8s.io/llms-full.txt and /docs/llms-full.txt: 404."
- Robots AI policy: partial — "https://agent-sandbox.sigs.k8s.io/robots.txt: User-agent: *; no AI-specific policy."
- JSON LD: partial — "https://agent-sandbox.sigs.k8s.io/ : WebSite JSON-LD only; invalid zero-year dates in template, no Product offers."
- Sitemap: pass — "https://agent-sandbox.sigs.k8s.io/sitemap.xml: non-trivial URL set."
- Meta quality: pass — "https://agent-sandbox.sigs.k8s.io/ : descriptive title, description and OG metadata."
- Markdown negotiation: fail — "Accept: text/markdown returned text/html; /index.md 404. Raw GitHub Markdown exists but is not site content negotiation."
- Content efficiency: pass — "Homepage readable text / HTML bytes = 14.8%; script/style/tag stripped."
- Docs discoverable: pass — "https://agent-sandbox.sigs.k8s.io/ : first-class Docs navigation."
- Pricing machine readable: na — "No first-party hosted tier. Apache-2.0 license, infrastructure costs external."
- Anti bot: pass — "Homepage, docs and repository sources fetched without public challenge."

### Drive: 8 of 9 signals present

8/9 signals (7 full, 1 partial)

- Public API: pass — "https://raw.githubusercontent.com/kubernetes-sigs/agent-sandbox/main/docs/api.md : documented CRDs and sandboxd runtime contracts."
- Openapi spec: pass — "https://raw.githubusercontent.com/kubernetes-sigs/agent-sandbox/main/packages/sandboxd/spec/filesystem/v1/filesystem.yaml : fetched valid OpenAPI 3.0.3 document."
- MCP server: pass — "https://raw.githubusercontent.com/kubernetes-sigs/agent-sandbox/main/clients/integrations/mcp-server/README.md : documented provisioning/command/file tools."
- SDK packages: pass — "Official Go and Python SDK documentation captured; TypeScript release evidence."
- Auth docs: pass — "https://raw.githubusercontent.com/kubernetes-sigs/agent-sandbox/main/packages/sandboxd/USER_GUIDE.md : Kubernetes-authorized port forwarding, no daemon TLS/auth; explicit NetworkPolicy/mTLS proxy guidance; Python SDK gateway auth documented."
- Agent self serve creds: na — "No hosted account/API key issuance; operator supplies Kubernetes credentials."
- Webhooks: fail — "No documented product webhook delivery/signing found in reviewed API/runtime documentation."
- CLI tool: pass — "README documents official kubectl interface for CRD management."
- Error model: pass — "https://raw.githubusercontent.com/kubernetes-sigs/agent-sandbox/main/packages/sandboxd/spec/filesystem/v1/filesystem.yaml : Error schema; runtime guide specifies standard gRPC errors."
- Rate limit docs: na — "No vendor-operated endpoint or universal hosted rate limits; operator supplies ingress controls."
- Agent config: partial — "https://raw.githubusercontent.com/kubernetes-sigs/agent-sandbox/main/clients/integrations/mcp-server/skill/README.md : installable MCP skill; no second captured user-facing config surface."

## Coding harnesses

- Claude Code (Anthropic) — "Any MCP-speaking agent (Claude Code, Cursor, OpenCode) works with zero client library." [source](https://raw.githubusercontent.com/kubernetes-sigs/agent-sandbox/main/examples/containarium-ssh-sandbox/README.md)
- Cursor (Anysphere) — "Any MCP-speaking agent (Claude Code, Cursor, OpenCode) works with zero client library." [source](https://raw.githubusercontent.com/kubernetes-sigs/agent-sandbox/main/examples/containarium-ssh-sandbox/README.md)
- OpenCode (opencode) — "Any MCP-speaking agent (Claude Code, Cursor, OpenCode) works with zero client library." [source](https://raw.githubusercontent.com/kubernetes-sigs/agent-sandbox/main/examples/containarium-ssh-sandbox/README.md)
- Openhands — "A workspace backend for the [OpenHands agent SDK]" [source](https://raw.githubusercontent.com/kubernetes-sigs/agent-sandbox/main/clients/integrations/openhands/README.md)

## Compliance & regions

- Note: No product-held standards found in README, threat model or public documentation. Kubernetes affiliation and operator/cloud certifications are not product attestations.

## Open source

- Repository: https://github.com/kubernetes-sigs/agent-sandbox
- License: Apache-2.0
- Stars: 4190
- Forks: 549
- Self-host methods: kubernetes, helm
- Self-host dependencies: kubernetes

## Company & presence

- GitHub: https://github.com/kubernetes-sigs/agent-sandbox
- Documentation: https://agent-sandbox.sigs.k8s.io/docs/

## Nearby in the atlas

- [Agent Safehouse](/products/agent-safehouse.md)
- [Agent Substrate](/products/agent-substrate.md)
- [Agent37](/products/agent37.md)
- [AgentNest](/products/agentnest.md)
- [Anthropic Sandbox Runtime (srt)](/products/sandbox-runtime.md)
- [AWS Lambda MicroVMs](/products/lambda-microvms.md)

## Method

Facts come from the product's own public pages. Each claim carries its evidence: a quote and the page it came from. We count capabilities rather than grade products, and "Not assessed" means we have not checked, never that the product lacks it.