Code & AI agent sandboxes: read the guide
Scanned 14 Oct 2026 · Schema v5 · features v21
- Licence
- Apache-2.0
Self-hosted; you pay for the infrastructure.
- Free tier
- Free to run
- Isolation
- Virtual machine
hypervisor, or nothing at all
- Regions
- —
Not disclosed on the public surface.
- Capabilities
- 18 / 61
5 partial · 35 fail · 0 not assessed
- Agent readiness
- 7/10 · 6/10
read · drive, pre-login surface
Advertised for
AI agent sandboxes · Pr preview environments · Dev environments · General linux VMS
Built for
Developers, then technical
- · CLI-first install/create/exec/shell workflow on operator-owned hardware.
- · Own-kernel VMs, KVM/HVF, qcow2 and snapshots are technical concepts.
- · Linux and Apple Silicon macOS self-hosting; not a no-code managed app builder.
01 Website design Desktop public website · assessed 14 Oct 2026
Complete assessment.
Dark developer-facing website with restrained orange accents, a terminal-led two-column landing page and dense, three-column documentation. Landing and docs captured; hosted pricing not applicable.
- Retro-computing
- Landing page: captured
- Pricing: not applicable
- Docs: captured
02 Runtime Each fact carries its source; dots show confidence. Open a row for the evidence.
Isolation & lifecycle
Resources & limits
Access
Network & secrets
Placement & use
03 Capabilities 18 pass · 5 partial · 35 fail · 61 of 61 assessed
- Supported — Documented on the public surface and verified.
- Partially supported — Exists with caveats: gated, thin, or enterprise-only.
- Not supported — Checked and not offered.
- Not assessed — Scanned before this capability was tracked. Not a lack.
Compute & storage 6/10
Networking & delivery 5/9
Developer access 3/10
AI & agents 0/12
Data 0/4
Platform & operations 0/6
Organisation & security 4/7
Proposed, not verified
Capabilities the scan saw but the registry does not track yet. A key is admitted only once two distinct products exhibit it. These are not scored.
- Browser web-shell (zero-install xterm.js PTY over WebSocket via `bhatti share`)web-shell
“Only one share link is active at a time per sandbox. The page opens an xterm.js terminal connected via WebSocket.” bhatti.sh
- Volume backup/restore to S3volume-backup
“Volume backups to S3-compatible storage. Requires a backup block in the server config.” bhatti.sh
04 Agent readiness Pre-login surface · counts, not a grade
Can an agent read it?
parse-ability · docs, metadata, machine-readable surfaces
7/10
5 full · 2 partial · 70% of applicable checks
- llms.txtSupported
- llms-full.txtSupported
- robots.txt AI policyPartially supported
- JSON-LDNot supported
- SitemapNot supported
- Meta tagsSupported
- Markdown negotiationNot supported
- Content efficiencySupported
- Docs discoverableSupported
- Machine-readable pricingNot applicable
- No anti-bot wallPartially supported
Can an agent drive it?
act-ability · APIs, SDKs, MCP, credentials, webhooks
6/10
4 full · 2 partial · 60% of applicable checks
- Public APISupported
- OpenAPI specNot supported
- MCP serverNot supported
- SDK packagesNot supported
- Auth documentedSupported
- Self-serve credentialsNot applicable
- WebhooksNot supported
- CLI toolSupported
- Error modelSupported
- Rate limits documentedPartially supported
- Agent config filesPartially supported
05 Coding harnesses Which agents and IDEs are documented to run here
Advertised integrations 0
The public surface names no coding harness as supported or documented-to-run-here.
Plausible compatibility 0
Derived, not stored: the product passes SSH access, so any CLI coding agent is installable inside it. This is plausible compatibility, not a supported integration.
No general shell access documented, so nothing is derived. Absence is not unsupported.
06 Compliance & regions Standards held, with ordinal rigor; never a score
Certifications held 0
No attestations found on the public surface. Empty means nothing is advertised, after checking, not that nothing was checked.
Regions —
No region list captured.
07 Open source Apache-2.0 · fetched by machine, not quoted from marketing
Licence & repository
- Licence
- Apache-2.0OSI
- Primary language
- Go
- Stars
- 268
- Forks
- 10
- Created
- 11 Mar 2026
- Archived
- No
Activity
- Last commit
- 6 Oct 2026
- Latest release
- v2.5.4 · 6 Oct 2026
- Issues open / closed
- 0 / 13 · 100% closed
Eight recent release entries span October 4–6, 2026, including v2.4 prerelease and v2.5 patches; observation, not a health grade.
Fetched via gh on 14 Oct 2026.
Self-hosting
- Methods
- binarysource-build
- You operate
- —
Self-host only: Apache-2.0 software plus operator infrastructure, not a hosted free tier. Runtime bundle or Go source build; Linux x86_64/ARM64 with KVM or Apple Silicon macOS with HVF. krucible/libkrun, bhatti-vmm, bhatti-netd and guest kernel are bundled. v2 uses qcow2, no btrfs requirement. v1 snapshots/on-disk state do not migrate: install v2 fresh. Default local owner-only Unix socket; explicitly configure TLS for remote API. Single host, no cluster management. Back up state.db and age.key; memory snapshots contain plaintext secrets. Optional S3-compatible backup backend.
Documentation signals 7/8
- SupportedQuickstart
- SupportedAPI reference
- SupportedSelf-host guide
- SupportedChangelog
- Not supportedOpenAPI
- Supportedllms.txt
- SupportedExamples
- SupportedArchitecture doc
08 Company & presence Facts only, not scored
Company
- Headquarters
- Not disclosed
- Founded
- 2026
- Team size
- Not disclosed
- Hiring
- not-disclosed
Notable people
- Sahil Shubham (author)
Activity
- Last release
- v2.5.4 (2026-10-06) github.com
- Last blog post
- —
Presence 3
Links found on the public surface scanned; not an exhaustive search.
09 Sources & method How this entry was produced
Public surface only
Everything here was read from bhatti.sh's unauthenticated pages, docs, pricing and repository on 14 Oct 2026. Nothing behind a login was used.
Statuses, not scores
Capabilities are pass, partial or fail against a written rubric (features v21). “Not assessed” means the scan predates the key.
Confidence is separate
Each fact carries its own confidence. Low-confidence facts are shown, never hidden, so you can weigh them.
- Schema
- scan v5
- Features registry
- v21
- Keys tracked today
- 61
- Assessed on this entry
- 61
Nearby in the atlas
All Sandbox products →Agent SafehouseSandbox · Not disclosedOpen source tool
Agent SandboxSandbox · Kata / gVisorOpen source tool
Agent SubstrateSandbox · Kata / gVisorOpen source tool
Agent37Sandbox · Kata / gVisorHosted
AgentNestSandbox · ContainerOpen source tool
Anthropic Sandbox Runtime (srt)Sandbox · ContainerOpen source tool