# OpenSandbox

Secure, Fast, and Extensible Sandbox runtime for AI agents.

Source: https://wheredoirunthis.com/products/opensandbox · JSON: https://wheredoirunthis.com/api/products/opensandbox · Read on 2026-10-12

## At a glance

- Type: Sandbox
- Kind: Open source tool
- Isolation: Container
- Free tier: Not documented
- Starting price: Not disclosed
- GPU: Yes
- Regions: Not disclosed
- Coverage: 23 of 61 assessed capabilities supported
- Agent readiness: read 5 of 10 signals, drive 9 of 10 signals

## Links

- Homepage: https://open-sandbox.ai/
- Docs: https://open-sandbox.ai/getting-started/
- Repository: https://github.com/opensandbox-group/OpenSandbox

## Runtime

- **GPU & accelerators**: Yes — "Create containers with CPU, memory, GPU, platform, capability, AppArmor, seccomp, PID, and secure-runtime settings." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/architecture/index.md) (confidence: high)
- **BYOC (Bring your own cloud)**: na — "Self-host-only; no managed BYOC tier." [source](https://github.com/opensandbox-group/OpenSandbox) (confidence: high)
- **Secrets management**: Environment injection plus optional sidecar Credential Vault on-the-wire injection; template-backed FastSandbox has no sandbox-side Vault. [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/guides/credential-vault.md) (confidence: high)
- **Storage options**: Host paths, Docker named volumes/PVCs, Kubernetes PVCs and Alibaba OSSFS mounts; snapshots/golden images use operator registries/object storage. [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/architecture/index.md) (confidence: high)
- **Supported workloads**: untrusted-agent-code, shell-command-execution, code-interpreter, browser-automation, desktop-computer-use, coding-agent-environments, agent-evaluation, rl-training [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/examples/index.md) (confidence: high)
- **Persistence**: Backend-dependent: host bind mounts, Docker named volumes, Kubernetes PVCs and OSSFS mounts; snapshots persist separately. [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/architecture/index.md) (confidence: high)
- **Data jurisdiction**: na — "Operator chooses host placement; no first-party hosting jurisdiction." [source](https://github.com/opensandbox-group/OpenSandbox) (confidence: high)
- **Resource limits & quotas**: Creation timeout defaults to 10 minutes in high-level SDKs; configurable/null manual cleanup for image/snapshot creation. Template creation requires TTL. Optional creation-time timeout ceiling does not cap renewals or total lifetime. CPU/memory/GPU limits, cluster admission quotas and pool acquisition/create-wait deadlines depend on operator/backend. [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/sdks/index.md) (confidence: high)
- **SDK languages**: python, javascript, typescript, kotlin, java, go, csharp [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/sdks/index.md) (confidence: high)
- **Network & egress controls**: Per-sandbox DNS rules plus opt-in dns+nft default-deny network enforcement, operator overlays and runtime policy changes. [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/architecture/network/egress.md) (confidence: high)
- **Snapshots & forks**: Docker image snapshots; Kubernetes container rootfs OCI snapshots; FastSandbox reusable checkpoints with microVM device/vCPU/memory state. [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/architecture/fast-sandbox/checkpoints.md) (confidence: high)
- **Deployment methods**: http-api, sdk, cli, mcp, docker, kubernetes, helm [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/architecture/index.md) (confidence: high)
- **Isolation**: Container — "runc (default): Process-level cgroups." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/guides/secure-container.md) (confidence: high)

## Capabilities

### AI & agents

| Capability | Status | Evidence |
| --- | --- | --- |
| Agent skills | Supported | "The CLI ships with built-in OpenSandbox skills for coding agents and agent-oriented tools." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/cli/README.md) |
| AI app builder | Not supported | "Scan assessment: no advertised First-party prompt-to-app generation/publishing; agent execution infrastructure is not an app builder." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/architecture/index.md) |
| Autonomous QA agent | Not supported | "Scan assessment: no advertised First-party autonomous QA agent. Playwright/browser examples provide execution tools, not an autonomous testing product." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/architecture/index.md) |
| Built-in coding agent | Not supported | "Scan assessment: no advertised First-party coding agent; the project documents third-party agent integration examples instead." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/architecture/index.md) |
| BYOK for LLMs | Supported | "Auth is passed via ANTHROPIC_AUTH_TOKEN, and you can override endpoint/model with ANTHROPIC_BASE_URL / ANTHROPIC_MODEL." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/examples/claude-code.md) |
| Credential-injection proxy | Supported | "Credential Vault: Secrets stay in the sidecar; credentials are injected into matching outbound requests." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/architecture/network/egress.md) |
| LLM gateway | Not supported | "Scan assessment: no advertised Native multi-provider LLM routing/gateway; Credential Vault injects keys into outbound requests but does not provide model routing." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/architecture/index.md) |
| MCP client | Not supported | "Scan assessment: no advertised First-party MCP client consuming external MCP tools; the documented MCP component is a control server." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/architecture/index.md) |
| MCP-server hosting | Not supported | "Scan assessment: no advertised Advertised customer MCP-server workload hosting. A generic container runtime and the first-party MCP control server do not establish this specific capability." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/architecture/index.md) |
| MCP server | Supported | "OpenSandbox MCP Server exposes the OpenSandbox Python SDK as MCP tools for Claude Code, Cursor, and other MCP-capable clients." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/sdks/mcp.md) |
| Model inference API (first-party) | Not supported | "Scan assessment: no advertised First-party hosted model inference service/catalogue. BYO external model keys do not establish this." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/architecture/index.md) |
| Preinstalled coding agent | Partially supported | "The script installs the Claude CLI (npm i -g @anthropic-ai/claude-code@latest) at runtime (Node.js is already in the code-interpreter image), then sends a simple request." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/examples/claude-code.md) |

### Networking & delivery

| Capability | Status | Evidence |
| --- | --- | --- |
| Automatic HTTPS | Not supported | "The ingress speaks cleartext HTTP/1.1 and never terminates TLS. Put an L7 proxy in front of it." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/architecture/network/ingress.md) |
| Custom domains | Partially supported | "Wildcard mode requires a wildcard address (e.g. *.sandbox.example.com); header and uri modes take a plain host (e.g. sandbox.example.com)." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/guides/secure-access.md) |
| Direct public IPv6 | Not supported | "Scan assessment: no advertised Stable per-instance public IPv6 for raw TCP/UDP. IPv6 parsing/egress options do not supply public addressing." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/architecture/index.md) |
| Edge KV store | Not supported | "Scan assessment: no advertised A platform-provided globally replicated edge KV store." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/architecture/index.md) |
| Egress controls | Supported | "Network enforcement (dns+nft): Strict default-deny at the packet layer, fed by DNS-resolved addresses with bounded leases." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/architecture/network/egress.md) |
| Email send / receive | Not supported | "Scan assessment: no advertised Native email sending/receiving service; running an email client in a sandbox is not this feature." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/architecture/index.md) |
| Public preview URLs | Supported | "Public URL to access the service from outside the sandbox." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/specs/sandbox-lifecycle.yml) |
| Private networking | Partially supported | "Support network modes host, bridge, and custom user-defined networks." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/architecture/index.md) |
| Built-in reverse proxy | Supported | "The ingress gateway is the front door for sandbox traffic on Kubernetes: one reverse proxy standing in front of every sandbox, with no per-sandbox configuration." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/architecture/network/ingress.md) |

### Organisation & security

| Capability | Status | Evidence |
| --- | --- | --- |
| Built-in auth | Partially supported | "When enabled on a sandbox, the ingress gateway (and the server proxy path) require every caller to prove they are authorized before HTTP or WebSocket traffic reaches the sandbox." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/guides/secure-access.md) |
| BYOC | Not applicable | "Applicability assessment: OpenSandbox is a self-host-only tool with no first-party hosted deployment plane or region catalogue." [source](https://github.com/opensandbox-group/OpenSandbox) |
| Deploy into customers' VPCs | Not applicable | "Applicability assessment: OpenSandbox is a self-host-only tool with no first-party hosted deployment plane or region catalogue." [source](https://github.com/opensandbox-group/OpenSandbox) |
| Secrets management | Supported | "Environment variables to inject into the sandbox runtime." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/specs/sandbox-lifecycle.yml) |
| Self-host / OSS core | Supported | "Run AI agents in sandboxes on your own infrastructure." [source](https://github.com/opensandbox-group/OpenSandbox) |
| Sharing | Supported | "Use signed URLs to hand out shareable, time-limited endpoints without exposing the static token." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/guides/secure-access.md) |
| SSO / SAML | Not supported | "Scan assessment: no advertised SSO/SAML identity-provider integration; static API keys, tenant routing and signed URLs do not establish this." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/architecture/index.md) |
| Teams | Not supported | "Scan assessment: no advertised Collaborative team accounts, roles and billing. Tenant API-key scoping alone is not a team-management product." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/architecture/index.md) |
| Workload identity | Not supported | "Scan assessment: no advertised Per-workload OIDC/SPIFFE/cloud-federated short-lived identity. Static keys and credential-injection proxying are separate capabilities." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/architecture/index.md) |

### Developer access

| Capability | Status | Evidence |
| --- | --- | --- |
| CLI | Supported | "Use the CLI to manage sandboxes, run commands, and work with files from a terminal." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/sdks/index.md) |
| E2B-compatible API | Not supported | "Scan assessment: no advertised Documented drop-in E2B client/API compatibility. OpenSandbox publishes its own lifecycle and execd contracts; generic sandbox similarity is not compatibility." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/architecture/index.md) |
| Filesystem API | Supported | "Create, connect, renew, pause/resume, kill; Commands, files, resource metrics." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/sdks/index.md) |
| Git deploy | Not supported | "Scan assessment: no advertised Git push/branch-triggered deployment; generic git commands inside a sandbox do not establish this." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/architecture/index.md) |
| HTTP data API | Not supported | "Scan assessment: no advertised Native HTTP database/data-query API; the public sandbox lifecycle/file APIs are not a database query surface." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/architecture/index.md) |
| OpenAPI spec | Supported | "OpenAPI source" [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/api/index.md) |
| Private container registry | Not supported | "Scan assessment: no advertised Platform-hosted private image registry. Per-request credentials for external private image pulls do not provide a registry." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/architecture/index.md) |
| Public API | Supported | "Control plane: creation, inspection, deletion, expiration, endpoint resolution, pause/resume, snapshots, templates, and lifecycle network-policy operations." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/api/implementation-compatibility.md) |
| SDK | Supported | "OpenSandbox provides five sandbox SDKs for lifecycle management, command execution, file operations, and resource metrics." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/sdks/index.md) |
| SSH access | Not supported | "Scan assessment: no advertised First-party SSH access. Documented command APIs and PTY/WebSocket extensions are not SSH." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/architecture/index.md) |

### Compute & storage

| Capability | Status | Evidence |
| --- | --- | --- |
| Cloud-init / ignition config | Not supported | "Scan assessment: no advertised Cloud-init/ignition boot-user-data interface. Entrypoint/env/preStart hooks are not the same cloud-init interface." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/architecture/index.md) |
| Desktop / computer-use sandbox | Supported | "Launch Xvfb + x11vnc + fluxbox in OpenSandbox to provide a VNC-accessible desktop environment." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/examples/desktop.md) |
| GPU compute | Supported | "Resource limits and GPU translation to Kubernetes extended resources." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/architecture/index.md) |
| Live-state (memory) snapshots | Supported | "Sandbox records checkpoint microVM runtime state (rootfs + VM state + memory) for template-backed sandboxes." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/architecture/fast-sandbox/checkpoints.md) |
| Multi-region | Not applicable | "Applicability assessment: OpenSandbox is a self-host-only tool with no first-party hosted deployment plane or region catalogue." [source](https://github.com/opensandbox-group/OpenSandbox) |
| Object storage | Not supported | "Scan assessment: no advertised Managed object-store buckets provided to user workloads. OSSFS mounts consume an external OSS bucket and FastSandbox S3 stores runtime artifacts; neither provides a workload object-storage service." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/architecture/index.md) |
| Persistent disk | Supported | "pvc: platform-managed named storage. Docker maps this to a Docker named volume; Kubernetes maps it to a PersistentVolumeClaim." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/architecture/index.md) |
| Sandbox templates / custom images | Supported | "Output is content-addressed: the build publishes artifacts to the store and records a manifest reference plus artifact digest in the CR status — builds are immutable and verifiable, never mutated in place." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/architecture/fast-sandbox/templates.md) |
| Scale to zero | Partially supported | "Pausing a sandbox writes a complete checkpoint and releases its Fastlet, so a paused sandbox has zero compute footprint." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/architecture/fast-sandbox/checkpoints.md) |
| Selectable isolation runtime | Partially supported | "To offer multiple profiles in one Kubernetes cluster, deploy separately addressed Server releases." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/guides/secure-container.md) |
| Snapshots / forking | Supported | "Snapshots are the public form of the same machinery: they publish a running sandbox's state as a reusable artifact set that new sandboxes can be created from." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/architecture/fast-sandbox/checkpoints.md) |

### Data

| Capability | Status | Evidence |
| --- | --- | --- |
| Database branching | Not supported | "Scan assessment: no advertised Native copy-on-write database branching; runtime snapshots are a different capability." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/architecture/index.md) |
| Ephemeral instant DB (no-signup) | Not supported | "Scan assessment: no advertised No-signup ephemeral database provisioning; disposable compute sandboxes are not databases." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/architecture/index.md) |
| First-party database | Not supported | "Scan assessment: no advertised Provisioned first-party workload database. SQLite/PostgreSQL server-metadata stores and Redis pools are self-host dependencies." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/architecture/index.md) |
| Vector search | Not supported | "Scan assessment: no advertised First-party vector indexing/search service; running user code that queries an external vector database is not sufficient." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/architecture/index.md) |

### Platform & operations

| Capability | Status | Evidence |
| --- | --- | --- |
| Managed CI/CD runners | Not supported | "Scan assessment: no advertised Platform-managed drop-in CI runner fleet. User-programmed sandbox execution is not a managed runner service." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/architecture/index.md) |
| Built-in observability | Supported | "Python and Kotlin/Java expose remote logs/events on both Sandbox and SandboxManager." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/sdks/index.md) |
| Preview environments | Not supported | "Scan assessment: no advertised Automatic per-PR/branch environments with teardown. GetEndpoint shareable URLs and sandbox creation alone do not establish this." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/architecture/index.md) |
| Scheduled tasks | Supported | "Standard five-field cron expression or descriptor such as @hourly or @every 30s." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/guides/lifecycle-hooks.md) |
| Project template marketplace | Not supported | "Scan assessment: no advertised Project/app starter-template marketplace. FastSandbox compute golden images are sandbox-templates instead." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/architecture/index.md) |
| Durable workflows | Not supported | "Scan assessment: no advertised Durable workflow execution. Periodic lifecycle hooks run only inside live sandboxes and do not establish persisted workflow recovery." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/architecture/index.md) |

## Agent readiness

### Read: 5 of 10 signals present

5/10 signals (4 full, 1 partial)

- Llms txt: fail — "https://open-sandbox.ai/llms.txt: HTTP 404; no llms.txt source found in the repository documentation paths."
- Llms full txt: fail — "https://open-sandbox.ai/llms-full.txt: HTTP 404."
- Robots AI policy: partial — "https://open-sandbox.ai/robots.txt: HTTP 404, therefore default-allow, not explicit AI allow."
- JSON LD: fail — "Homepage HTML contains no application/ld+json script."
- Sitemap: fail — "https://open-sandbox.ai/sitemap.xml: HTTP 404; absent robots.txt supplies no alternate sitemap pointer."
- Meta quality: pass — "Homepage title, description and og:title/og:description describe OpenSandbox Documentation and Universal Sandbox Infrastructure for AI Applications."
- Markdown negotiation: fail — "Accept: text/markdown on the homepage still returns text/html; /getting-started/index.md returns 404. Public raw GitHub Markdown is available but is not website content negotiation."
- Content efficiency: pass — "Homepage has 1,996 UTF-8 bytes of visible text / 31,015 HTML bytes = 6.44%, above the rubric’s 5% threshold."
- Docs discoverable: pass — "Server-rendered homepage navigation links Getting Started, Architecture, Guides, SDKs, API and Deployment."
- Pricing machine readable: na — "Self-host-only Apache-2.0 project has no first-party hosted pricing tiers."
- Anti bot: pass — "Homepage, raw source/docs and SVG assets were fetched without a public-content challenge."

### Drive: 9 of 10 signals present

9/10 signals (8 full, 1 partial)

- Public API: pass — "https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/api/index.md links substantive lifecycle, execd, egress and diagnostics API documentation."
- Openapi spec: pass — "Fetched lifecycle (OpenAPI 3.1.0), execd and egress source specifications from https://github.com/opensandbox-group/OpenSandbox/tree/main/specs."
- MCP server: pass — "https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/sdks/mcp.md documents pip install opensandbox-mcp and first-party lifecycle/command/file tools; /.well-known/mcp being 404 does not remove credit."
- SDK packages: pass — "https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/sdks/index.md documents five official SDK families with package installation commands."
- Auth docs: pass — "https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/guides/multi-tenancy.md documents tenant API-key authentication and scoped access; secure-access documents endpoint tokens."
- Agent self serve creds: na — "There is no first-party hosted account/key-issuance service. Self-host operators configure API keys; no live credential acquisition was attempted."
- Webhooks: fail — "No documented signed outbound webhook integration found in the captured architecture/API/SDK surface; in-sandbox hooks are not webhooks."
- CLI tool: pass — "https://github.com/opensandbox-group/OpenSandbox/blob/main/cli/README.md documents official osb/opensandbox-cli, machine-readable output and diagnostic commands."
- Error model: pass — "https://github.com/opensandbox-group/OpenSandbox/blob/main/specs/sandbox-lifecycle.yml defines ErrorResponse required code/message fields, HTTP categories and request IDs."
- Rate limit docs: partial — "Lifecycle API documents 429 pool-capacity timeout plus Retry-After; server configuration documents Kubernetes read/write QPS knobs. No caller-facing rate-limit/quota schedule is documented."
- Agent config: pass — "Repository AGENTS.md, troubleshoot-sandbox/SKILL.md and osb skill listings/install targets are multiple documented agent-configuration surfaces."

## Coding harnesses

- Claude Code (Anthropic) — "Access Claude via the `claude-cli` npm package in OpenSandbox." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/examples/claude-code.md)
- Codex CLI (OpenAI) — "Use the official @openai/codex npm package to call OpenAI/Codex-like models in OpenSandbox." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/examples/codex-cli.md)
- Gemini CLI (Google) — "Call Google Gemini via the @google/gemini-cli npm package in OpenSandbox." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/examples/gemini-cli.md)
- OpenCode (opencode) — "Run the OpenCode coding agent inside an OpenSandbox container." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/examples/opencode.md)
- Qwen Code (Alibaba (Qwen)) — "Run Qwen Code inside an OpenSandbox container through an OpenAI-compatible endpoint." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/examples/qwen-code.md)
- GitHub Copilot (GitHub) — "Run the official GitHub Copilot CLI inside an OpenSandbox container." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/examples/github-copilot-cli-sandbox.md)
- OpenClaw (Peter Steinberger) — "Launch an OpenClaw Gateway inside an OpenSandbox instance and expose its HTTP endpoint." [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/examples/openclaw.md)
- Kimi cli — "Run Kimi CLI (Moonshot AI) in a sandbox" [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/docs/examples/index.md)
- Cursor (Anysphere) — "| `cursor` | `./.cursor/rules/` or `~/.cursor/rules/` |" [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/cli/README.md)
- Windsurf (Codeium) — "| `windsurf` | `./.windsurfrules` or `~/.windsurfrules` |" [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/cli/README.md)
- Cline (Cline) — "| `cline` | `./.clinerules` or `~/.clinerules` |" [source](https://github.com/opensandbox-group/OpenSandbox/blob/main/cli/README.md)

## Compliance & regions

- Note: Checked landing/README, SECURITY.md, license, governance and architecture/security guides. No named held compliance certification/attestation found. CNCF Landscape and OpenSSF Best Practices badges are project ecosystem/process signals, not SOC 2/ISO/HIPAA/GDPR attestations.

## Open source

- Repository: https://github.com/opensandbox-group/OpenSandbox
- License: Apache-2.0
- Stars: 15803
- Forks: 1455
- Self-host methods: docker, kubernetes, helm, source-build, package-manager
- Self-host dependencies: docker, python

## Company & presence

- GitHub: https://github.com/opensandbox-group/OpenSandbox
- Documentation: https://open-sandbox.ai/
- Discord: https://discord.gg/g7FuPs8YeD
- DingTalk: https://qr.dingtalk.com/action/joingroup?code=v1,k1,A4Bgl5q1I1eNU/r33D18YFNrMY108aFF38V+r19RJOM=&_dt_no_comment=1&origin=11

## Nearby in the atlas

- [Agent Safehouse](/products/agent-safehouse.md)
- [Agent Sandbox](/products/agent-sandbox.md)
- [Agent Substrate](/products/agent-substrate.md)
- [Agent37](/products/agent37.md)
- [AgentNest](/products/agentnest.md)
- [Anthropic Sandbox Runtime (srt)](/products/sandbox-runtime.md)

## Method

Facts come from the product's own public pages. Each claim carries its evidence: a quote and the page it came from. We count capabilities rather than grade products, and "Not assessed" means we have not checked, never that the product lacks it.