# sandboxd (formerly sandboxed)

Open-source, self-hosted AI app builder.

Source: https://wheredoirunthis.com/products/sandboxed · JSON: https://wheredoirunthis.com/api/products/sandboxed · Read on 2026-10-12

## At a glance

- Type: Sandbox
- Kind: Open source tool
- Isolation: Container
- Free tier: Not documented
- Starting price: Not disclosed
- GPU: Not documented
- Regions: Not disclosed
- Coverage: 17 of 61 assessed capabilities supported
- Agent readiness: read 8 of 10 signals, drive 5 of 10 signals

## Links

- Homepage: https://sandboxd.io/
- Docs: https://sandboxd.io/what-is-sandboxd
- Repository: https://github.com/tastyeffectco/sandboxd

## Runtime

- **GPU & accelerators**: Not documented [source](https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/README.md) (confidence: low)
- **BYOC (Bring your own cloud)**: na [source](https://sandboxd.io/managed)
- **Secrets management**: App secrets encrypted at rest and write-only. Model credentials stay in control plane and are injected by auth proxy; sandbox receives dummy credentials. Disabling proxy enables legacy credential-dir mount. [source](https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/ARCHITECTURE.md)
- **Storage options**: Persistent per-sandbox workspace directory; SQLite WAL control-plane state. User apps may bring embedded SQLite; no managed Postgres/Redis/object-store provisioner. [source](https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/ARCHITECTURE.md)
- **Supported workloads**: AI app-builder backends and prompt-generated apps, Per-user or per-branch developer sandboxes, Ready-made OSS apps, Node/Python web servers and background workers, Headless Claude Code/OpenCode tasks [source](https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/README.md)
- **Persistence**: Workspace bind mounts and SQLite state survive stop and reboot; root filesystem read-only, /tmp ephemeral. [source](https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/ARCHITECTURE.md)
- **Data jurisdiction**: na [source](https://sandboxd.io/cloud)
- **Resource limits & quotas**: Hard memory/PID/fd limits; optional cgroup memory.high; idle reaper default 2100 seconds plus memory-pressure reaper. No per-workspace disk quota; single host and one public preview endpoint per sandbox. Configuration says /v1 requires session/bearer key by default, despite stale contrary AGENTS/OpenAPI introduction. [source](https://sandboxd.io/reference/configuration)
- **SDK languages**: Not documented [source](https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/README.md)
- **Network & egress controls**: Default egress is open/unlogged. nftables subsystem exists but is compiled off in self-hosted Compose build; domain-level per-sandbox allowlist is roadmap. Operator firewall/proxy required. [source](https://sandboxd.io/security)
- **Snapshots & forks**: Workspace snapshots, app fork/restore, and automatic per-task Git checkpoints; directory-storage backend still experimental. No memory/process-state restoration claimed. [source](https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/ARCHITECTURE.md) (confidence: high)
- **Deployment methods**: api, dashboard, template, container-image [source](https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/README.md)
- **Isolation**: Container — "The boundary is the sandbox container: a Linux container, not a VM." [source](https://sandboxd.io/security) (confidence: high)

## Capabilities

### AI & agents

| Capability | Status | Evidence |
| --- | --- | --- |
| Agent skills | Not supported | "Platform prompt ... Per-app AGENTS.md" [source](https://sandboxd.io/guides/agents) |
| AI app builder | Supported | "Prompt it and a coding agent builds real apps in isolated sandboxes on your server" [source](https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/README.md) |
| Autonomous QA agent | Not supported | "No autonomous-qa-agent capability advertised in reviewed README, Architecture, Configuration, API and Security surfaces." [source](https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/README.md) |
| Built-in coding agent | Not supported | "Both CLIs (claude, opencode) are pre-installed" [source](https://sandboxd.io/guides/agents) |
| BYOK for LLMs | Supported | "connect Claude Code by API key" [source](https://sandboxd.io/guides/agents) |
| Credential-injection proxy | Supported | "No long-lived credential ever crosses into a sandbox." [source](https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/docs/agent-auth.md) |
| LLM gateway | Supported | "credential-injecting auth proxy" [source](https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/docs/agent-auth.md) |
| MCP client | Not supported | "No mcp-client capability advertised in reviewed README, Architecture, Configuration, API and Security surfaces." [source](https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/README.md) |
| MCP-server hosting | Not supported | "No mcp-hosting capability advertised in reviewed README, Architecture, Configuration, API and Security surfaces." [source](https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/README.md) |
| MCP server | Not supported | "No mcp-server capability advertised in reviewed README, Architecture, Configuration, API and Security surfaces." [source](https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/README.md) |
| Model inference API (first-party) | Not supported | "Agents reach their model provider through a credential-injecting proxy" [source](https://sandboxd.io/guides/agents) |
| Preinstalled coding agent | Supported | "Both CLIs (claude, opencode) are pre-installed in every sandbox" [source](https://sandboxd.io/guides/agents) |

### Networking & delivery

| Capability | Status | Evidence |
| --- | --- | --- |
| Automatic HTTPS | Partially supported | "Production TLS" [source](https://sandboxd.io/guides/production-tls) |
| Custom domains | Partially supported | "BASE_DOMAIN" [source](https://sandboxd.io/guides/production-tls) |
| Direct public IPv6 | Not applicable | "No direct-ipv6 capability advertised in reviewed README, Architecture, Configuration, API and Security surfaces." [source](https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/README.md) |
| Edge KV store | Not applicable | "No edge-kv capability advertised in reviewed README, Architecture, Configuration, API and Security surfaces." [source](https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/README.md) |
| Egress controls | Partially supported | "the nftables subsystem exists but is compiled off in the self-hosted build" [source](https://sandboxd.io/security) |
| Email send / receive | Not supported | "No email-send-receive capability advertised in reviewed README, Architecture, Configuration, API and Security surfaces." [source](https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/README.md) |
| Public preview URLs | Supported | "each live at a preview URL" [source](https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/README.md) |
| Private networking | Partially supported | "Each sandbox gets its own Docker bridge network" [source](https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/ARCHITECTURE.md) |
| Built-in reverse proxy | Supported | "Traefik — edge router; publishes a preview URL per running sandbox." [source](https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/ARCHITECTURE.md) |

### Organisation & security

| Capability | Status | Evidence |
| --- | --- | --- |
| Built-in auth | Supported | "Console login" [source](https://sandboxd.io/reference/configuration) |
| BYOC | Not applicable | "It’s your server (BYOC)." [source](https://sandboxd.io/managed) |
| Deploy into customers' VPCs | Not applicable | "Your compute, your data, no lock-in." [source](https://sandboxd.io/managed) |
| Secrets management | Supported | "Secrets in DB are encrypted at rest; read APIs are write-only" [source](https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/ARCHITECTURE.md) |
| Self-host / OSS core | Supported | "MIT License" [source](https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/LICENSE) |
| Sharing | Supported | "a stable public HTTPS URL" [source](https://sandboxd.io/cloud) |
| SSO / SAML | Not supported | "No sso-saml capability advertised in reviewed README, Architecture, Configuration, API and Security surfaces." [source](https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/README.md) |
| Teams | Partially supported | "tenant-scoped by API token" [source](https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/README.md) |
| Workload identity | Not supported | "API auth (/v1)" [source](https://sandboxd.io/reference/configuration) |

### Developer access

| Capability | Status | Evidence |
| --- | --- | --- |
| CLI | Not supported | "curl -fsSL sandboxd.io/install \| bash" [source](https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/README.md) |
| E2B-compatible API | Not supported | "No e2b-compatible-api capability advertised in reviewed README, Architecture, Configuration, API and Security surfaces." [source](https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/README.md) |
| Filesystem API | Supported | "/v1/sandboxes/{id}/files" [source](https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/docs/openapi.yaml) |
| Git deploy | Partially supported | "Git: diff, commit, push" [source](https://sandboxd.io/guides/console) |
| HTTP data API | Not applicable | "No http-query-api capability advertised in reviewed README, Architecture, Configuration, API and Security surfaces." [source](https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/README.md) |
| OpenAPI spec | Supported | "openapi: 3.0.3" [source](https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/docs/openapi.yaml) |
| Private container registry | Not supported | "No private-registry capability advertised in reviewed README, Architecture, Configuration, API and Security surfaces." [source](https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/README.md) |
| Public API | Supported | "The public, tenant-scoped API for sandboxd" [source](https://sandboxd.io/reference/api) |
| SDK | Not supported | "API-first — everything is a /v1 call" [source](https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/README.md) |
| SSH access | Not supported | "/v1/sandboxes/{id}/terminal" [source](https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/docs/openapi.yaml) |

### Compute & storage

| Capability | Status | Evidence |
| --- | --- | --- |
| Cloud-init / ignition config | Not supported | "install in one command" [source](https://sandboxd.io/quickstart) |
| Desktop / computer-use sandbox | Not supported | "No desktop-sandbox capability advertised in reviewed README, Architecture, Configuration, API and Security surfaces." [source](https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/README.md) |
| GPU compute | Not supported | "No gpu capability advertised in reviewed README, Architecture, Configuration, API and Security surfaces." [source](https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/README.md) |
| Live-state (memory) snapshots | Not supported | "tar/copy the workspace" [source](https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/ARCHITECTURE.md) |
| Multi-region | Not applicable | "No multi-region capability advertised in reviewed README, Architecture, Configuration, API and Security surfaces." [source](https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/README.md) |
| Object storage | Not supported | "Per-sandbox workspace bind mount" [source](https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/ARCHITECTURE.md) |
| Persistent disk | Supported | "workspace bind mount; persisted state survives stop/reboot" [source](https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/ARCHITECTURE.md) |
| Sandbox templates / custom images | Supported | "Runtime preset + base image" [source](https://sandboxd.io/guides/images-stacks-presets) |
| Scale to zero | Partially supported | "IDLE_THRESHOLD_SECONDS ... 2100" [source](https://sandboxd.io/reference/configuration) |
| Selectable isolation runtime | Supported | "SANDBOXD_CONTAINER_RUNTIME=runsc" [source](https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/docs/gvisor.md) |
| Snapshots / forking | Partially supported | "Snapshots (EXPERIMENTAL, current backend)" [source](https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/ARCHITECTURE.md) |

### Data

| Capability | Status | Evidence |
| --- | --- | --- |
| Database branching | Not applicable | "No database-branching capability advertised in reviewed README, Architecture, Configuration, API and Security surfaces." [source](https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/README.md) |
| Ephemeral instant DB (no-signup) | Not applicable | "No ephemeral-instant-db capability advertised in reviewed README, Architecture, Configuration, API and Security surfaces." [source](https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/README.md) |
| First-party database | Not supported | "SQLite (WAL)" [source](https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/ARCHITECTURE.md) |
| Vector search | Not applicable | "No vector-search capability advertised in reviewed README, Architecture, Configuration, API and Security surfaces." [source](https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/README.md) |

### Platform & operations

| Capability | Status | Evidence |
| --- | --- | --- |
| Managed CI/CD runners | Not supported | "No managed-ci-runners capability advertised in reviewed README, Architecture, Configuration, API and Security surfaces." [source](https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/README.md) |
| Built-in observability | Partially supported | "OTEL_ENABLED" [source](https://sandboxd.io/reference/configuration) |
| Preview environments | Not supported | "No preview-environments capability advertised in reviewed README, Architecture, Configuration, API and Security surfaces." [source](https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/README.md) |
| Scheduled tasks | Not supported | "No scheduled-tasks capability advertised in reviewed README, Architecture, Configuration, API and Security surfaces." [source](https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/README.md) |
| Project template marketplace | Not supported | "No template-marketplace capability advertised in reviewed README, Architecture, Configuration, API and Security surfaces." [source](https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/README.md) |
| Durable workflows | Not supported | "No workflows-durable capability advertised in reviewed README, Architecture, Configuration, API and Security surfaces." [source](https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/README.md) |

## Agent readiness

### Read: 8 of 10 signals present

8/10 signals (8 full, 0 partial)

- Llms txt: pass — "https://sandboxd.io/llms.txt: substantive docs, API and ancillary-pricing pointers."
- Llms full txt: fail — "https://sandboxd.io/llms-full.txt returns 404 HTML; no modular full-text set advertised in llms.txt."
- Robots AI policy: pass — "https://sandboxd.io/robots.txt explicitly allows GPTBot, ClaudeBot, PerplexityBot and Google-Extended."
- JSON LD: pass — "Homepage SoftwareApplication JSON-LD includes name, description and zero-price MIT offer."
- Sitemap: pass — "https://sandboxd.io/sitemap.xml is substantive nontrivial XML, also linked in robots."
- Meta quality: pass — "Self-hosted, open-source AI app builder | sandboxd; descriptive meta and OG tags."
- Markdown negotiation: fail — "Accept: text/markdown still returns text/html; /.md returns 404 HTML."
- Content efficiency: pass — "Readable homepage text ~19.1% of 23635 HTML bytes after ignoring script/style; SSR content."
- Docs discoverable: pass — "Docs visible in header with direct /what-is-sandboxd URL; no JS needed."
- Pricing machine readable: na — "No first-party hosted compute tier. Ancillary Cloud/Managed prices are public HTML and linked in meta, not runtime pricing."
- Anti bot: pass — "curl successfully fetches public landing/docs/well-known without challenge. Initial urllib 403 recovered by curl and required sequential foxcrawl retry: statusCode 200, blocked false; one informational JS error."

### Drive: 5 of 10 signals present

5/10 signals (4 full, 1 partial)

- Public API: pass — "https://sandboxd.io/reference/api documents self-hosted tenant-scoped /v1 API."
- Openapi spec: pass — "https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/docs/openapi.yaml fetchable OpenAPI 3.0.3."
- MCP server: fail — "No documented Model Context Protocol control server; /.well-known/mcp 404 HTML."
- SDK packages: fail — "No official client SDK packages advertised in docs/repository."
- Auth docs: pass — "https://sandboxd.io/reference/configuration documents bearer/scoped key and session auth; docs/agent-auth.md covers provider OAuth/proxy. Stale OpenAPI intro auth-default caveat noted."
- Agent self serve creds: na — "No hosted signup/key-issuance service; operator initializes self-hosted token/session configuration."
- Webhooks: fail — "SSE task/events are not outbound signed webhooks; none documented."
- CLI tool: fail — "Installer/server daemon and curl examples, not official client CLI."
- Error model: pass — "OpenAPI Error.error has code, message, retryable."
- Rate limit docs: fail — "No API request rate-limit response headers/limits documented in reviewed spec/configuration; resource quotas are different."
- Agent config: partial — "https://raw.githubusercontent.com/tastyeffectco/sandboxd/main/AGENTS.md plus platform/per-app grounding prompt; no public well-known agent endpoint or skill listing."

## Coding harnesses

- Claude Code (Anthropic) — "Both CLIs (claude, opencode) are pre-installed in every sandbox" [source](https://sandboxd.io/guides/agents)
- OpenCode (opencode) — "opencode is the default when a task omits agent" [source](https://sandboxd.io/guides/agents)

## Open source

- Repository: https://github.com/tastyeffectco/sandboxd
- License: MIT
- Stars: 968
- Forks: 65
- Self-host methods: compose, source-build
- Self-host dependencies: docker, git

## Company & presence

- Privacy policy: https://sandboxd.io/privacy
- GitHub: https://github.com/tastyeffectco/sandboxd
- Discussions: https://github.com/tastyeffectco/sandboxd/discussions
- Blog: https://sandboxd.io/blog
- Sponsor: https://github.com/sponsors/tastyeffectco

## Nearby in the atlas

- [Agent Safehouse](/products/agent-safehouse.md)
- [Agent Sandbox](/products/agent-sandbox.md)
- [Agent Substrate](/products/agent-substrate.md)
- [Agent37](/products/agent37.md)
- [AgentNest](/products/agentnest.md)
- [Anthropic Sandbox Runtime (srt)](/products/sandbox-runtime.md)

## Method

Facts come from the product's own public pages. Each claim carries its evidence: a quote and the page it came from. We count capabilities rather than grade products, and "Not assessed" means we have not checked, never that the product lacks it.