#1212th of 18 in Sandboxes
agent-sandbox
Kubernetes CRD and controller for stateful, singleton sandbox pods for agents
- Stars
- 4.6k
- License
- Apache-2.0
- Last commit
- Nov 2026
- Last release
- Nov 2026
- Language
- Go
1,877 on 22 Apr 20264,586 on 11 Nov 2026
From GitHub's daily star counts.
Checked on GitHub.
Overview
Defines a Sandbox custom resource that manages a single pod with stable hostname, persistent storage and a lifecycle (create, scheduled delete, pause, resume). Extensions add SandboxTemplate, SandboxClaim and SandboxWarmPool for pre-warmed sandboxes. It orchestrates only: isolation comes from runtimes such as gVisor or Kata Containers selected through RuntimeClass.
Who it is for: Platform engineers running untrusted agent code or RL workloads on Kubernetes
Strengths
- Warm pools of pre-created sandboxes cut startup time for claims
- Delegates isolation to gVisor or Kata via RuntimeClass, vendor-neutral
- Go and Python SDKs plus an optional HTTP sandbox router
- Part of Kubernetes SIG Apps; release manifests and Helm chart provided
Weaknesses
- Requires an existing Kubernetes cluster, 1.25+ with CEL validation; 1.29+ recommended
- Does not provide isolation itself; you must set up a sandbox runtime
- Gateway-based client access needs Gateway API CRDs, which need Kubernetes 1.31+
- Deep hibernation and memory sharing are listed as goals, not confirmed features
What it needs
- no GPU
- Docker
- Needs Kubernetes 1.25+, gVisor or Kata Containers (optional runtime), Gateway API CRDs (optional)
What changed
- v1.0.10 ↗ (opens in a new tab)Breaking
“Router NetworkPolicy changes (#1550, #2095, #2144):”
- v1.0.9 ↗ (opens in a new tab)Breaking
“Router NetworkPolicy now allows egress to TCP 9090 (#1880): The NetworkPolicy in sandbox-router/deploy/ (applied by kubectl apply -k sandbox-router/deploy/) now allows egress on TCP 9090 as well as 8…”
- v1.0.8 ↗ (opens in a new tab)Breaking
“MCP executecommand output is now bounded (#1978): Combined stdout and stderr are capped at 30,000 Unicode code points by default. Output over the budget comes back as head-and-tail excerpts separated…”
From the release notes. No flag means the note does not say so, not that the upgrade is safe.
Also in Sandboxes
See all 18| Rank | Project | Score |
|---|---|---|
| 1 | LightpandaHeadless browser written in Zig for agents and scraping, with CDP and MCP | 94 out of 100 |
| 2 | OpenShellPolicy-enforced sandbox runtime for autonomous AI agents | 89 out of 100 |
| 3 | ObscuraRust headless browser with V8 and CDP for scraping and agents | 87 out of 100 |
| #4 | opensandboxSandbox API for running AI agent code, commands and browsers in isolation | 87 out of 100 |
| #5 | NemoClawReference stack for running OpenClaw, Hermes and Deep Agents in OpenShell sandboxes | 86 out of 100 |