microsandbox

Microsandbox runs untrusted workloads from AI agents to CI jobs inside fast local microVMs, with hardware isolation and boot times under 100 milliseconds.

Microsandbox is positioned as an easy, fast, local first microVM runtime and library. The workloads it targets are the ones you do not fully trust: AI agents, user code, plugins, CI jobs, dev environments, scrapers, and automation. Each of those runs inside a microVM, which is where the hardware isolation comes from. Naming the workload types matters because it shows the tool is aimed at people who already know what they want to isolate, not at someone shopping for a generic sandbox.

The README makes speed a headline feature. Boot times come in under 100 milliseconds, which it describes as instant startup. The runtime is OCI compatible, so standard container images run as they are, and workflows can look Docker like. Cross platform support covers Linux, macOS, and Windows. Because it is embeddable, there is no setup server and no long running daemon to babysit. For tooling that has to sit inside a developer loop, that last part is often the difference between using it and not.

Isolation is the deeper point, and the README pushes it hard. Secrets cannot leak because the secret keys are unexploitable and never enter the VM in the first place. Long running sandboxes can run in detached mode, which matters for workloads that outlive a single command. The project also calls itself agent ready, meaning agents can create their own sandboxes rather than waiting on a human to spin one up. That phrasing points at a future where the sandbox is created by the very agent that runs inside it.

There are two ways in. One is the SDK, with installers for Rust, Python, TypeScript, and Go, so developers can spawn VMs from inside their own code. The other is the CLI, which has a command that boots a microVM plus a global install across macOS, Linux, and Windows. Package managers such as brew, npm, uv, and cargo are supported along the way. Having both paths means library users and command line users get the same isolation without learning each other's workflow.

• Source 1 · Project repository
• Source 2 · README