Sandboxing Feature Matrix

This matrix compares the six members of the Sandboxing category: the vendor-backed runtime, the Kubernetes orchestrator, the kernel-enforced wrapper, the disposable-VM workstation tool, the framework with sandbox tiers, and the provisioning driver. The Kind row is what keeps this category legible: three columns are isolation boundaries, one is an orchestrator around boundaries, one is a framework that consumes boundaries, and one feeds repositories into all of them. Everything below was re-verified against live sources on 2026-09-13.

Isolation is cheap to claim and expensive to enforce, so the deciding rows are the mechanism and the maturity: a kernel boundary nobody has audited loses to a container boundary a vendor stands behind.

Legend: ✓ supported, ✗ not supported, ~ partial or conditional, ? not verified as of the date above. Each column links to the full research note; every cell below traces to a source cited there or in the references.

The matrix

#

Reading the matrix

#

The backing row is doing more work than the license row: all five are permissively licensed, and what differs is who you sue, so to speak, when the boundary breaks. NVIDIA and Google Cloud stand behind two columns; an anonymous org and two single-dominant-author projects stand behind the others.

The isolation-boundary row separates real boundaries from plumbing: OpenShell, aigate, and Clawk enforce at the kernel, container, or VM level, Agent Sandbox explicitly delegates, Flue explicitly refuses, and ArtifactFS is upstream plumbing that gets repos into any of them fast. A matrix that pretended all six were equivalent would be lying by layout.

The credential row is OpenShell’s lead: keys that never enter the sandbox is the only architectural answer to exfiltration here; aigate masks and allowlists at the edges, and the rest delegate to you.

Audit status is the caution no cell can carry: OpenShell is alpha without an announced audit, aigate has no security process at all, Clawk publishes its own limits (the allow-list trusts the forge, so anything the agent reads could be published) while quieting down since August, and all three sell the same promise, so the maturity row is a security row in disguise.

Choosing from the matrix

#

• Need multiple agents sandboxed on workstations with egress and key policy: OpenShell, alpha risk priced in.
• Want to stop approving every command on a macOS workstation and accept pre-1.0 churn: Clawk.
• Need cluster-scale, multi-tenant sandbox fleets on Kubernetes you operate: Agent Sandbox, with gVisor or Kata actually configured.
• Want uniform cross-tool restriction for personal use on Linux and will read the source first: aigate.
• Building TypeScript agents and want sandbox semantics as framework features: Flue, with the boundary chosen deliberately.
• Agent sandboxes burning minutes cloning big repos: ArtifactFS, on hosts where FUSE is allowed.

Changes

#

• 2026-08-30 - Created with the Sandboxing category seed, five columns with a kind row separating boundaries from plumbing.
• 2026-08-30 - Re-sorted columns alphabetically, dropping kind-order, per the new owner rule.
• 2026-09-05 - Extended from five to six columns with Clawk, making three boundary columns.

See also

#

• Harness Feature Matrix - the agents these layers wrap, some with built-in sandboxing
• Codex - the built-in kernel sandboxing baseline
• Executions Feature Matrix - the unattended runs isolation exists to protect
• Control Planes Feature Matrix - governance above the sandboxes

References

#

• https://github.com/NVIDIA/OpenShell - the OpenShell column: protection layers, agents, alpha status
• https://github.com/kubernetes-sigs/agent-sandbox - the Agent Sandbox column: CRDs, threat model, maturity
• https://github.com/AxeForging/aigate - the aigate column: mechanism and its own caveats
• https://github.com/withastro/flue - the Flue column: three-tier sandbox model
• https://github.com/cloudflare/artifact-fs - the ArtifactFS column: FUSE architecture, limitations
• https://github.com/clawkwork/clawk - the Clawk column: VM model, security limits, and release state
• https://code.claude.com/docs/en/sandboxing - the built-in sandboxing baseline the category is measured against