↓ Skip to main content
tomrochette.com
  1. Agents/
  2. Sandboxing/

Sandboxing Feature Matrix

Author
glm-5.3-flash
History / Edit / PDF / EPUB / MD
Created: / Updated: / Status: finished / Readability: 3 / 25 minutes read (~4855 words)
agent-curated 572 comparison 24 fully-ai-generated 675 isolation 19 llm=glm-5.3-flash 582 sandboxing 30 security 18
Table of Contents

This matrix compares the twenty-three members of the Sandboxing category: two orchestrators (the Kubernetes fleet orchestrator and NVIDIA’s OpenShell reference stack), the provisioning driver, the framework with sandbox tiers, the general-purpose sandbox platform, the hosted sandbox API that defines the category’s compatibility baseline, and seventeen further isolation boundaries spanning kernel wrappers, namespace sandboxes, container walls, dev containers, and microVMs from workstation to fleet scale. The Kind row is what keeps this category legible: nineteen columns are isolation boundaries (fifteen workstation-scale, four platform-scale services), two orchestrate boundaries (Agent Sandbox for fleets, NemoClaw for NVIDIA’s reference assistants), one is a framework that consumes boundaries, and one feeds repositories into all of them.

Isolation is cheap to claim and expensive to enforce, so the deciding rows are the mechanism and the maturity: a kernel boundary nobody has audited loses to a container boundary a vendor stands behind.

Legend: ✓ supported, ✗ not supported, ~ partial or conditional, ? not verified. Each column links to the full research note; every cell below traces to a source cited there or in the references.

The matrix
#

Feature Agent Sandbox aicontainer aigate ArtifactFS Brig Brood Box Clawk Container Use CubeSandbox Drop E2B Fence Flue Greywall Landrun Microsandbox NemoClaw nono NVX OpenSandbox OpenShell Overalls Yolobox
Kind K8s sandbox orchestrator devcontainer-spec sandbox for auto-approve agent CLIs kernel-enforced CLI wrapper workspace provisioning driver microVM workstation sandbox review-gated microVM workstation sandbox disposable per-agent Linux VM agent-created containerized dev environments on per-agent git branches (MCP server) self-hosted E2B-compatible microVM sandbox service rootless namespace sandbox wrapper hosted Firecracker-microVM sandbox API OS-native command sandbox CLI framework with sandbox tiers OS-native command sandbox with proxy observability (a Fence fork) kernel Landlock CLI wrapper (single primitive) local-first embeddable microVM runtime OpenShell reference stack: guided onboarding, managed inference, network policy, and lifecycle ops kernel capability sandbox with per-tool broker research-grade microVM sandbox general-purpose sandbox platform sandboxed agent runtime self-hosted Firecracker microVM dev-machine platform container sandbox wrapper for coding agents
Isolation boundary ~ delegates to gVisor or Kata via RuntimeClass ✓ Docker devcontainer per project, host kernel shared, Docker daemon reachable only through a digest-pinned socket proxy (object APIs off by default) ✓ ACLs plus namespaces plus Seatbelt ✗ not an isolation boundary ✓ microVM per agent (hull hvi, vz, or Linux urunc), runc optional and flagged weaker ✓ libkrun microVM per run (KVM Linux, Hypervisor.framework Apple Silicon), own kernel, COW snapshot, VM stopped before the per-file review ✓ VM boundary, host mounts only what you share ✓ container per environment, Dagger-executed, git worktree and branch per agent, host kernel shared ✓ dedicated-kernel KVM MicroVM per sandbox, eBPF network isolation ✓ six namespace types, capabilities dropped, optional gVisor ✓ Firecracker microVM per session, nftables egress firewall ✓ sandbox-exec on macOS, bubblewrap plus Landlock and seccomp on Linux, host kernel shared ✗ adapters to external sandboxes ✓ bubblewrap namespaces, Landlock, seccomp, eBPF monitoring on Linux, Seatbelt on macOS, host kernel shared ✓ Landlock LSM domains, filesystem paths plus TCP ports and IPC scoping, host kernel shared, no namespaces ✓ microVM per sandbox via libkrun, own kernel ~ none of its own; applies OpenShell’s boundary (seccomp, Landlock, privilege drop, namespaces) plus a stricter blueprint policy ✓ kernel primitives, session sandbox plus per-command sandboxes ✓ OpenVMM microVM, own kernel, Linux guests ~ default runc container, opt-in gVisor, Kata, or Firecracker ✓ container or MicroVM, Landlock, seccomp, L7 proxy ✓ persistent Firecracker microVM per machine, own kernel, ZFS disk, isolated network with lateral traffic blocked by nftables, locked-down profile removes outbound ✓ Docker container, full sudo inside, project mounted at its host path, home unmounted by default, the runtime is the boundary
Backing Google Cloud via Kubernetes SIG Apps, Apache-2.0 solo author (Stefano Ginella), MIT anonymous two-person org, MIT Cloudflare, Apache-2.0 NOFire AI (team behind CNCF’s urunc), Apache-2.0 Stacklok (the ToolHive and Minder company), Apache-2.0 small independent team, Apache-2.0 Dagger, Apache-2.0 Tencent, Apache-2.0 with listed third-party exceptions solo author (Jan Wrobel), Apache-2.0 E2B (Insight Partners-backed, $32M raised), Apache-2.0 SDKs and runtime Tusk (AI testing-agents company), Apache-2.0 Astro/Cloudflare team, Apache-2.0 GreyhavenHQ, Apache-2.0 (fork of Tusk’s Fence) solo author (Zouuup), MIT superradcompany (YC-backed badge), Apache-2.0 NVIDIA, Apache-2.0 nolabs-ai (the Sigstore team), Apache-2.0 Microsoft (MSR and Azure Research), MIT opensandbox-group, Alibaba-origin, Apache-2.0 NVIDIA, Apache-2.0 solo author (Geoffrey Huntley, the Ralph loop author) with Antithesis, Cachix, and Namespace Labs support, MIT solo author (Finbarr), MIT
Platform any Kubernetes cluster anywhere Docker runs (Docker Desktop, OrbStack, Colima, Rancher Desktop, rootless), VS Code devcontainer integration Linux first, macOS partial macOS (macFUSE), Linux (fuse3) Apple Silicon macOS 15+ (14 with fallbacks), Linux x86-64/arm64 Linux with KVM, macOS Apple Silicon macOS, Linux experimental macOS, Linux, anywhere Docker and Git run x86_64 Linux with KVM, ARM64 supported, K8s deploy preview Linux only (amd64, arm64), host distro reused hosted cloud (US, EU, APAC), BYOC; Embed self-hosts on one x86-64 KVM Linux node macOS and Linux, container-free any Node 22+ host, deploys anywhere Linux and macOS Linux only (kernel 5.13+, 6.7+ for TCP and IPC controls) Linux, macOS, and Windows hosts Linux, macOS, and WSL hosts with Docker; DGX Spark and DGX Station express profiles Linux and macOS, brew/Nix/curl install Linux/KVM, Linux/MSHV, Windows/WHP Docker locally, Kubernetes runtime at scale Linux, macOS, WSL2 experimental self-hosted x86_64 bare metal with /dev/kvm (NixOS hosts), guests NixOS, Ubuntu 26.04 LTS, Windows Server 2025 macOS and Linux wherever Docker runs
Agent integration none specific, bring your own Claude Code, Codex, OpenCode in bypass mode tool-agnostic wrapper any sandbox that mounts FUSE 8 built-in profiles (Claude Code, Codex, Gemini, Grok, OpenCode, Cursor, Claude Desktop, shell) built-in commands for Claude Code, Codex, OpenCode, Hermes, Gemini CLI, custom agents via config, ToolHive MCP proxy, run-image for arbitrary OCI images wraps Claude Code, Codex, pi, or a shell MCP server for any MCP client, config helpers for Claude Code, Codex, Cursor, Goose, Copilot, Amazon Q, Cline, Windsurf, Zed, Amp, Kilo, Qodo, Kiro E2B SDK drop-in, base-URL swap tool-agnostic wrapper, docs tour uses Claude Code SDK-first (Python, JavaScript), framework adapters target it tool-agnostic wrapper, wiring docs for Claude Code, Codex, Amp, Gemini CLI, Copilot, OpenCode, Droid hooks, useSandbox API built-in profiles for Claude Code, Codex, Cursor, Aider, Goose, Gemini CLI, OpenCode, Amp, Cline, Copilot, Kilo, Auggie, Droid none specific, tool-agnostic CLI agent-created sandboxes via shipped skills and an MCP server, embeddable library OpenClaw default, Hermes, LangChain Deep Agents Code, Pi release candidate; onboarding wizard and per-agent aliases tool-agnostic CLI plus Go/TypeScript/Python SDKs none shipped, agent architecture in design docs 5 SDK languages, osb CLI, MCP server 4 first-class, BYOC built-in agent threads on any machine (a prompt wakes a stopped machine), Claude Code and Codex preinstalled, browser, CLI, SSH, VS Code, and a phone client built-in shortcuts for Claude Code, Codex, Kimi Code, Gemini, Antigravity, OpenCode, Copilot, and Pi, plus in-sandbox agent guidance
Policy model K8s RBAC plus RuntimeClass always-on link-local and cloud-metadata block, opt-in outbound allowlist, PreToolUse hook blocking .env reads, fixed safe-field config sanitizer, per-project path-unique volumes per-project YAML deny rules ✗ n/a, provisioning only network posture isolated by default on hvi and Linux, egress policies enforced on hvi and Linux DNS-aware egress profiles (permissive, standard, locked) plus per-host allowlist, snapshot default with operator-only direct mode, tighten-only workspace overrides network allow-list, forge pre-allowed per-project default environment config (base image, setup and install commands, env vars), agent adaptations importable, no egress policy eBPF inter-sandbox isolation plus L7 per-domain egress policy TOML config, shared base plus per-environment overrides per-sandbox nftables egress, SNI/Host-inspecting domain allow and deny lists one fence.json, network deny-by-default with allow templates, command deny rules, write restrictions tier choice plus env allowlist per-invocation JSON profile, deny-by-default network and filesystem, command deny rules, learning mode generates profiles, greywatch allow-by-default observation per-invocation flags, maximum restriction when no rules given, best-effort ABI degradation ~ container-style flags, no declarative policy layer Balanced, Restricted, or Open presets over OpenShell YAML, managed network policies, hardened blueprint image per-tool profiles with chained policies, L7 credential proxy scoping API methods and paths ~ snapshot and lifecycle ABI, no policy engine yet ingress gateway plus per-sandbox egress controls declarative YAML, auditable guest egress only through the Brady proxy (verified upstreams, cached), Cedar authorization evaluated at execution time, per-machine sharing roles (viewer, operator, manager) home opt-in mount, persistent volumes, –exclude and –copy-as narrowing, network on unless disabled
Credential handling your K8s secrets ~ nothing forwarded by default, logins happen inside the container, host config reduced to fixed safe fields by a root-only one-shot egress allowlist, stdout masking ✗ n/a ✓ host credential sources unread on the run path, keychain-backed store, profile-named forwarding ✓ named env forwarding only (single-quote escaped), git token and SSH agent forwarding, .env and key files always excluded from snapshots, ephemeral per-session SSH keys secrets stay on host, ssh-agent forwarded ~ op://, env://, vault://, and file:// references resolve to env vars inside the environment, values stripped from logs and outputs, the model sees references only ✓ credential vault, keys injected at egress gateway original home hidden, selected host files read-only ✓ secrets vault injected at egress proxy ✗ not a credential broker, policy files only env allowlist per tier ✓ placeholders replace credential variables, greyproxy substitutes values at the HTTP layer ~ deny-by-default environment passing (nothing crosses without –env), no credential broker ~ project states secret keys never enter the VM (self-reported) ✓ keys stay at OpenShell’s inference proxy, host env vars filtered from the build, digest-pinned credential helper ✓ per-tool credentials via proxy, tokens scoped to selected methods and paths ✗ not yet addressed ✓ credential vault for outbound requests ✓ keys stay at inference proxy ✓ no keys in guests: inference via llm.internal with credentials added outside the VM (Ziggy), integration credentials at the edge (Galileo), usage recorded per account ~ home and dotfiles invisible by default, project files and env cross at root reach
Maturity v1.0.8 tag (2026-10-22), v1beta1 API, breaking migrations pre-1.0 (npm 0.12.1, 2026-10-14), solo maintainer, no audit v1.0.0, 14 stars, no audit 1.0.0-rc, no releases, beta pre-1.0 (v0.4.1), new sandboxes isolated by default on hvi and Linux, no audit pre-1.0 (v0.0.25, 2026-09-14), experimental badge, no audit pre-1.0 (v0.4.0), own breaking-changes banner experimental badge, v0.4.2 (2025-08-19), release train stopped, sparse 2026 commits pre-1.0 (v0.7.3, 2026-10-12, E2B-compatible MCP gateway), six months old pre-1.0 (v0.3.1), solo maintainer SOC 2 Type II cloud, 2.59.x SDK train, runtime newly open source pre-1.0 (v0.1.67), org renamed to fencesandbox, no audit first stable v2.0 after rewrite pre-1.0 (v0.3.7, 2026-06-01), quiet since August, no audit pre-1.0 (v0.1.17, 2026-07-22), commit train resumed October 2026 on Landlock ABI 10 and UDP work, no release yet, no audit pre-1.0 (v0.7.9), weekly releases, no audit prerelease only (one ci-native-podman-e2e tag, 2026-10-01), self-declared alpha pre-1.0 (v0.80.0), 1.0 approaching, no audit research preview, daily v0.1.0-dev prereleases, no stable release 1.1.1 stable patch cut (the wheel-fix release), 1.2.0-rc.2 prerelease (OSEP-0024 auto-pause, the OSEP-0022 credential vault) stable 0.1.x line at v0.1.5, self-declared alpha dropped research preview (launches 2026-11-03), no release or tag yet, 170+ architecture decision records pre-1.0 (v0.19.10, 2026-10-20), sixty-nine releases since January, no audit
Community signal 4.3k stars, Google-backed 21 stars, 505 npm downloads a month, no HN thread 14 stars, 0 issues, footprint is the signal 1.2k stars, 217-point HN launch 231 stars, 9-point launch, nine weeks old 78 stars, no HN launch 1.0k stars, 226-point HN launch, quiet since August 4.1k stars, 82-point Show HN (2025) 13.0k stars, best HN thread 7 points 386 stars, 193-point HN launch 14.4k stars (SDK repo), 2-point launch, enterprise claims 992 stars, 78-point HN launch 8.5k stars, single dominant author 309 stars, 7-point launch, quiet since August 2,315 stars, 518-point HN launch (2025) 8.7k stars, 402-point HN launch (2025) 22.8k stars, 385-point HN launch 4.5k stars, best HN thread 4 points 400 stars, 3-point HN thread 15.9k stars, no HN launch of its own, Trendshift-driven 16.4k stars, ~132 contributors 1,557 stars (2026-10-21 baseline), pre-launch, no coverage yet 651 stars, 122-point HN launch
Pricing free, cluster costs free free free, Artifacts service metered free free free free free, self-hosted fleet free usage-based, Hobby free, Pro $150/mo free free, provider costs free free free, self-hosted; hosted cloud in private beta free, host and token costs free free free, self-hosted free free, self-hosted bare metal and token costs free

Reading the matrix
#

The backing row is doing more work than the license row: all twenty-three are permissively licensed, and what differs is who you sue, so to speak, when the boundary breaks. Google Cloud, NVIDIA (which now stands behind two columns, OpenShell and NemoClaw), Alibaba’s opensandbox-group, Tencent, NOFire AI (the team behind CNCF’s urunc), the venture-backed E2B company, Microsoft, nolabs-ai (the Sigstore team), Tusk, YC-backed superradcompany, Stacklok, and Dagger stand behind thirteen columns between them; the rest belong to two Cloudflare team projects, GreyhavenHQ (the small org behind the Greywall fork of Tusk’s Fence), a small independent team, five solo authors, and an anonymous org.

The isolation-boundary row separates boundaries from plumbing: OpenShell, aigate, aicontainer, Brig, Brood Box, Clawk, Container Use, Drop, CubeSandbox, E2B, Fence, Greywall, Landrun, Microsandbox, nono, NVX, Overalls, and Yolobox enforce at the kernel, container, or VM level, OpenSandbox ships a container boundary with stronger runtimes behind opt-in configuration, Agent Sandbox explicitly delegates, NemoClaw inherits OpenShell’s enforcement and layers a stricter blueprint on top, Flue explicitly refuses, and ArtifactFS is upstream plumbing that gets repos into any of them fast. A matrix that pretended all twenty-two were equivalent would be lying by layout.

The credential row now has five architectural answers: OpenShell, CubeSandbox, OpenSandbox, E2B, Overalls, NemoClaw (which creates the providers at onboarding, filters key-bearing host env vars out of the build, and rides OpenShell’s inference proxy), and Greywall (whose placeholders replace credential variables and whose greyproxy swaps in the values at the HTTP layer) keep keys out of the sandbox via a proxy or vault, nono goes finer and scopes each tool’s token to selected API methods and paths through its own broker, Drop’s answer is the filesystem itself, an empty home with selected paths mounted read-only, Yolobox’s the same bet with a container and an unmounted home, Landrun passes no environment variable unless a flag names it, aigate masks and allowlists at the edges, Brig reads no host credential source and forwards only what its profiles name, Brood Box the same with non-overridable secret-file exclusions and per-session keys, aicontainer forwards nothing and sanitizes host config down to fixed safe fields before the agent sees it, Container Use resolves secret references to environment variables inside the environment and strips the values from logs and outputs, so the model sees references while the container holds the keys, Microsandbox states keys never enter the VM without publishing an external review of the mechanism, and the rest delegate to you, so the differentiator moves from whether it is done to where the proxy runs and who operates it.

Audit status is the caution no cell can carry: OpenShell reached its stable 0.1.x line (now at v0.1.5) without an announced audit, aigate has no security process at all, Clawk publishes its own limits (the allow-list trusts the forge, so anything the agent reads could be published) while quieting down since August, Fence’s maintainer stated reads are allow-by-default on launch day, Greywall’s security model declares the same semi-trusted ceiling itself and its fork has sat unaudited and quiet since August, nono advertises an immutable audit chain and an OpenSSF badge while awaiting an external audit, Microsandbox’s boot and secret claims are self-reported, NVX answers with a limits page that rules out production needs by name, NemoClaw pins its credential helper and form by SHA-256 digest and publishes hardening docs while declaring itself alpha with no external audit, the newer platforms announce no independent audit either, OpenSandbox leaning on cosign-signed images and OpenSSF badges, CubeSandbox on its own benchmarks, Drop on a candid docs overview, Brig publishing measured reachability results and trust assumptions while awaiting an external audit, Landrun’s author publishing his own supply-chain warning that binaries are not trustworthy, Yolobox’s docs listing kernel exploits and container escapes as out of scope on a dedicated security page, Container Use’s experimental badge and its August 2026 path-traversal patch standing in for a threat model, Brood Box’s self-published security model behind an experimental badge, aicontainer’s threat model and printed boundary table as self-review without an external audit, Overalls’s disclosure program (private advisories, a hall of fame, no bounty) standing in front of a platform that has neither a release nor an audit yet, and E2B answering with SOC 2 Type II on process while the boundary itself stays un-audited in public, so the maturity row is a security row in disguise.

The 2026-10-12 scan resolutions stay below the bar: AgentTier (55 stars, a Kubernetes pod-and-PVC sandbox platform with a dashboard and optional gVisor whose release burst stopped 2026-06-30 and whose commits went quiet 2026-07-17, duplicating the Agent Sandbox column’s slot without its adoption), intentic (78 stars, an active MIT workspace for coding agents whose per-agent Docker sandboxes and git worktrees are plumbing under a fleet-board orchestration product run from a hosted control plane, flagged to the orchestration shelf), and katspaugh’s machine (17 stars, one ready-to-work Lima VM per project, macOS only, dormant since 2026-07-20 with its slot held by Clawk and Brig).

Choosing from the matrix
#

  • Need multiple agents sandboxed on workstations with egress and key policy: OpenShell, pre-1.0 risk priced in.
  • Want OpenClaw, Hermes, or Deep Agents operated for you inside OpenShell with NVIDIA’s defaults: NemoClaw, alpha attached.
  • Want to stop approving every command on a macOS workstation and accept pre-1.0 churn: Clawk.
  • Need cluster-scale, multi-tenant sandbox fleets on Kubernetes you operate: Agent Sandbox, with gVisor or Kata actually configured.
  • Want uniform cross-tool restriction for personal use on Linux and will read the source first: aigate.
  • Want a coding agent fenced in on Linux without leaving your installed environment: Drop, with gVisor enabled for untrusted work.
  • Want a maintained microVM around an agent on your own Apple Silicon or Linux box, and will read its security docs first: Brig, pre-1.0.
  • Want a microVM whose changes land only after you approve the per-file diff: Brood Box, experimental.
  • Want one policy file around semi-trusted commands and agents on macOS or Linux, accepting allow-by-default reads: Fence, 0.x.
  • Want the kernel’s own Landlock around one Linux command with no containers and no namespaces: Landrun, the primitive the wrappers are built on.
  • Want to stop approving every command by giving the agent root inside a container while home stays out: Yolobox, container-grade isolation only.
  • Want to watch what an agent tries before fencing it, with proxy-swapped credentials: Greywall, a quiet Fence fork.
  • Want several agents in parallel with each one’s work on its own branch, reviewed with plain git: Container Use, experimental and slowed.
  • Want auto-approve Claude Code, Codex, or OpenCode inside a devcontainer with the Docker socket proxied away: aicontainer, a thin footprint.
  • Want each delegated tool fenced separately with per-endpoint credential scoping: nono, pre-1.0.
  • Want VMs with container workflows on your own machine, including agents that spawn their own sandboxes: Microsandbox, self-reported claims attached.
  • Need Windows-hypervisor isolation research, or want to watch where Microsoft is taking microVMs: NVX, a research preview.
  • Building TypeScript agents and want sandbox semantics as framework features: Flue, with the boundary chosen deliberately.
  • Agent sandboxes burning minutes cloning big repos: ArtifactFS, on hosts where FUSE is allowed.
  • Need a drop-in self-hosted replacement for the E2B API with hardware isolation: CubeSandbox, on a KVM-capable Linux fleet.
  • Want zero-ops hardware-isolated execution behind an API and can pay per second: E2B, the hosted path.
  • Want a whole self-hosted fleet of persistent agent machines with keys and usage accounting held at the edge: Overalls, pre-launch (3 November 2026).
  • Want one self-hosted platform for coding agents, GUI agents, and evals across Docker and Kubernetes: OpenSandbox, with a secure runtime configured deliberately.

Changes
#

  • 2026-08-30 - Created with the Sandboxing category seed, five columns with a kind row separating boundaries from plumbing.
  • 2026-08-30 - Re-sorted columns alphabetically, dropping kind-order, per the new owner rule.
  • 2026-09-05 - Extended from five to six columns with Clawk, making three boundary columns.
  • 2026-09-16 - Extended from six to eight columns (CubeSandbox, OpenSandbox), re-sorted alphabetically, with the boundary, backing, credential, and audit prose updated for eight members.
  • 2026-09-18 - Agent Sandbox maturity cell updated to the v1.0.3 tag (released 2026-09-17); every other cell re-verified against the refreshed notes and unchanged.
  • 2026-09-21 - Refreshed the community-signal cells for CubeSandbox (12.6k), Flue (8.3k), OpenSandbox (15.4k), and OpenShell (8.7k stars, ~120 contributors); all other cells re-verified unchanged.
  • 2026-09-24 - Removed the verification preamble line on owner request.
  • 2026-09-25 - Maturity cells refreshed: Agent Sandbox v1.0.4, CubeSandbox v0.7.2, OpenSandbox at its first stable 1.1.0 umbrella release; community-signal cells refreshed (Agent Sandbox 4.0k, CubeSandbox 12.7k, Flue 8.4k, OpenSandbox 15.5k, OpenShell 8.8k stars and about 123 contributors).
  • 2026-09-27 - OpenShell maturity cell moved to its first stable v0.1.1 release (v0.1.0 on 2026-09-25, alpha badge dropped), and the audit prose updated to match.
  • 2026-09-29 - Extended to nine columns with Drop (rootless namespace wrapper), inserted alphabetically, with the backing, boundary, credential, and audit prose updated for nine members.
  • 2026-09-29 - Cell refreshes: OpenShell maturity to the stable 0.1.x line at v0.1.2 and community to 9.7k stars with about 124 contributors, OpenSandbox community to 15.6k stars, and the OpenShell choosing bullet reworded from alpha to pre-1.0 risk after the stable graduation.
  • 2026-10-02 - Cell refreshes: Agent Sandbox maturity to v1.0.5 and community to 4.1k stars, Drop maturity to v0.3.0 and community to 350 stars, ArtifactFS community to 1.2k stars, CubeSandbox community to 12.8k stars, and OpenShell community to 14.0k stars with about 126 contributors after the Open Agent Safety Platform push.
  • 2026-10-06 - Extended to eleven columns with Brig (the actively maintained microVM workstation sandbox) and E2B (the hosted sandbox API the category cites as its compatibility baseline), inserted alphabetically, with the boundary, backing, credential, and audit prose updated for eleven members.
  • 2026-10-06 - Cell refreshes: Agent Sandbox community to 4.2k stars, Drop to 375, OpenSandbox to 15.7k, and OpenShell to 15.0k stars with about 128 contributors.
  • 2026-10-07 - Extended to fifteen columns with Fence (the OS-native command sandbox CLI), Microsandbox (the libkrun local-first microVM runtime), nono (the per-command capability broker), and NVX (Microsoft’s research-grade microVM sandbox), inserted alphabetically, with the boundary, backing, credential, and audit prose updated for fifteen members.
  • 2026-10-07 - Cell refreshes: Brig maturity to v0.4.0 with the new default-isolated network posture and Linux egress enforcement, Brig community to 211 stars, Drop to 377, and OpenShell to 15.2k stars as the platform push continued.
  • 2026-10-07 - Extended to sixteen columns with NemoClaw (NVIDIA’s OpenShell reference stack for OpenClaw, Hermes, and Deep Agents), inserted alphabetically between Microsandbox and nono, with the intro, orchestrator count, backing, boundary, credential, and audit prose updated.
  • 2026-10-08 - Extended to seventeen columns with Greywall (GreyhavenHQ’s Fence fork adding proxy-held credential substitution and the greywatch observability mode), inserted alphabetically between Flue and Microsandbox, with the intro counts, boundary, backing, credential, and audit prose updated for seventeen members.
  • 2026-10-08 - Cell refreshes: Brig community to 214 stars, Fence to 988, NVX to 353, and OpenShell to 15.4k stars as the platform push continued.
  • 2026-10-09 - Extended to nineteen columns with Landrun (the Landlock-only kernel wrapper behind many hand-rolled agent sandboxes) and Yolobox (the container wrapper for full-sudo agent runs with an unmounted home), inserted alphabetically, with the intro counts, boundary, credential, and audit prose updated for nineteen members; cell refreshes: Agent Sandbox maturity to v1.0.6, Brig community to 218 stars, Greywall to 309, NVX to 369, and OpenShell to 15.5k stars.
  • 2026-10-10 - Cell refreshes with no membership change: Drop maturity to v0.3.1 and community to 382 stars, E2B maturity to the 2.55.x SDK train and community to 14.3k, Landrun maturity to 79 days quiet and community to 2,315, Microsandbox maturity to v0.7.8, OpenSandbox maturity to the 1.1.1 stable patch cut and community to 15.8k, OpenShell maturity to v0.1.3 and community to 15.6k, Yolobox maturity to sixty-six releases (correcting thirty), plus Brig community to 224, CubeSandbox community to 12.9k, and NVX community to 373; the backing prose’s member counts corrected to nineteen and three solo authors, both stale from the extension the day before.
  • 2026-10-11 - Cell refreshes with no membership change: Brig community to 226 stars at nine weeks, Drop to 384, Fence to 989, NVX to 382, OpenShell to 15.8k, Landrun’s quiet window to eighty days, and CubeSandbox’s age to six months; all other cells re-verified unchanged.
  • 2026-10-12 - Extended to twenty-two columns with Container Use (Dagger’s agent-created containerized environments on per-agent git branches), Brood Box (Stacklok’s review-gated libkrun microVM runner), and aicontainer (the devcontainer-spec sandbox with the Docker socket proxied), inserted alphabetically, with the intro counts, boundary, backing, credential, and audit prose updated for twenty-two members.
  • 2026-10-12 - Added the scan-rejection long tail (AgentTier, intentic, katspaugh’s machine) with reasons; existing members’ cells re-verified unchanged.
  • 2026-10-12 - Cell refreshes with no membership change: CubeSandbox maturity to the v0.7.3-rc prereleases opened 2026-10-12 plus the dated kernel-release-261012-1 assets tag, Landrun’s quiet window to eighty-one days, and community cells for Brig (228), Landrun (2,318), and NVX (387); all other cells re-verified against the refreshed notes and unchanged.
  • 2026-10-13 - Cell refreshes with no membership change: CubeSandbox maturity to the v0.7.3 stable cut of 2026-10-12 with its E2B-compatible MCP gateway, OpenShell maturity to v0.1.4 and community to 16.1k stars with about 132 contributors, E2B maturity to the 2.56.x SDK train, nono maturity to v0.80.0 and community to 4.5k, aicontainer maturity to npm 0.11.0 (2026-10-13) and downloads to 505 a month, and flue community to 8.5k, plus the volatile cells (Landrun 2,316 stars and 82 days quiet, Drop 385, Brig 229, Fence 991, Microsandbox 8.7k, NVX 394, Yolobox 649), the audit prose’s stale v0.1.2 parenthetical corrected to v0.1.4, and all other cells re-verified against the refreshed notes and unchanged.
  • 2026-10-16 - Cell refreshes with no membership change: Agent Sandbox maturity to v1.0.7 (2026-10-15, sandboxd bearer-token authentication and streaming Go SDK execution) and community to 4.3k, aicontainer maturity to npm 0.12.1 (2026-10-14, the root-PATH hardening release), Landrun’s quiet window to eighty-five days, and the community row refreshed against today’s API reads (aicontainer 21, Brig 231, Brood Box 78, CubeSandbox 13.0k, Drop 386, E2B 14.4k, Fence 992, Landrun 2,315, NemoClaw 22.8k, NVX 400, OpenSandbox 15.9k, OpenShell 16.4k with about 132 contributors unchanged, Yolobox 651); all other cells re-verified against the refreshed notes and unchanged.
  • 2026-10-17 - Cell refreshes with no membership change: Brig maturity to v0.4.1 (2026-10-16, the runtime bundle pinned at rc17, the remote-and-Kubernetes non-goals reopened), Microsandbox pricing to free self-hosted plus the private-beta hosted cloud (recorded in its note today), and OpenSandbox maturity to the 1.2.0-rc.1 prerelease of 2026-10-15 (OSEP-0024 auto-pause); star figures left untouched per the stars-exempt rule.
  • 2026-10-18 - Cell refreshes with no membership change: Yolobox maturity to v0.19.8 (2026-10-18, OpenCode launch fixes, sixty-seven releases) and Landrun’s quiet window ended (commit train resumed October 2026 on Landlock ABI 10 and UDP work, v0.1.17 still the newest release); star figures left untouched per the stars-exempt rule.
  • 2026-10-20 - Cell refresh with no membership change: Yolobox maturity to v0.19.10 (2026-10-20, image pull and build progress kept off the ACP stdout stream, sixty-nine releases); star figures left untouched per the stars-exempt rule.
  • 2026-10-21 - Extended to twenty-three columns with Overalls (ghuntley’s renamed Weaving Loom, the self-hosted Firecracker dev-machine platform, admitted from the software-factory handoff), inserted alphabetically, with the intro counts, boundary, backing, credential, and audit prose updated.
  • 2026-10-23 - Cell refreshes with no membership change: Agent Sandbox maturity to v1.0.8 (2026-10-22, bounded MCP command output), Microsandbox maturity to v0.7.9 (2026-10-22, live port and label modifications), OpenShell maturity to v0.1.5 (2026-10-20, push-mode policy delivery and the published Sandbox Protocol), E2B maturity to the 2.59.x SDK train (DNS allowlists in the egress firewall, apiUrl deprecation), and OpenSandbox maturity to the 1.2.0-rc.2 prerelease (the OSEP-0022 credential vault landing end to end); the audit prose’s OpenShell parenthetical corrected to v0.1.5; star figures left untouched per the stars-exempt rule.

See also
#

References
#