Local AI Agent Sandboxes

Executive Summary

Local sandbox tools separate an agent's requested work from the authority it receives on a developer machine. The useful questions are concrete: which files can it read or change, which destinations can it contact, where do credentials live, and what happens when a required restriction is unavailable?

There is no evidence here that containers have lost to operating-system policy wrappers. Both approaches remain available, and dedicated local microVM products now offer another option. Docker Sandboxes supplies a separate Linux kernel and Docker daemon; OpenShell supports container and MicroVM drivers; nono and srt restrict processes using host OS mechanisms.^[1][2][3][4]

This report compares 9 active standalone tools: Anthropic Sandbox Runtime, nono, Landrun, Fence, yolobox, Litterbox, Shai, Docker Sandboxes, and OpenShell. “Active” means an available project with a recent verified release, not an assurance of support or security.

The June assessment of Landrun is obsolete: v0.1.17 added Landlock ABI v9 support in July. Conversely, yolo-cage's repository is now explicitly archived. Release and archival evidence are more useful than classifying projects from star counts or a quiet month.^[5][6]

---

Scope and Membership

The shortlist covers command-level policy wrappers and packaged environments intended for running existing coding-agent CLIs locally. It includes different boundaries rather than pretending they are interchangeable. Built-in Codex, Claude Code, Copilot CLI, and Grok Build controls are a separate baseline below; they are not additional standalone members.

Docker Sandboxes and OpenShell enter this edition because they provide documented agent-launch workflows. The archived yolo-cage moves to historical context instead of the current shortlist.^[7][8][6]

Discovery also reviewed Microsandbox, Gondolin, and SmolVM. Their general VM lifecycle, SDK, or programmable-policy surfaces are useful building blocks for custom agent systems; this edition keeps them as adjacent infrastructure rather than expanding the launcher/wrapper shortlist into a catalog of VM runtimes. The agent sandbox infrastructure comparison covers that broader buying decision. This is a scoped comparison, not an exhaustive census.^[9][10][11]

---

Comparison Matrix

The policies below are defaults or documented options, not penetration-test results. Host support and restrictions can differ by version and backend.

A Docker or Podman container shares the kernel of its runtime host. On a Mac that host commonly sits in a Linux VM; this is different from a dedicated VM per agent sandbox. Compare the whole deployment, including mounted files and sockets, rather than assigning a security grade from the product name.^[1][18]

---

Release and Maintenance Evidence

Latest published releases checked September 15, 2026:

Litterbox's maintainer explicitly says other projects take priority and invites contributions. That is a supported maintenance caveat, unlike inferring abandonment from a small star count. The README also warns that main may be unstable and recommends tagged releases.^[19]

---

What Changes the Choice

Restrict the existing environment or create a new one

Srt, nono, Fence, and Landrun restrict a command and its descendants using OS facilities. They avoid rebuilding the toolchain into a separate guest, but continue to trust the host kernel and relevant supervisors. Nono's security model recommends an outer boundary for stronger assurance and multi-tenant scenarios.^{[4][3][16][14]}

Yolobox and Shai package container workflows. Litterbox deliberately exposes desktop integration and warns against using it to contain known malicious software. Docker Sandboxes provides a separate kernel per environment; OpenShell lets the operator choose container or MicroVM compute. Image upkeep, local storage, and the authority of shared paths remain operational responsibilities.^{[18][20][19][1][2]}

Hide a token or restrict what it can do

Nono's proxy keeps selected credentials outside the child, but --env-credential exposes a value in the child environment. Its tool broker can apply separate file, argument, and endpoint rules to selected commands. Those controls depend on the effective policy and trusted supervisor.^[12][33]

Docker's normal proxy-managed path also substitutes credentials on the host, while explicit environment secrets and OAuth passthrough can expose them. OpenShell Providers v2 binds substitution to endpoints. Neither prevents misuse of an API operation that the credential and network policy intentionally authorize.^[34][35]

Shai's configured host calls are another explicit capability: they execute on the host, outside the container. Yolobox's token passthrough and host Docker socket option likewise widen authority; they are not credential brokering by default.^[20][18]

Check degradation and exception paths

• Landrun: strict mode fails on a kernel lacking its target ABI. --best-effort trades restrictions for compatibility. Its documented TCP controls do not cover every protocol; the README flags Multipath TCP as a limitation.^[5][14]
• OpenShell: HTTP rules require the intended protocol and enforce mode to block violations. Landlock hard_requirement fails when enforcement is unavailable; the default best-effort behavior can continue without those restrictions.^[25]
• Fence: runtime command denial is executable-path based. A multiword intent such as git push is not a general guarantee that equivalent child-process behavior is impossible. Allowed domains can still receive sensitive data.^[16]
• Docker Sandboxes: clone mode mounts the source repository read-only, including ignored files. A .env there remains readable; separate writes do not imply separate secrets.^[1]

---

Built-in Agent Controls Are the Baseline

Codex currently documents Seatbelt on macOS, bubblewrap plus seccomp on Linux, and a native Windows implementation. WSL2 uses the Linux path. Approval policy is separate from sandbox mode: --ask-for-approval never suppresses prompts but does not itself disable the sandbox. Its --yolo alias disables both. Review defaults before adding another wrapper.^[36]

Claude Code's /sandbox applies to shell execution on macOS, Linux, and WSL2. Its native Windows sandbox remains unsupported even though standalone srt has a Windows alpha. Built-in file tools and desktop interactions have different boundaries. The current docs also offer credential deny/masking settings; credential brokering is no longer a capability that can be categorically ruled out for first-party tools.^[37][4]

Claude's allowUnsandboxedCommands: false and failIfUnavailable address retry and missing-dependency behavior, but exclusions and other tools still require review. Permission rules are enforced by the harness, while filesystem/network confinement comes from the sandbox. They solve different parts of the problem.^[37][38]

GitHub Copilot CLI now offers experimental local sandboxing, off by default. Its MXC backends use macOS Seatbelt, Linux bubblewrap, and supported Windows 11 BaseContainer. Built-in file tools run inside the unsandboxed CLI and apply policy on a best-effort basis; remote MCP servers are outside this local boundary. Its macOS proxy configuration relies on programs honoring proxy environment variables, unlike the Linux private-network-namespace path. If the host cannot support sandboxing, the default behavior is to disable it for the session; enforced enterprise settings fail closed instead. These documented distinctions belong in the baseline review before assuming an extra wrapper is unnecessary.^[39]

Grok Build uses Landlock on Linux and Seatbelt on macOS, with sandboxing off by default. Its workspace profile permits broad reads and networking. The strict and read-only profiles block child networking only on Linux; macOS does not enforce that restriction. Model and web-tool traffic remains separate. Even read-only permits session and temporary writes, and protecting credential paths requires an explicit deny policy. These are built-in agent controls, not a tenth standalone sandbox product.^[40]

Grok's plan review is a separate boundary: it gates edit tools, while shell commands can still write and subagents do not inherit the edit gate. For a repository audit, inspect both the permission policy and the selected OS sandbox rather than treating the word “plan” as a read-only guarantee. This focused addition was checked September 16, 2026; it is a documentation review, not an escape test.^[41]

---

Cost and Licensing

Srt, nono, Fence, Litterbox, and OpenShell use Apache-2.0; Landrun, yolobox, and Shai use MIT. These are runtime software licenses, not bundled model subscriptions or free infrastructure.^{[42][43][15][19][8][14][17][20]}

Docker's local sbx CLI is free for commercial use after sign-in, with separately paid organization governance; its releases repository is not an open-source runtime. Account requirements, host resources, model bills, and policy administration belong in the comparison alongside the download price.^[23][44]

---

Developer Experience and Limits of This Review

An August 10 Hacker News discussion provides useful first-hand Docker Sandboxes experiences: rusch valued everyday firewall and credential-proxy use but disliked login, while Humphrey liked concurrent sandboxes and criticized authentication and clone-workflow friction. These reports concern individual setups and earlier releases, not a comparative benchmark.^[45]

This review read current primary documentation and releases. It did not run escape tests, compare latency, or operate every tool. The shortlist therefore avoids a “most secure” winner and unqualified claims that any tool makes the host untouchable.

---

Recommendations

These are conditional starting points based on the documented boundaries above, not rankings based on stars or vendor affiliation.

When the requirement is a cloud agent platform

Disclosure: Ry Walker is CEO and co-founder of Tembo. Tembo provides coding-agent sessions in isolated cloud VMs, integrations, shared visibility, and managed or self-hosted deployment. It is relevant when teams want to move execution off individual laptops and operate the whole workflow. It is excluded from this report's local launcher/wrapper matrix because that is a different deployment and product scope, not because sandboxing is irrelevant to it.^[46]

Compare it in AI Agent Sandboxes when the requirement includes cloud execution and team operations. There is no verified Tembo integration with the local tools implied here.

---

Outlook

The useful direction is more explicit authority: per-tool grants, host-side credentials, separate guest kernels, and clearer handling of unsupported restrictions. These controls appear across different architectures; there is no supported reason to forecast one universal winner.

Choose the smallest environment that supplies the required boundary, then verify it with the actual repositories, tools, credentials, and host OS the team uses. Reassess after upgrades that change policy defaults or supported platforms.

---

Research by Ry Walker Research • methodology