microsandbox

Microsandbox is a local-first microVM runtime designed to safely execute untrusted code — such as AI agents, user scripts, plugins, CI jobs, scrapers, or dev environments — within lightweight, hardware-isolated virtual machines. It offers near-instant boot times (under 100ms on M1), cross-platform support (Linux, macOS, Windows), and OCI compatibility for running standard container images from Docker Hub or other registries. The tool provides both a CLI (msb) and SDKs for TypeScript, Rust, Python, Go, and Ruby, allowing developers to spawn sandboxes directly from their applications without requiring long-running daemons or server infrastructure. Key features include secrets that never enter the VM, network controls, persistent volumes, and detached mode for long-running sessions. It integrates with agent frameworks like Eve, LangChain, and Smithers, and supports use cases including browser automation (Playwright), Docker-in-sandbox, database migration rehearsal, and secure document conversion. The project is backed by Y Combinator and licensed under Apache 2.0. Note: Microsandbox is still in beta, with potential breaking changes and missing features.