Runs AI coding agents inside isolated Docker containers
FreeFreeFree tier
About Runs AI coding agents inside isolated Docker containers
Agent Sandbox is an open-source tool that runs AI coding agents inside isolated Docker containers with strict security restrictions. It supports agents like pi and opencode, preventing root access, Docker socket access, and privilege escalation. Users can run agents with specific language runtimes (Go, PHP 8.4, PHP 8.5) and optionally enable a proxy sidecar to restrict network access to an allowlist of domains. The tool uses multi-stage Docker builds based on Chainguard's node:latest-dev image and bind-mounts the current working directory for agent file operations.
Key Features
Isolated Docker containers with no root access, no Docker socket, and no privilege escalation
Supports pi and opencode AI coding agents
Run agents with specific language runtimes: Go, PHP 8.4, PHP 8.5
Optional proxy sidecar for restricted network access via allowlist
Multi-stage Docker builds based on Chainguard's node:latest-dev
Bind-mounts current working directory for agent file editing
Installation via symlink with --build option for image creation
Strict security: --cap-drop=ALL, --no-new-privileges, runs as non-root host UID
Pros & Cons
Pros
- Strong security isolation: agents cannot escape container or escalate privileges
- Open source and free to use
- Supports multiple AI agents (pi, opencode) with easy switching
- Configurable language runtimes for specific development needs
- Optional network restriction via proxy sidecar with allowlist
- Simple installation and usage via command line
Cons
- Requires Docker to be installed on the host machine
- Only supports two agents by default (pi, opencode)
- Documentation limited to a README file
- May require familiarity with Docker and containerization concepts
Best For
Sandboxed execution of AI coding agents to modify source code safelyRunning AI agents for code generation and editing in isolated environmentsTesting and developing AI agents with restricted network accessSetting up reproducible, secure AI-assisted development workflows
FAQ
How does the security model work?
Containers run as the host user's UID (non-root) with all Linux capabilities dropped and --no-new-privileges enforced. Agents cannot install system packages, access the Docker socket, or escape via privilege escalation.
Can I restrict network access for agents?
Yes, you can enable the proxy sidecar with --proxy flag. The agent container is placed on an isolated internal Docker network and all outbound traffic is forced through a tinyproxy that enforces an allowlist of permitted hostnames.
What language runtimes are supported?
Supported runtimes include base (Node.js + npm), Go (Go 1.26), PHP 8.4, and PHP 8.5. You can specify a runtime with the --lang flag.