microsandbox

Microsandbox is a local-first microVM runtime for executing untrusted code, agents, plugins and automation. It suits developers and platform teams that need stronger isolation than containers and want to run on laptops, servers or their own clusters. The central trade-off is clear: isolation and deployment control are strong, while the free allowance is small and cloud access is still gated.

Overview

Every sandbox gets its own Linux kernel, filesystem and network boundary instead of sharing the host kernel. That separation is a meaningful reason to consider Microsandbox for user-submitted code, AI agents, CI jobs, scrapers and plugins where a container’s shared-kernel model is not sufficient. It also makes the runtime relevant to teams building systems that must contain failures or reduce the blast radius of hostile workloads.

The local runtime launches on the user’s machine without a daemon, root service or account. This keeps local development from depending on a permanently running privileged service. The same runtime can run on your servers or clusters, and the cloud platform can be deployed inside your infrastructure, giving self-hosting teams more control over placement and data.

Key features

Microsandbox offers SDKs for TypeScript, Rust, Python, Go and Ruby, as well as a CLI and MCP workflows. That breadth makes it practical to integrate into application code, developer tooling or agent pipelines rather than forcing one interface. OCI images can be pulled from Docker Hub, GHCR, ECR, GCR and other registries, so existing image-based workflows can carry over.

Network policy starts permissive toward the public internet, but private, host-local, link-local and metadata destinations are blocked. You can replace that default with an allowlist or disable egress entirely. This is useful when workloads need selected APIs, but it requires deliberate policy decisions if unrestricted outbound access is inappropriate.

Bound secrets appear as placeholders inside the sandbox and are substituted on the host for supported intercepted requests to approved destinations. Secret handling is not universal pass-through: intercepted TLS is required by default, and request-body substitution must be enabled separately and obeys format and size limits. Teams with unusual protocols or large bodies should account for that constraint before relying on the feature.

Local full snapshots preserve disk, memory and running processes, which is valuable for pausing and resuming active environments. Managed cloud currently supports disk snapshots from stopped persistent sandboxes and disk restore, so cloud snapshot behavior is narrower than the local capability.

Pricing

The Free plan costs nothing, billed at $0 per month. It includes 5 vCPU-hours, 20 memory GiB-hours, 20 disk GiB-hours, up to three sandboxes, 1 GiB of durable storage and no overage rates. Each sandbox is capped at 1 vCPU, 512 MiB of memory and 8 GiB of writable disk. Those limits are suitable for experiments, small checks and personal development, but restrictive for sustained jobs or larger agents.

Builder costs $49 a month, billed $49 per month. It raises allowances to 500 vCPU-hours, 2,000 memory GiB-hours, 2,000 disk GiB-hours and 50 GiB of durable storage, with 1,000 ephemeral-running and 50 persistent-running. This is the sensible starting point for an individual developer or a small service that has outgrown the free caps.

Teams costs $299 a month, billed $299 per month. It provides 2,000 vCPU-hours, 8,000 memory GiB-hours, 8,000 disk GiB-hours, 250 GiB durable storage, 25,000 ephemeral-running and 500 persistent-running. Those larger pools fit shared workloads and higher concurrency better than Builder.

Enterprise uses a custom agreement. It includes 4,000 vCPU-hours, 16,000 memory GiB-hours, 16,000 disk GiB-hours and 500 GiB durable storage; ephemeral and persistent-running limits are set together, with a committed or BYOC model. Choose it when those deployment and capacity terms matter more than a posted price.

Platforms

Microsandbox supports API, Linux, macOS, self-hosted deployments and Windows. It offers both API/CLI access and deployment options for local or controlled infrastructure. Microsandbox Cloud is in private beta and requires an access request, so teams needing immediately available hosted capacity should not assume cloud access.

Who it's for

Choose Microsandbox for engineering teams running untrusted code that need microVM-level kernel separation, configurable egress and the option to self-host. It is especially well matched to agent platforms, CI systems, plugin execution and automation that must accept varied workloads. It is less suitable when a tiny free tier, broad hosted availability or unconstrained credential injection is the priority.

Pros and cons

• Pros: Separate kernels, filesystems and network boundaries provide stronger isolation than shared-kernel containers.
• Pros: Local startup needs no daemon, root service or account, reducing local operational overhead.
• Pros: Allowlisted or disabled egress gives meaningful control over outbound access.
• Pros: Open-source Apache 2.0 licensing and self-hosting support suit infrastructure owners.
• Cons: The Free plan has low compute, memory, disk and per-sandbox limits, with no overage option.
• Cons: Secret substitution depends on intercepted TLS, and body substitution is optional and constrained.
• Cons: Cloud access is private beta, while managed snapshots are limited to stopped persistent sandboxes.

Alternatives

For a broad directory of sandboxing choices, see Sandbox Software.

ANY.RUN is a better fit when you want a freemium service with a free trial and Android, iOS, web and desktop platform coverage.

Pick Context Agent Sandboxes when agent concurrency is the main concern and a free tier for one agent or a $20.00-per-month Plus plan for three agents meets your needs.

Daytona is an alternative for teams seeking freemium developer environments with a pay-as-you-go option and 5 GiB of storage free before storage charges.

Choose Docker Desktop when a conventional container workflow is preferable; its Personal plan is free and Pro is $9 a month.

Northflank suits teams wanting hosted services, databases and cron jobs, including a free Sandbox plan.

Anthropic Sandbox Runtime is a free alternative for Linux, macOS, Windows and self-hosted use.

CAPE Sandbox is a free, open-source self-hosted project with an online demonstration instance.

crun is a free Linux and self-hosted OCI container runtime for those who need containers rather than microVM isolation.

Verdict

Microsandbox is a strong choice for developers and platform teams that place kernel-level isolation, egress control and self-hosting ahead of a generous free quota. Its local, multi-language runtime and Apache 2.0 license broaden its usefulness. Look elsewhere if you need an immediately accessible managed cloud, higher free-plan limits or secret handling without TLS interception constraints.