Coding Agent Sandboxes

This map organizes research about giving coding agents a constrained workspace. The useful question is not just which tool is best. It is which boundary each tool provides: files, network, credentials, runtime isolation, and review workflow.

Core Patterns

• Agent Isolation Boundaries
• Network Deny By Default
• Credential Brokering
• Copy Diff Apply Workflows
• Host Vs Guest Trust

Open-Source Project Analyses

• Agentcage
• Agentjail
• Aide Sandbox
• Byre
• Clawk
• Containarium
• Flar
• Gondolin
• Katsuobushi Sandbox
• Nix Opencode With Mitm
• Pi Landstrip
• Skynot
• Smolvm
• Take Ai Control
• Virtdev
• Watch Ly
• Yoloai
• Yolobox

Hosted Development Environments

• Bitrise Remote Dev Environments
• Claude Code Web
• Codeanywhere
• Exe Dev
• Fly Io Sprites
• Github Codespaces
• Instavm Coderunner
• Instavm Nixos Sandboxes
• Vercel Sandbox

Sandbox Runtimes

• Apple Container
• Firecracker
• Firejail
• Gvisor
• Incus
• Mkosi
• Podman Machine Os
• Quickemu
• Sandboxy
• Vagrant

Embedded Sandboxes

• Agentvm
• Amla Sandbox
• Cloudflare Workerd
• Container2wasm
• Vscode Container Wasm Gcc Example

Supporting Components

• Clawk Gvisor Tap Vsock
• Cloudflare Artifact Fs
• Housecat Scratch
• Paseo
• Tarit
• Vm Curator

Sources

• • source map for this research set.