agent-sandbox vs OpenShell
Kubernetes SIG Apps' Sandbox CRD and controller: stateful singleton pods with stable identity and persistent storage for agent runtimes and RL — templates, claims, warm pools; gVisor/Kata isolation. — versus — NVIDIA's safe runtime for autonomous agents: kernel-enforced sandboxes with policy on every file, syscall and connection; credentials injected only for approved endpoints.
Both run agent sandboxes on Kubernetes; agent-sandbox is a CRD for stateful sandbox pods, OpenShell adds kernel-level policy, egress control and credential injection.
| agent-sandbox | OpenShell | |
|---|---|---|
| Stars | 4.2k | 16k |
| Forks | 549 | 1.8k |
| Language | Go | Rust |
| License | Apache-2.0 | Apache-2.0 |
| Last activity | 3 days ago | yesterday |
| Topics | sandboxes, agents | sandboxes, security, agents |
| Curated connections | 8 | 4 |
agent-sandbox — the curator's take
Pick agent-sandbox when you already run Kubernetes and want agent sandboxes as a declarative, first-class resource: one long-lived pod per agent with a stable hostname, persistent volume, pause/resume and scheduled deletion, plus warm pools so claims start fast. It's upstream Kubernetes (SIG Apps), so it's the boring, vendor-neutral choice, with Go and Python SDKs and a router for reaching pods. The catch is in its own scope note: it orchestrates, it doesn't isolate. Security comes from the RuntimeClass you configure (gVisor, Kata); on the default runtime it's just a pod. No cluster? A microVM runtime like cubesandbox or a hosted sandbox SDK is far less machinery.
OpenShell — the curator's take
Reach for it when agents need real credentials and network but you want least privilege enforced below the agent — declarative policies, secrets the agent never sees, and a prover that flags risky new access for human review. More machinery than throwaway code execution needs; a microVM sandbox API is simpler there. On Kubernetes your CNI must enforce NetworkPolicy; Windows is WSL-only and experimental.