superradcompany/microsandbox

**Microsandbox** runs **untrusted workloads** inside fast, local microVMs: AI agents, user code, plugins, CI jobs, dev environments, scrapers, and automation.
- **Hardware Isolation**: Hardware-level isolation with tiny virtual machines.
- **Fork & Snapshot**: Fork live sandboxes[^demo]. Save running sandbox state and restore later.
- **Cross Platform**: Runs on Linux, macOS, and Windows.
- **OCI Compatible**: Runs standard container images from Docker Hub, GHCR, or any OCI registry.
- **Docker-Like Workflows**: Familiar image, command, shell, and volume workflows.
- **Instant Startup**: Average boot times[^boot-time] under 100 milliseconds.
- **Embeddable**: Spawn VMs right within your code. No setup server. No long-running daemon.
- **Secrets That Can't Leak**: Unexploitable secret keys that never enter the VM.
- **Long-Running**: Sandboxes can run in detached mode. Great for long-lived sessions.
- **Agent-Ready**: Your agents can create their own sandboxes with our Agent Skills and MCP server.
  Getting Started
  Install the CLI
>
>
>
>
>
>  We also support other package managers →
>
> ##
>
>
>
>
>
>
>
>
>
>
>
> ##
>
> Start creating sandboxes once installed:
>
>
  Install the SDK
>
>
>
>
>
>
>
> **Requirements**:
>
> - **macOS**: Apple Silicon.
> - **Linux**: KVM enabled.
> - **Windows**: WHP enabled.
>
> **Warning**: Microsandbox is still **beta software**. Expect breaking changes, missing features, and rough edges.
  CLI
The msb CLI provides a complete interface for managing sandboxes, snapshots, images, and volumes.
  Run a Command
>
  Named Sandboxes
>
>
>
>
>
>
>
>
> Forking duplicates live execution. Restoring starts from saved state; add --cow-mem to share unchanged memory from a full snapshot. Snapshot generations describe progression, while branches describe distinct paths through snapshot history. The old --forked restore flag remains a deprecated alias. See forking and snapshots.
>
>
  Image Management
>
  Configuration File
>
>
>
  Install & Uninstall Sandboxes
>
  Status & Inspection
>
> [!TIP]
>
> Run:
> · msb --help for quick help menu.
> · msb --tree for complete command hierarchy and descriptions.
> · msb --tree for a specific command tree.
  SDK
The SDK lets you create and control sandboxes directly from your application. Sandbox.builder("...").create() boots a microVM as a child process. No infrastructure required.
  Run Code in a Sandbox
>
>
>
>  Rust Example →
>
>
>
>
>
>  Python Example →
>
>
>
>
>
>  Ruby Example →
>
>
>
> See the Ruby SDK guide for installation, lifecycle,
> networking, and backend details.
>
>
>
>
>  Go Example →
>
>
>
>
> The first call to create() pulls the image if it isn't cached locally, so it may take longer depending on your connection. Subsequent runs reuse the cache.
  Guides
Practical ways to put microsandbox to work:
> • **Docker in a Sandbox**: Run Docker without touching the host daemon.
> • **OpenCode**: Give a coding agent an isolated project workspace.
> • **Browser Use**: Run an AI browser agent inside a microVM.
> • **Playwright**: Run headless browser jobs inside a microVM.
> • **Warm Workers**: Snapshot a toolchain and launch clean workers.
> • **Migration Rehearsal**: Test a database migration, then restore the baseline.