- Fixes the 1.1.0 server wheel: FastPath stubs now ship in the package and installs import cleanly; SDK/CLI/server packages publish at 1.1.1 (#1959)
- Identity-bound filesystem operations: execd executes file APIs as an explicit Linux UID/GID, with FilesWithIdentity/fileswithidentity in all five SDKs; isolated sessions gain multiple independent…
- Server hardening: snapshot creation submits the runtime object before persisting so early reads can't map to Failed, proxied backend failures map to 502/504 instead of a generic 500, and…
- Implement pause/resume for the agent-sandbox provider by bridging to spec.operatingMode (Running/Suspended) on agents.x-k8s.io/v1beta1, with state derivation (Paused/Pausing/Resuming/Terminated)…
- Isolate tenants that share one Kubernetes namespace: creates stamp opensandbox.io/tenant, and list/get/delete/pause/resume/proxy hide other tenants' labeled sandboxes as 404 while unlabeled legacy…
- Heal the silent renew-intent drop after a server restart in multi-tenant mode: the resolver now falls back to a cluster-wide label lookup with a 403 circuit breaker and structured warnings, trusts…
OpenSandbox by opensandbox-group
Secure, Fast, and Extensible Sandbox runtime for AI agents.
Agent tooling for cost, context and memory
New · Added to AgentGid on Oct 14, 2026Open source · Apache-2.0Free to start
Recently added on Oct 14, 2026. The description, category and pricing were filled in from public metadata and have not been checked by an editor yet.
Price
Free (OSS)
free and open source
Popularity
#35 in Agent tooling
Gid Score 36 / 100 · #35 of 65 ranked agent tools
Trend
Gaining stars
about +25 GitHub stars a day
Development
Actively updated
latest 1.1.1, 12d ago
Community
16K GitHub stars
public signals
Usage data: latest readings Oct 21, 2026, last checked Oct 21, 06:33 UTC. Date of each number
What OpenSandbox does
It is free and open source (Apache-2.0); you pay only for the models it calls.
Key facts
| Maker | opensandbox-group |
|---|---|
| First released | December 2025 |
| License | Apache-2.0 |
| Main language | Python |
| Open issues and PRs | 130 |
Pricing
Open source under the Apache-2.0 licence; check the website for any paid hosted plans.
, checked Oct 14, 2026. Prices change often; confirm before you buy.
Quick answers
- Free to start?Yes
- Open source?Yes (Apache-2.0)
- Closest alternativeOpenShell · all alternatives
OpenSandbox alternatives
Best OpenSandbox alternatives compared · All agent tooling for cost, context and memory
| # | Agent | Gid Score | Downloads 7d | 7d | 30d | Stars | Latest release | Price | |||
|---|---|---|---|---|---|---|---|---|---|---|---|
| 1 |
OpenShellNVIDIA |
77 | 101K | down 14.1% | up 381.4% | 16.8K+103/day | 0.1.5yesterday | Free (OSS) | |||
| 2 |
|
72 | 22.9M | up 4.3% | — | 61.7K+79/day | 1.104.5today | Free (OSS) | |||
| 3 |
NVIDIA NemoClawNVIDIA |
69 | — | — | — | 22.8K+10/day | — | Free (OSS) | |||
| 4 |
|
64 | 9.5M | down 17.1% | up 17.7% | 36.1K+48/day | 4.66.0yesterday | Free + $29/mo | |||
| 5 |
|
64 | 2M | down 19.8% | up 0.3% | 194K+350/day | 2.11.04mo ago | Free + $16/mo | |||
| 6 |
|
60 | 3.2M | down 14.5% | up 21.9% | 14.5K+21/day | 2.11.2yesterday | Free + $150/mo | |||
| No agents match that filter. | |||||||||||
Ratings from people who use OpenSandbox
No ratings yet. Used OpenSandbox? Rate it and say what it is good and bad at.
OpenSandbox news
-
10 agents added to AgentGid
Octop, Corsair, OpenSandbox, Trail-Code, Chat ON Steroids, holaOS, Trueforge, EverOS, dsh-TUI, FrontierAgent
-
OpenSandbox 1.1.1 released
Fixes the 1.1.0 server wheel: FastPath stubs now ship in the package and installs import cleanly; SDK/CLI/server packages publish at 1.1.1 (#1959); Identity-bound filesystem operations: execd executes file APIs as an explicit Linux UID/GID, with…
What changed: recent OpenSandbox releases
17 stable releases in the last 90 days · Full changelog
- First unified umbrella release: every artifact ships at 1.1.0 from tag release-1.1.0, with a Sigstore-signed BOM as the digest authority
- First release of the Fast Sandbox integration: a Firecracker microVM runtime behind the FastPath fleets backend, with pause/resume, ingress FastPath routing, and fsb template management in all…
- Snapshot persistence gains an opt-in PostgreSQL store with multi-process HA and a SQLite migration command, and sandboxes gain preStart/periodic lifecycle hooks
- Add the FastPath fleets lifecycle backend: create, renew, delete, and status mapping served through FastPath v2, plus end-to-end fsb pause/resume with async 202 semantics and UID fencing (#1703 #1844)
- Converge snapshot status via a per-namespace watch instead of blocking polls, and add fast-sandbox snapshot support (#1846)
- Add an opt-in PostgreSQL snapshot store with pooled connections and CAS semantics, a one-shot migrate-snapshots command for moving SQLite records, and multi-process HA coordination for snapshot…
Earlier releases
- OPENSANDBOXEGRESSSANDBOXID is now server-injected and rejected in request env — the server unconditionally sets the egress sidecar's sandbox-id attribution variable in both Docker and Kubernetes…
- Sandbox lifecycle hooks (preStart / periodic), OSEP-0020 — CreateSandboxRequest.lifecycle is accepted, validated (reserved transports, duplicate periodic names, pool-allocation combinations), and…
- preStart.timeoutSeconds limit raised from 300s to 3 hours — server and OpenAPI limits now allow up to 10800s for pre-start hooks; the periodic limit stays at 300s. The execd-side product policy…
- QEMU VMState pause/resume for runc-based sandboxes — opt-in capture of guest memory/vCPU/device state via QMP migration; rootfs and compressed VMState are stored as separate OCI images keyed by…
- Pool capacity exhaustion is now machine-identifiable — the controller publishes a PoolAllocationPending/PoolCapacityExhausted condition; the server waits a bounded acquisition window (new…
- Pool allocation summary in lifecycle responses — getSandbox now surfaces an optional Sandbox.allocation block (mode: pool, poolRef, state: allocated) for confirmed Kubernetes pool allocations,…
- execd as sandbox init (OSEP-0018). execd can now run as PID 1: single reaper with a managedProcess abstraction on every launch path, signal forwarding (TERM/HUP/USR1/USR2/WINCH), entrypoint-owned…
- Pre-exec hardening floor. The new opensandbox-launcher native helper applies env strip → KEEPCAPS → bounding-set trim → nonewprivs → identity drop → seccomp → execve; [landlock] adds a filesystem…
- eBPF observation variant. execd-ebpf (CGO + cilium/ebpf) hooks exec/connect/privilege with CO-RE, scoped to the sandbox cgroup, emitting a rotating JSONL audit; needs kernel ≥5.10 with BTF. The…
- preStart and periodic lifecycle hooks (OSEP-0020). CreateSandboxRequest.lifecycle is transported to the sandbox via the internal OPENSANDBOXLIFECYCLE env (Kubernetes; the Docker provider rejects…
- In-namespace signals no longer leak into /command in init mode. kill -HUP 1 previously killed whatever /command was running (signal: hangup); signals are now owned by the init forwarder only. (#1546)
- PTY creation failure emitted a second success body. POST /pty now stops immediately after the error response instead of appending a success body and a nonexistent session id. (#1603)
- Resilient HTTP transport — Async and sync clients now share a configurable retry transport with backoff, jitter, Retry-After handling, per-attempt timeouts, an overall deadline, and retry…
- Sandbox lifecycle hooks — Sandbox.create and SandboxSync.create now accept optional preStart and periodic lifecycle hooks, with stable Python models and server-aligned validation. Hook timeout…
- Background runs in isolated sessions — Isolated sessions can start detached work and poll its status and incremental combined output. Active background runs suspend idle collection; read-only…
- Runtime allocation and hardening visibility — Sandbox responses can expose confirmed Pool allocation summaries, while isolated capabilities include execd init mode and hardening-layer state. These…
- Pool capacity back-pressure — Compatible lifecycle servers can now surface exhausted Kubernetes Pool capacity as HTTP 429 with KUBERNETES::POOLCAPACITYEXHAUSTED and Retry-After, instead of…
- Faster sandbox startup — Async sandbox creation, connection, and resume resolve execd and egress endpoints concurrently, reducing the two management API lookups to one parallel wait. Failure…
- Client-pool reconcile interval is no longer configurable — SandboxPool.Builder.reconcileInterval(...) and the corresponding PoolConfig setting have been removed. Pool reconciliation now runs on a…
- Scalable asynchronous client-pool warmup — Pool refill now separates create, readiness, prepare, post-prepare health checking, renewal, and commit into a staged asynchronous pipeline. Create…
- Pool warmup tracing and operational summaries — Applications can opt in with ConnectionConfig.enableTracing(true) to emit OpenTelemetry traces covering queue wait and every warmup phase, using the…
- Lifecycle hook models — Sandbox creation now accepts additive preStart and periodic lifecycle hook models. Hook timeout validation remains authoritative on the server rather than being duplicated…
- Detached runs in isolated sessions — Kotlin consumers can start background work inside a persistent isolated session, poll its status, and read logs incrementally. Background runs are bounded by…
- Richer runtime metadata — The SDK now models execd hardening capability results and exposes an optional Sandbox.allocation summary for confirmed Kubernetes Pool allocations. Allocation metadata is…
OpenSandbox popularity and usage data
The GitHub repository has 16K stars, 611 of them added in the last 30 days. The latest stable release is 1.1.1, published Oct 9, 2026; there were 2 stable releases in the past 30 days.
Download the raw daily series: opensandbox.csv
Gid Score breakdown
Adoption—
Community50
Attention—
Momentum52
Each component is scored 0 to 100 from public signals; a dash means no data for it. Methodology.
How fresh these numbers are
| Number | Latest reading | Last checked |
|---|---|---|
| GitHub stars | Oct 21, 2026 | Oct 21, 06:33 UTC |
We fetch every source once a day. Registries publish downloads and page views a day or two late, so their latest reading trails the check. A reading more than 4 days old is marked out of date; the Gid Score still uses it until a newer one arrives.
OpenSandbox FAQ
How much does OpenSandbox cost?
Open source under the Apache-2.0 licence; check the website for any paid hosted plans.
Is OpenSandbox open source?
Yes. OpenSandbox is open source, released under the Apache-2.0 license.
How popular is OpenSandbox?
The GitHub repository has 16K stars, 611 of them added in the last 30 days. The latest stable release is 1.1.1, published Oct 9, 2026; there were 2 stable releases in the past 30 days.
What is the latest version of OpenSandbox?
The latest stable release we track is 1.1.1, published on Oct 9, 2026.
What are the alternatives to OpenSandbox?
The closest alternatives in the same category by Gid Score are OpenShell, LiteLLM, NVIDIA NemoClaw, Langfuse.
For the makers of OpenSandbox badges, corrections
Add a live badge to your README or site:
[](https://agentgid.com/agents/opensandbox/)[](https://agentgid.com/agents/opensandbox/)Something wrong or outdated on this page? Send a correction with a link to the official source. More for makers.
Where these numbers come from
GitHub: opensandbox-group/opensandbox. Site rank: open-sandbox.ai on the Tranco list. See data sources for how each one is collected.
Product facts and pricing were checked against: open-sandbox.ai, github.com.