Sandboxes on any Linux host

Move risky work out of your process. Model-generated code, user submissions, plugins, CI jobs — anything you would not run inline gets its own sandbox, with its own memory, CPU and process budget, and a workspace you can read and write directly.

npm install -g nativesandbox
nsbx run "node --version"

npx nativesandbox run "node --version"

That is the whole install. No binary to download, no runtime to version-match, nothing written to a dot-directory in your home.

Why nativesandbox

Runs where microVMs cannot

Containers need no nested virtualisation. On the cloud shapes that do not offer it — Oracle’s Ampere ARM64 free tier among them — a microVM cannot boot at all, and this can.

Nothing to install but the engine

Zero dependencies, and no runtime of its own. Podman or Docker is the runtime, and your distro already packages it.

The workspace is a directory

Bind-mounted, not copied through an agent channel. 7× faster to place 200 files and 49× faster to read them back than a microVM runtime on the same machine.

Warm caches between commands

Reuse is meet-or-exceed, so a sandbox built large serves a small command. A dependency install survives instead of going cold every time.

Hardened by default

Every Linux capability dropped, no-new-privileges, cgroup limits, and a network policy per sandbox — each verified against a real npm install, not assumed.

A fleet that reclaims itself

Idle stop and a hard maximum lifetime, recorded on the container so they outlive the process that set them. Neither interrupts a command in flight.

What people use it for

AI agents that run code. A tool call that executes whatever the model wrote, in a box.
Untrusted user submissions. Coding exercises, notebook cells, marketplace plugins.
Build and test isolation. A dependency install that cannot reach the rest of the host.
Per-tenant workspaces. One long-lived sandbox per customer, reclaimed when it goes quiet.
Anything on a host without /dev/kvm. Which, on the cheap cloud shapes, is most of them.

A minimal example

import { Sandboxes, MiB } from "nativesandbox";

const sandboxes = new Sandboxes();
const box = await sandboxes.create("hello", { memory: MiB(512) });

await box.writeFile("/main.js", "console.log('Hello from a sandbox!')");
const { stdout } = await box.exec("node main.js");

console.log(stdout);
await sandboxes.remove("hello");

const { Sandboxes, MiB } = await import("nativesandbox");

const sandboxes = new Sandboxes();
const box = await sandboxes.create("hello", { memory: MiB(512) });

await box.writeFile("/main.js", "console.log('Hello from a sandbox!')");
const { stdout } = await box.exec("node main.js");

console.log(stdout);
await sandboxes.remove("hello");

nsbx run "node -e \"console.log('Hello from a sandbox!')\""

Hello from a sandbox!

The trade, stated plainly

This is process isolation, not hardware isolation. A sandbox cannot read or write the host, but the boundary it leans on is the kernel rather than a hypervisor, and that is a weaker boundary. It is narrowed by running rootless, by dropping every capability, by seccomp, by cgroup limits and by a per-sandbox network policy — and it can be narrowed much further, at no cost, with gVisor, which still needs no KVM. If your host has KVM and you want hardware isolation, use a microVM runtime. This exists for the hosts that cannot. If you have seen this, that is you:

[BootStart] failed to start "…": sandbox process exited
(signal: 6 (SIGABRT) (core dumped)) before agent relay became available

Next steps

Quickstart

From nothing to a running sandbox, in one command.

Check your host

nsbx doctor tells you whether this machine can run sandboxes, and what to fix if not.

Isolation

What is taken away from every sandbox — and what is not defended against.

API reference

Every option and method.

Getting started

CLI

Guides

Operations

Sandboxes on any Linux host

Why nativesandbox

Runs where microVMs cannot

Nothing to install but the engine

The workspace is a directory

Warm caches between commands

Hardened by default

A fleet that reclaims itself

What people use it for

A minimal example

The trade, stated plainly

Next steps

Quickstart

Check your host

Isolation

API reference

​Why nativesandbox

Runs where microVMs cannot

Nothing to install but the engine

The workspace is a directory

Warm caches between commands

Hardened by default

A fleet that reclaims itself

​What people use it for

​A minimal example

​The trade, stated plainly

​Next steps

Quickstart

Check your host

Isolation

API reference

Why nativesandbox

What people use it for

A minimal example

The trade, stated plainly

Next steps