Purpose
awesome-ai-coding-sandboxes is a curated resource list for the secure operation of AI coding agents. AI coding agents (such as Claude Code, Codex, OpenHands, etc.) execute arbitrary commands generated by the model, so the core issue is not speed of execution, but the security boundary: whether isolation is strong enough, whether the agent can exfiltrate data through network egress, whether secrets are held directly by the agent, and whether the workspace state of long-running tasks is persistent. The list is organized around the principle of security posture first, helping developers screen sandbox solutions suitable for running untrusted agent code.
Key Capabilities
The list provides a comparison matrix, sorted by isolation level: microVMs (separate kernel) > gVisor (user-space kernel) > containers (shared kernel) > processes. It also notes egress control capabilities, including default-deny, allowlist, configurable, default-open, or none; and secret handling methods, divided into broker-managed (credentials do not enter the sandbox) and environment injection. The matrix also distinguishes between ephemeral and persistent workspaces, and notes proprietary solutions. The list points out that solutions that restrict egress by default are a minority, while broker-managed secrets have reached a certain scale. Solutions with a strong security posture combination (microVM/VM + restricted egress + broker-managed secrets) are few in number. In addition, the list covers details such as EU data residency, control plane reachability, and authentication.
How to Use
The list is provided as a GitHub repository, containing a comparison matrix and a categorized list of projects. The categories include: microVMs, containers and gVisor, process and namespace sandboxes, filesystem and WebAssembly sandboxes, isolation building blocks, and tools that are related but not untrusted-code sandboxes. Every matrix cell requires a source link, and missing information is marked with a question mark. The repository provides CONTRIBUTING.md and a code of conduct, welcomes PR submissions, with each PR limited to one project. The data is published as _data/sandboxes.json, regenerated and compared by CI on every change.
Use Cases
Suitable for developers, security engineers, and platform teams that need to run code generated by autonomous AI coding agents, for evaluating and selecting sandbox solutions. It is especially suitable for scenarios focused on prompt injection risks, data exfiltration protection, and secret management. The list explicitly does not measure cold start latency, throughput, pricing, SDK ease of use, and language coverage, which are better covered by other resources.
Limitations
The list ranks based on documentation rather than implementation; default-denyThe annotations only indicate that the project documentation describes it as such; they are not penetration test results, nor has escape research been conducted. A strong security posture line does not equal a secure deployment; agent-hosted keys still need to be configured correctly; the strictness of the allowlist depends on the entries; and if a micro-VM mounts a host directory, the boundary fails. The list suggests using it as a preliminary screening tool, then reading the documentation of the candidate solutions. Regarding control plane authentication, AgentENV currently has no built-in API authorization, and the maintainers require deployment behind a trusted network or an authorized proxy. EU data residency is offered by only a few hosted solutions.
