Layers / Orchestration / Agents / Code execution sandboxes

Code execution sandboxes

Q: What is in the Code execution sandboxes category?

46 products in the Orchestration / Agents layer of the AI stack. Running model-generated code without trusting it: containers, microVMs, WASM, language-level jails, with the isolation and timeout that make it safe. Listed members include daytona, firecracker and opensandbox. Every fact on each listing carries the page it was read from and the date it was read.

Q: How are Code execution sandboxes compared here?

By the 6 attributes this category declares, asked of every member and answered only where a source states it. A product with no answer on record shows a gap rather than a guess, and no blended score is published — weights would be an opinion presented as arithmetic.

Q: daytona or firecracker?

Both are listed under Code execution sandboxes. We publish no verdict between them — we hold no benchmark that would support one. What we do hold is the same attribute sheet for each, side by side with the source behind every value, at /compare/daytona-vs-firecracker.

Q: What does a blank mean on a code execution sandboxes row?

That nobody has told us, not that the answer is no. A hollow ring is "no answer on record", which is a different state from a recorded no — and the two look different on purpose. A listing with a blank has not failed the question; it has not been read for it.

Q: How often are code execution sandboxes figures re-read?

Every value carries the date it was read and a link to the page it came from. Prices move fastest and are re-read most often; an attribute read weeks ago says so rather than presenting itself as current. Anything past 21 days is hidden rather than shown stale.

Q: Is this every code execution sandboxe there is?

No. This is 46 we have read and can cite. A directory that claimed completeness would be making a promise it cannot keep, so the page states its own count instead and says when a category is too thin to shortlist from.

Q: Can a vendor pay to rank higher here?

No. Nothing on this page can be bought: a sponsor cannot enter a table, reorder a row or change a mark, and there is no ranked position for sale. How the site is paid for, and the line each source of money does not cross, is set out under money and independence at /our-data#sec5.

COMPARE TWO OF THESE →

Running model-generated code without trusting it: containers, microVMs, WASM, language-level jails, with the isolation and timeout that make it safe.

46 in this category

SORTED BY STARS

NARROW BY WHAT THIS CATEGORY ASKS

LICENCE · 6 NOT READ

EXECUTION LANGUAGES · 12 NOT READ

ISOLATION · 25 NOT READ

PRODUCTUSED BYSTARSDOWNLOADS 30D

daytonaDaytona is a Secure and Elastic Infrastructure for Running AI-Generated Code71,724

firecrackerSecure and fast microVMs for serverless computing.36,684

opensandboxSecure, Fast, and Extensible Sandbox runtime for AI agents.15,142

cubesandboxInstant, Concurrent, Secure & Lightweight Sandbox for AI Agents.12,174

astridAstrid is a portable, capability-secure operating system for composable software.10,273

react-cosmosSandbox for developing and testing UI components in isolation8,684

microsandbox🧱 easy, fast, programmable and local-first microVM runtime and library8,212

sandboxAll-in-One Sandbox for AI Agents that combines Browser, Shell, File, MCP and VSCode Server in a single Docker container.5,897

arcboxRun AI agents on real and isolated machines — own kernel, filesystem, and network — with <100ms boot. Local first, OCI compatible, pure Rust.5,420

the-powder-toyWritten in C++ and using SDL, The Powder Toy is a desktop version of the classic 'falling sand' physics sandbox, it simulates air pressure and velocity as well as heat.5,303

judge0Robust, fast, scalable, and sandboxed open-source online code execution system for humans and AI.4,430 Vvm2Advanced vm/sandbox for Node.js4,101

agent-sandboxagent-sandbox enables easy management of isolated, stateful, singleton workloads, ideal for use cases like AI agent runtimes and reinforcement learning (RL).3,818

u3-sdkSource code for Unturned, a free open-world zombie survival sandbox game.3,791

arrow-jsThe first UI framework for the agentic era — tiny, performant, with WASM sandboxes for safe code execution.3,756

cubyzVoxel sandbox game with a large render distance, procedurally generated content and some cool graphical effects.3,652 Ccapev2Malware Configuration And Payload Extraction3,489

holmesgptSRE Agent - CNCF Sandbox Project3,272

forkdFork() for AI agent microVMs. Spawn 100 children in ~100ms from a warm parent; BRANCH a live VM in ~150ms. KVM-isolated, snapshot CoW.2,839

pistonA high performance general purpose code execution engine.2,808

kubearmorRuntime Security Enforcement System. Workload hardening/sandboxing and implementing least-permissive policies made easy leveraging LSMs (LSM-BPF, AppArmor).2,611

zerobootSub-millisecond VM sandboxes for AI agents via copy-on-write forking2,444

boxliteThe micro-VM for AI agents — light enough to embed on your laptop, elastic enough to power an agentic cloud.2,316 LlandrunRun any Linux process in a secure, unprivileged sandbox using Landlock. Think firejail, but lightweight, user-friendly, and baked into the kernel.2,285 Jjs-interpreterA sandboxed JavaScript interpreter in JavaScript.2,184

open-coworkOpen-source AI agent desktop app for Windows & macOS. One-click install Claude Code, MCP tools, and Skills — with sandbox isolation, multi-model support, and Feishu/Slack integration.2,134

sandbox-agentRun Coding Agents in Sandboxes. Control Them Over HTTP. Supports Claude Code, Codex, OpenCode, and Amp.1,561

sandbox-sdkRun sandboxed code environments on Cloudflare's edge network1,128

ide✨ Simple, free and open-source online code editor.1,121 Lllm-sandboxLightweight and portable LLM sandbox runtime (code interpreter) Python library.1,119

dormiceThe SQLite of agent sandboxes — self-hosted, E2B-compatible. One machine, sandboxes that live forever, idle costs nothing.1,084

naerskBuild Rust projects in Nix - no configuration, no code generation, no IFD, sandbox friendly.1,011

TensorlakeTensorlake is a serverless runtime for sandboxes and deploying background agentic applications997

claude-code-devcontainerSandboxed devcontainer for running Claude Code in bypass mode safely. Built for security audits and untrusted code review.939

coderunnerA local sandbox for your AI agents891

k7Your own self-hosted infra for lightweight VM sandboxes to safely execute untrusted code. CLI, API, Python SDK. ⭐ Star it if you like it! ⭐801

code-on-incusGive each AI agent its own isolated machine with root, Docker, and systemd. Active defense detects and stops threats automatically.700

SWE-ReXSandboxed code execution for AI agents, locally or on the cloud. Massively parallel, easy to extend. Powering SWE-agent and more.588 Cclaude-agent-serverRun Claude Agent (Claude Code) in a sandbox, control it via websocket583

agenvoySelf-hosted 24/7 personal AI agent that runs on your own machine — memory, schedules, tools and credentials stay local. Single Go binary with MCP.513

codejailSecure code execution478

kernRootless container runtime with no daemon. Runs agent tool calls and LLM-generated code in kernel-enforced containers.398

docksideCreate dev containers that mirror your prod environment and sandbox your Claude/Codex CLIs. Develop with VS Code/Jet Brains, via SSH with e.g. Vim or VS Code in your browser. Unlimited staging for co-322 Jjs-sandboxSecurely embed JavaScript code into a Rust application300

RuntmOpen-source sandboxes where coding agents build and deploy. Spin up isolated environments where Claude Code, Cursor, and other agents code and deploy software.297

computesdkA free and open-source toolkit for running other people's code in your applications.271

SORTED BY ONE STATED COLUMN · USED BY = LISTED PRODUCTS DEPENDING ON IT, IN THIS DIRECTORY — NOT A POPULARITY FIGURE · NO OVERALL SCORE AND NO RANK COLUMN, BECAUSE BLENDING ADOPTION, STARS AND DOWNLOADS NEEDS WEIGHTS, AND WEIGHTS ARE AN OPINION PRESENTED AS ARITHMETIC

Cite this page

The count and its date sit inside the citation, because “Code execution sandboxes” without a date is a claim that quietly goes wrong as the category fills.

infratoapp, “Code execution sandboxes — Orchestration / Agents”, read 27 October 2026. 46 listed products. https://www.infratoapp.com/layers/agents/sandboxing

No overall score, and no rank column

Blending adoption, stars and downloads needs weights, and weights are an opinion presented as arithmetic — so this table sorts by one stated column at a time and shows which. This view holds no billing column and joins no billing table: a sponsor cannot appear higher, and the signals meter is a row’s own confidence, never a score you can sort on.

Frequently asked

What is in the Code execution sandboxes category?

46 products in the Orchestration / Agents layer of the AI stack. Running model-generated code without trusting it: containers, microVMs, WASM, language-level jails, with the isolation and timeout that make it safe. Listed members include daytona, firecracker and opensandbox. Every fact on each listing carries the page it was read from and the date it was read.

How are Code execution sandboxes compared here?

By the 6 attributes this category declares, asked of every member and answered only where a source states it. A product with no answer on record shows a gap rather than a guess, and no blended score is published — weights would be an opinion presented as arithmetic.

daytona or firecracker?

Both are listed under Code execution sandboxes. We publish no verdict between them — we hold no benchmark that would support one. What we do hold is the same attribute sheet for each, side by side with the source behind every value, at /compare/daytona-vs-firecracker.

What does a blank mean on a code execution sandboxes row?

That nobody has told us, not that the answer is no. A hollow ring is "no answer on record", which is a different state from a recorded no — and the two look different on purpose. A listing with a blank has not failed the question; it has not been read for it.

How often are code execution sandboxes figures re-read?

Every value carries the date it was read and a link to the page it came from. Prices move fastest and are re-read most often; an attribute read weeks ago says so rather than presenting itself as current. Anything past 21 days is hidden rather than shown stale.

Is this every code execution sandboxe there is?

No. This is 46 we have read and can cite. A directory that claimed completeness would be making a promise it cannot keep, so the page states its own count instead and says when a category is too thin to shortlist from.

Can a vendor pay to rank higher here?

No. Nothing on this page can be bought: a sponsor cannot enter a table, reorder a row or change a mark, and there is no ranked position for sale. How the site is paid for, and the line each source of money does not cross, is set out under money and independence at /our-data#sec5.