ArchestackBest of Open-Source AI: List on GitHub ↗ (opens in a new tab)

Sandboxes

Isolated runtimes where agents execute code, browse or use tools safely.

Lightpanda leads with 92, ahead of Obscura (85) and OpenShell (85). 11 projects ranked by score. Updated from public GitHub data.

Same topic: Agent and MCP starters (43, starters to fork) · Agent platforms (48, ready to use) · Agent frameworks and SDKs (77, parts to build with). All categories

Coming from Browserbase? See the open-source alternatives.

The ranking

Sandboxes: full ranking
RankProjectAdoptionFreshnessMaintenanceAgent-readyScore
1LightpandaHeadless browser written in Zig for agents and scraping, with CDP and MCP36.9k starsAGPL-3.0last commit Oct 202691100917092 out of 100
2ObscuraRust headless browser with V8 and CDP for scraping and agents29.2k starsApache-2.0last commit Oct 202682100903085 out of 100
3OpenShellPolicy-enforced sandbox runtime for autonomous AI agents Live demo ↗ (opens in a new tab)19k starsApache-2.0last commit Oct 202666100908585 out of 100
#4NemoClawReference stack for running OpenClaw, Hermes and Deep Agents in OpenShell sandboxes22.8k starsApache-2.0last commit Oct 202674100768583 out of 100
#5opensandboxSandbox API for running AI agent code, commands and browsers in isolation16.1k starsApache-2.0last commit Oct 202653100937081 out of 100
#6cubesandboxMicroVM sandbox service for AI agents with an E2B-compatible API13k starscustom licenselast commit Oct 202643100904575 out of 100
#7montyEmbedded Python interpreter in Rust for running LLM-generated code8.8k starsMITlast commit Oct 202624100838571 out of 100
#8microsandboxEmbeddable local microVM sandboxes for running untrusted code and AI agents8.8k starsApache-2.0last commit Oct 202629100863068 out of 100
#9Open TerminalREST API shell and file server for AI agents to run commands and code3.4k starsMITlast commit Oct 2026110075053 out of 100
#10Steel BrowserBrowser API that manages Chrome sessions for Puppeteer, Playwright and Selenium7.9k starsApache-2.0last commit Oct 20261610045048 out of 100
#11Browser Use Web UIGradio UI for running browser-use agents with your own Chrome16.6k starsMITlast commit May 202658620036 out of 100

Momentum, Verified build, Docs and Privacy are not measured yet; their weight goes to the signals shown. A dash means the signal is not scored for that kind of project. Hover a number for its rating in words.

Reviews

192 out of 100

Lightpanda

Headless browser written in Zig for agents and scraping, with CDP and MCP

36.9k starsAGPL-3.0last commit Oct 2026

Lightpanda is a headless browser written from scratch in Zig, using V8 for JavaScript, libcurl for HTTP and html5ever for parsing, with no graphical rendering. It exposes a CDP server for Puppeteer and Playwright, WebDriver BiDi, an MCP server over stdio or HTTP, and a fetch command that dumps pages as HTML or Markdown. An agent mode records sessions as replayable scripts.

Strengths

  • README benchmark: 123MB peak vs 2GB for headless Chrome over 100 pages
  • Speaks CDP, WebDriver BiDi and MCP, so Puppeteer and Playwright clients can connect
  • Agent mode supports many LLM providers and local Ollama or llama.cpp, or runs with --no-llm
  • Agent sessions export to deterministic scripts that replay without a model

Weaknesses

  • No graphical rendering; web platform coverage is partial (see WPT results)
  • No native Windows binary; needs WSL2, and Linux binaries need glibc
  • Usage telemetry is on by default and must be disabled via environment variable
  • AGPL-3.0 license and a CLA required for contributions
  • no GPU
  • Docker
  • Needs Puppeteer or Playwright (optional client), LLM provider API key (agent mode only)
  • Models: Anthropic, OpenAI, Gemini, Google Vertex AI, Mistral
  • port 9222
Documentation ↗ (opens in a new tab)Website ↗ (opens in a new tab)Repository on GitHub ↗ (opens in a new tab)
285 out of 100

Obscura

Rust headless browser with V8 and CDP for scraping and agents

29.2k starsApache-2.0last commit Oct 2026

Obscura is a headless browser engine written in Rust that runs JavaScript through embedded V8 and exposes the Chrome DevTools Protocol, so Puppeteer and Playwright can connect to it. It has its own rendering layer for screenshots, screencasts and PDF export without Chromium, plus an optional stealth build with fingerprint randomization and tracker blocking. A CLI covers single-page fetch, parallel scrape, and a CDP server on port 9222.

Strengths

  • No Chrome or Node.js needed; release archives ship as prebuilt binaries for Linux, macOS and Windows
  • Connects to existing Puppeteer and Playwright scripts over CDP
  • README claims ~30 MB memory and ~85 ms page load versus headless Chrome
  • Parallel scrape command and DOM-to-Markdown CDP method suit LLM pipelines

Weaknesses

  • Independent rendering engine; long-tail CSS, some Web APIs and media playback may differ from Chromium
  • Stealth transport needs a separate build or archive, compiling BoringSSL with CMake and Clang
  • Blocks private-network fetches by default; local dev servers need --allow-private-network
  • Speed and memory figures are the project's own; independent verification not given in README
  • no GPU
  • Docker
  • port 9222
Documentation ↗ (opens in a new tab)Website ↗ (opens in a new tab)Repository on GitHub ↗ (opens in a new tab)
385 out of 100

OpenShell

Policy-enforced sandbox runtime for autonomous AI agents

Live demo ↗ (opens in a new tab)19k starsApache-2.0last commit Oct 2026

OpenShell runs each agent in an isolated sandbox where kernel controls restrict file access and system calls, and every outbound network connection is checked against a declared policy. Real credentials are injected only into requests bound for approved endpoints, and policy changes are checked with formal verification so risky new access waits for human review. It ships a CLI and gateway, SDKs for four languages, and a Helm chart.

Strengths

  • Filesystem, syscall and network rules declared per agent in a policy
  • Agents never see real credentials; injected only for approved endpoints
  • Policy changes are formally verified and gated for human review
  • SDKs for Python, TypeScript, Go and Rust; Helm chart for Kubernetes

Weaknesses

  • Default sandbox image is minimal Ubuntu with no agent installed
  • Windows support is via WSL 2 and marked experimental
  • Kubernetes needs a CNI that enforces NetworkPolicy
  • Anonymous telemetry is on by default; opt-out required
  • GPU optional
  • Docker + Compose
  • Needs Docker, Podman or host virtualization, Kubernetes with NetworkPolicy-enforcing CNI (optional)
  • Models: OpenRouter (example provider)
Live demo ↗ (opens in a new tab)Documentation ↗ (opens in a new tab)Repository on GitHub ↗ (opens in a new tab)
#483 out of 100

NemoClaw

Reference stack for running OpenClaw, Hermes and Deep Agents in OpenShell sandboxes

22.8k starsApache-2.0last commit Oct 2026

NemoClaw is a CLI-driven reference stack that installs a supported AI agent (OpenClaw by default, Hermes, or LangChain Deep Agents Code) inside an NVIDIA OpenShell sandbox. It adds guided onboarding, managed inference, network egress policy with operator approval, managed integrations and state persistence. The README labels it alpha.

Strengths

  • Network policy with baseline rules, presets and operator approval for egress
  • Supports three agents: OpenClaw, Hermes and LangChain Deep Agents Code
  • Guided installer with express presets for DGX and WSL hosts
  • Official docs cover architecture, sandbox hardening and CLI commands

Weaknesses

  • Labeled alpha; maintainer responses carry no guaranteed timelines
  • Depends on NVIDIA OpenShell as the sandbox runtime
  • No tagged release published
  • Hardware and RAM requirements are only in external docs, not the README
  • Docker
  • Needs NVIDIA OpenShell
  • Models: OpenClaw, Hermes, LangChain Deep Agents Code
Documentation ↗ (opens in a new tab)Repository on GitHub ↗ (opens in a new tab)
#581 out of 100

opensandbox

Sandbox API for running AI agent code, commands and browsers in isolation

16.1k starsApache-2.0last commit Oct 2026

OpenSandbox provides isolated environments where agents execute code, run shell commands, manage files and drive browsers or desktops, through a single lifecycle API. It runs locally on Docker and scales to Kubernetes, with SDKs for Python, Java/Kotlin, TypeScript, C#/.NET and Go, plus an `osb` CLI and an MCP server. Egress policies, an ingress gateway and a credential vault control network access.

Strengths

  • SDKs in five languages plus osb CLI and MCP server
  • Same lifecycle API for local Docker and Kubernetes deployments
  • Per-sandbox egress policies and a credential vault keep real secrets out of workloads
  • Firecracker runtime with pause/resume; reported 64 ms P50 creation time

Weaknesses

  • Docker required for local use; Kubernetes setup needed for the fast runtime
  • No hosted demo or playground listed in the README
  • Firecracker and pause/resume features documented only for the Kubernetes fast runtime
  • Server needs separate install and TOML configuration before first use
  • no GPU
  • Needs Docker, Python 3.10+, Kubernetes (optional, for cluster deployment)
Documentation ↗ (opens in a new tab)Website ↗ (opens in a new tab)Repository on GitHub ↗ (opens in a new tab)
#675 out of 100

cubesandbox

MicroVM sandbox service for AI agents with an E2B-compatible API

13k starscustom licenselast commit Oct 2026

CubeSandbox runs each agent sandbox in its own KVM MicroVM, built on RustVMM, and exposes an E2B-compatible API so existing E2B SDK clients can point at it by changing an environment variable. It runs on a single node or a multi-node cluster and includes snapshot/rollback, pause/resume, an eBPF network layer and an L7 egress proxy with credential injection. The README reports under 60ms cold start and under 5MB memory overhead per sandbox.

Strengths

  • Each sandbox gets a dedicated kernel in its own KVM MicroVM, not shared-kernel containers
  • E2B SDK compatible; README says switching needs one environment variable change
  • Snapshot, clone and rollback, plus auto pause/resume of idle sandboxes
  • Egress proxy injects credentials so API keys never enter the sandbox

Weaknesses

  • Requires x86_64 Linux with KVM for the quick start path
  • Multi-component stack (API, master, cubelet, eBPF switch, proxy), heavier than a single binary
  • Kubernetes deploy and cross-node pause/resume are marked preview
  • License detected as NOASSERTION; README badge says Apache 2.0, so verify
  • no GPU
  • Docker
  • Needs KVM, Linux x86_64, S3 (optional, for cross-node pause/resume)
  • port 12088
Repository on GitHub ↗ (opens in a new tab)
#771 out of 100

monty

Embedded Python interpreter in Rust for running LLM-generated code

8.8k starsMITlast commit Oct 2026

Monty is a Python 3.14 subset interpreter written in Rust, installed as a Python, JavaScript or Rust package. It runs model-written code with no filesystem, environment variables or network, so the code reaches the host only through functions and mounts the caller passes in. The README reports under 1ms to get a new sandbox from a running pool, compared with about 1500ms for a sandbox service.

Strengths

  • No filesystem, env vars or network inside; host access only via passed-in functions and mounts
  • Reported under 1ms sandbox start from a pool, versus about 1500ms for a sandbox service
  • Packages for Python (pydantic-monty), npm (@pydantic/monty) and Rust (monty crate)
  • Documents resource limits and snapshots; MIT licensed

Weaknesses

  • Runs only a subset of Python, so some model-written code will not execute
  • Server mode (Full Monty, WebSocket service) is a separate commercial product
  • Go and Dart bindings are community-maintained, not official
  • Latency figures come from the project's own docs, not independent benchmarks
  • no GPU
Documentation ↗ (opens in a new tab)Website ↗ (opens in a new tab)Repository on GitHub ↗ (opens in a new tab)
#868 out of 100

microsandbox

Embeddable local microVM sandboxes for running untrusted code and AI agents

8.8k starsApache-2.0last commit Oct 2026

Microsandbox boots OCI images (Docker Hub, GHCR, any registry) as hardware-isolated microVMs, with reported average boot times under 100 ms. It ships an `msb` CLI and SDKs for TypeScript, Rust, Python, Go and Ruby that spawn VMs as child processes, with no server or daemon. It supports forking live sandboxes, snapshots, network allowlists and secrets that never enter the VM. The README marks it as beta software.

Strengths

  • Embeddable SDKs spawn microVMs in-process; no setup server or long-running daemon
  • Fork running sandboxes and snapshot or restore full state
  • Runs standard OCI images on Linux (KVM), macOS (Apple Silicon) and Windows (WHP)
  • Secrets stay outside the VM; network access limited by host allowlist

Weaknesses

  • README warns of beta status: breaking changes, missing features, rough edges
  • Needs KVM on Linux, Apple Silicon on macOS, or WHP on Windows
  • First create() pulls the image, so initial start depends on network
  • Intel Macs are not listed as supported
  • no GPU
  • Docker
  • Needs KVM (Linux), WHP (Windows), OCI registry access
Documentation ↗ (opens in a new tab)Website ↗ (opens in a new tab)Repository on GitHub ↗ (opens in a new tab)
#953 out of 100

Open Terminal

REST API shell and file server for AI agents to run commands and code

3.4k starsMITlast commit Oct 2026

Open Terminal is a Python server that exposes a shell, file management, search and code execution over a REST API, with interactive docs at /docs. It runs either in a Docker container (latest, slim, alpine and openshift images) or on bare metal via pip or uvx. It integrates with Open WebUI as a direct or admin-level connection, with a file sidebar.

Strengths

  • Runs via Docker or bare metal with `pip install open-terminal` or `uvx`
  • Four image variants, from ~230 MB alpine to ~4 GB full toolkit image
  • Configurable by CLI flags, environment variables or TOML config files
  • Built-in OpenAPI docs at /docs and file browser endpoints

Weaknesses

  • Bare metal mode runs commands with your user's permissions, with no sandbox
  • Multi-user mode shares one container and is not a security boundary
  • Per-user container isolation needs Terminals, which requires an Open WebUI Enterprise License
  • Mounting the Docker socket gives effective root on the host
  • no GPU
  • Docker
  • Needs Docker (optional), Python (bare metal)
  • port 8000
Documentation ↗ (opens in a new tab)Repository on GitHub ↗ (opens in a new tab)
#1048 out of 100

Steel Browser

Browser API that manages Chrome sessions for Puppeteer, Playwright and Selenium

7.9k starsApache-2.0last commit Oct 2026

REST API and UI on port 3000 that launches Chrome sessions with persisted cookies and storage, proxy chains, stealth plugins and request logging, then hands you a CDP endpoint for Puppeteer or Playwright or a WebDriver endpoint for Selenium. Quick-action endpoints return a page as HTML, markdown, screenshot or PDF. Runs from a prebuilt ghcr.io image or docker compose; Node and Python SDKs target cloud or self-hosted instances.

Strengths

  • One image serves API, UI and console debugger (ports 3000 and 9223)
  • Session API persists cookies and storage; Selenium sessions via isSelenium
  • Swagger UI at /documentation on the local instance
  • Node and Python SDKs switch between cloud and self-host with baseURL

Weaknesses

  • Public beta; API still changing
  • Runs full Chrome; needs a Chrome executable when run outside Docker
  • Selenium integration lacks some features of the CDP session API
  • Apple Silicon compose needs DOCKER_DEFAULT_PLATFORM=linux/arm64
  • no GPU
  • Docker + Compose
  • Needs Google Chrome (non-Docker runs), Node.js (non-Docker runs)
  • port 3000
Documentation ↗ (opens in a new tab)Website ↗ (opens in a new tab)Repository on GitHub ↗ (opens in a new tab)
#1136 out of 100

Browser Use Web UI

Gradio UI for running browser-use agents with your own Chrome

16.6k starsMITlast commit May 2026

Gradio front end over the browser-use library that takes a task, drives a Playwright browser with an LLM (Google, OpenAI, Azure OpenAI, Anthropic, DeepSeek or Ollama) and shows the run. Can attach to your own Chrome profile to reuse logins, keep the browser open between tasks and record video. Runs with uv and Python 3.11 on port 7788, or via docker compose with a noVNC viewer on port 6080.

Strengths

  • Own-browser mode reuses existing Chrome logins and cookies
  • Docker compose includes noVNC so you can watch the agent at localhost:6080
  • Persistent browser sessions keep history visible between tasks
  • Supports Ollama and DeepSeek-R1 alongside cloud providers

Weaknesses

  • Changelog stops in January 2025; last commit May 2026
  • Default VNC password is published in the README; change VNC_PASSWORD
  • Own-browser mode requires closing all Chrome windows and using another browser for the UI
  • Gradio single-user UI; no auth or multi-user features described
  • no GPU
  • Docker + Compose
  • Needs Playwright browsers, LLM API key or Ollama, Chrome (optional, own-browser mode)
  • Models: Google, OpenAI, Azure OpenAI, Anthropic, DeepSeek
  • port 7788
Documentation ↗ (opens in a new tab)Repository on GitHub ↗ (opens in a new tab)

Written from each project's README and checked facts. Spot something wrong? Report it on GitHub (opens in a new tab).