Managed sandboxes like E2B and Daytona made it easy to give an AI coding agent somewhere safe to run code. But they come with three trade-offs some teams can't accept: your code runs on someone else's infrastructure, your API keys usually have to be handed to the sandbox, and per-second billing grows with every agent you add.

The good news is that the open-source options have caught up. This guide compares the self-hostable sandboxes worth knowing in 2026, what each one isolates with, and what it takes to run it yourself. Last reviewed 19 October 2026.

#Why self-host your agent sandbox

• Data residency. Some codebases can't leave a company's machines, whether because of regulation, client contracts or plain policy.
• Credential exposure. A coding agent needs API keys to call models and push code. In most setups those keys sit inside the sandbox, where a malicious dependency or a prompt injection can read them.
• Cost at scale. One agent session is cheap. Fifty parallel agents running all day on a per-second meter is not, especially when you already own the hardware.

#At a glance

#Hotcell: sandboxes on your own hardware, keys on the host

Hotcell is the sandbox layer of the Directionally Local stack. It runs as many isolated sandboxes as a machine can hold, on a Mac Mini, a cloud VM or a bare-metal box, using Docker everywhere, Firecracker on Linux with KVM, or Apple Virtualization on macOS, all behind one interface.

What sets it apart is credential handling. You add keys on the host (hotcell keys add openrouter), and each sandbox only gets a short-lived, per-sandbox token. LLM calls and git push go through a gateway on the host that swaps the token for the real key, metering and spend-capping each sandbox, and letting you revoke a token without touching the others. Outbound traffic can be default-deny, kernel-enforced on Linux and inside microVMs (advisory with Docker on macOS). Admission control tracks live CPU, memory and cost per sandbox and refuses new work instead of overloading the host.

Hotcell is explicit about its limits: credentials that don't travel in an HTTP header, such as database passwords or AWS request signing, can't be swapped and would have to be injected. Its benchmarks publish the weak results alongside the strong ones.

npm i -g hotcell
hotcell keys add openrouter
hotcell create -n 5 --repo https://github.com/you/app --branch auto --opencode

That last command creates five sandboxes, each with the repo cloned on its own branch and OpenCode preinstalled and pointed at the gateway.

#E2B's open-source runtime

E2B's managed service is the default for many teams, and the runtime behind it is open source under Apache-2.0. It runs Firecracker microVMs with snapshot, pause and resume, and can be deployed with Terraform into cloud accounts you operate. It's the closest thing to self-hosted E2B, and the most operational work on this list: you're running the same distributed system E2B runs.

#microsandbox

microsandbox runs OCI images in hardware-isolated microVMs built on libkrun, as an embeddable library with no server or long-running daemon. It runs on Apple Silicon Macs, Linux with KVM and Windows, has SDKs for TypeScript, Python, Rust and Go, and supports secrets that never enter the VM. It's labelled beta, and a hosted cloud is in private beta.

#agent-sandbox for Kubernetes

If your agents already run on Kubernetes, kubernetes-sigs/agent-sandbox adds a Sandbox resource and controller, plus templates, claims and warm pools. Isolation comes from the cluster's RuntimeClass, typically gVisor or Kata Containers. We wrote a step-by-step setup guide.

#agentbox

agentbox wraps a coding agent such as Claude Code, Codex, OpenCode or Pi in a Docker container with an egress proxy and firewall, and injects secrets through the proxy so the agent never sees them. It's MIT-licensed and early-stage, and a lightweight option for a single developer.

#What about Daytona?

Daytona's open-source repository was archived on 3 October 2026. Its README says core development moved to a private codebase in June 2026 and the public code (last release v0.190.0, AGPL-3.0) will get no further updates. You can still fork it, but for a maintained self-hosted option, look at the tools above.

#How to choose

#FAQs

#What is the best open-source alternative to E2B?

It depends on where you want to run. For E2B's own architecture on your cloud accounts, use E2B's open-source runtime. For sandboxes on your own machines that also keep API keys out of the sandbox, use Hotcell. On Kubernetes, use agent-sandbox.

#Can I run AI coding sandboxes on a Mac?

Yes. Hotcell supports Docker and Apple Virtualization microVMs on macOS, and microsandbox supports Apple Silicon.

#Do self-hosted sandboxes keep my code private?

They keep execution on infrastructure you control. Your prompts and code still go to whichever model provider the agent calls, unless you also run the model yourself.

#Is Daytona still open source?

Its last open-source release (v0.190.0, AGPL-3.0) remains available, but the repository was archived in October 2026 and development continues in a private codebase.