MicroVM sandboxes and policy engines that keep agents out of YOLO mode

strands-agents / AWS

OS-isolation sandbox with default-deny Dogwood semantic policies, credential injection, and event-history aware rules for any agent harness.

Use caseUse it to confine any coding agent on macOS Apple silicon under temporal and argument-aware policies without secrets entering the box.

jingkaihe

CLI for ephemeral Firecracker/Virtualization.framework microVMs with network allowlisting and host-side MITM secret injection.

Use caseUse it to run any coding agent in a disposable Linux VM where API keys stay on the host and only allowed hosts are reachable.

NodeOps-app

TypeScript SDK for CreateOS microVM sandboxes with pause-to-snapshot, fork branching, private networking and typed errors.

Use caseUse it to launch stateful agent sandboxes, expose ports, manage disks and fork parallel branches from a golden snapshot.

community

Agentic OS with runtime, security, observability and tokenless compression for lower cost long-horizon agents.

Use caseUse it to run agents under an OS-like layer that compresses context and enforces runtime security without extra tokens.

MiniMax-AI

Self-hosted open implementation of the OpenAI Agents API with multiple native harnesses and sandbox support.

Use caseUse it to run Agents API compatible sessions on your own infrastructure with pluggable harnesses and sandboxes.

Brandon Vigliarolo

AWS open-sourced Strands Box, an OS-isolation sandbox with Dogwood semantic policies and credential injection to stop agents running in YOLO mode. It currently targets macOS Apple silicon with Linux planned, and works with any harness.

Shipped

Forkast

DigitalOcean Agent Droplets, Uber permission gateways, Daytona CoW forking and Cloudflare isolates all shipped the same week, making per-agent microVM or isolate forks the default governance primitive. Forking cost near zero shifts the default to disposable boundaries for every hop.

Read

AgentPatterns.ai

Practical comparison of the three isolation families for coding agents, trading startup latency against escape blast radius. Recommends Firecracker microVMs for production untrusted code and bubblewrap or Seatbelt for local dev with migration notes.

Read