License & Deployment Mix: 1 tool – 1 OSS, 0 SaaS. (OSS and SaaS counts can overlap when an open-source tool also offers a vendor-hosted edition.)
What Is a Code Sandbox?
A code sandbox is a system that executes untrusted or AI-generated code inside an isolated, throwaway environment and hands the result back through an API. The caller creates a sandbox, runs code or commands in it, reads the output (and any files it produced), and then destroys it. The defining assumption is that the code is not trusted – it was authored by an LLM, submitted by an anonymous user, or pulled from a pull request – so the runtime must contain whatever that code tries to do.
This category has grown sharply alongside AI agents and LLM-generated code. Chat “code interpreters,” autonomous agents that write-and-run scripts, tool calls emitted by a model, and online judges / grading labs all need to execute code that no human vetted first. The sandbox is what stops that code from reading other tenants’ data, exfiltrating secrets, or escaping onto the host.
Isolation is delivered by one (or more) of several technologies, each trading off overhead against strength:
- gVisor – a user-space application kernel that intercepts guest syscalls, containing code without hardware virtualization
- Firecracker microVMs – lightweight KVM-backed VMs giving hardware-level isolation per sandbox
- Containers – namespaces / cgroups, the weakest boundary on its own; usually hardened with seccomp, user namespaces, or one of the above
- WASM – WebAssembly runtimes that sandbox at the bytecode level, strong for language-level isolation but limited in what code can run
Whatever the isolation tech, the recurring concerns are the same: kernel isolation (can the code reach the host kernel?), network egress control (can it phone home or hit cloud metadata endpoints?), filesystem snapshots (can we capture and restore state for warm starts and reproducibility?), resource limits (CPU, memory, storage, timeouts), and multi-tenancy (can one tenant’s sandbox affect another’s?).
The information on these pages was researched by a combination of human review and large language models. To suggest an addition or correction, please contact us. Prepared by Rhodium Systems Inc., author of the ResorsIT platform — a unified IT operations management platform for IT teams and MSPs that integrates a curated suite of open-source, commercial, and SaaS applications into a single system with shared identity, single sign-on, access control, and a common audit trail. Use this catalogue only as a starting point for your own research, and review any tool carefully against your own requirements before relying on it. Catalogue data version 2026.197.
Comparison
This category covers platforms that execute untrusted / AI-generated code inside isolated, ephemeral environments. Only Isola is evaluated so far, so the tables below have a single row; they are laid out so the category can grow as hosted services (E2B, Modal sandboxes, Daytona) and other self-hosted options are added.
Capability Matrix
| Tool | Isolation tech | Self-host | License | SDKs | Snapshots | Network control | K8s-native |
|---|---|---|---|---|---|---|---|
| Isola | gVisor application kernel (per sandbox) | yes (only) | Apache-2.0 | Python, TypeScript, REST | yes (rootfs overlay to S3 / GCS / Azure) | deny-all default; optional internet or CIDR allow-list | yes (Helm + CRDs) |
License Comparison
| Tool | License | OSI | Type |
|---|---|---|---|
| Isola | Apache-2.0 | yes | OSS self-hosted platform (no SaaS tier) |
Deployment Comparison
| Tool | Deployment | External deps | Air-gap |
|---|---|---|---|
| Isola | Helm on Kubernetes (vanilla / EKS / AKS / GKE) with a gVisor RuntimeClass | none required (no DB / Redis / MQ); object storage optional, only for snapshots | yes |
SSO / OIDC
| Tool | OIDC | SAML | SCIM | Notes |
|---|---|---|---|---|
| Isola | n/a | n/a | n/a | Service-oriented REST API; API-key / service-credential auth, no interactive user console. Gate at the proxy layer (Authentik forward-auth) if needed. |
Tools
1 tools.
Isola
Self-hosted Kubernetes platform for safely executing untrusted and AI-generated code, isolating each sandbox behind its own gVisor application kernel.
License: Apache-2.0 (OSS) · Kind: web · Deploy: k8s · SSO: none
