{"slug": "show-hn-agentnest-self-hosted-sandboxes-for-ai-agents", "title": "Show HN: AgentNest, self-hosted sandboxes for AI agents", "summary": "AgentNest, an open-source runtime for secure AI agent execution, provides self-hosted sandboxes with disposable, policy-controlled environments for Python, shell commands, files, packages, browsers, GPUs, and Git work. The tool features secure defaults including non-root execution, read-only root filesystem, denied networking, and egress allowlisting, and supports stateful Python sessions, forkable state, async operations, and audit events.", "body_md": "**The open-source runtime for secure AI agent execution.**\n\nAgentNest gives AI agents disposable, policy-controlled environments for Python, shell commands, files, packages, browsers, GPUs, and Git work. It is self-hosted, Python-first, and deliberately not another cloud or cluster orchestrator.\n\n``` python\nfrom agentnest import Sandbox\n\nwith Sandbox(\"python:3.12-slim\", timeout=60) as sandbox:\n    sandbox.write_file(\"main.py\", \"print('Hello from isolation')\")\n    result = sandbox.exec_shell(\"python main.py\")\n    print(result.stdout)\n```\n\n**Secure defaults:** non-root, read-only root, no capabilities, denied networking, limits, cleanup**Egress allowlisting:** let code reach`pypi.org`\n\nand nothing else, with every connection logged**Agent-native:** stateful Python sessions, forkable state, async, streaming, secrets, approvals, audit events**Non-destructive timeouts:** a slow command is killed on its own; the sandbox and its state survive**Crash-safe:** every resource is labelled with a deadline, so`agentnest prune`\n\nreaps orphans**Proven, not promised:** a[suite of escape attempts](/mihirahuja1/agentnestOSS/blob/main/tests/escapes)runs on every commit**Self-hosted & extensible:** your Docker or Kubernetes; third-party backends via entry points\n\nTry it in one command (needs Docker):\n\n```\npip install agentnest\nagentnest demo\n```\n\nWarning\n\nContainers share the host kernel. Choose an isolation boundary appropriate for your threat model.\nRead the [security model](/mihirahuja1/agentnestOSS/blob/main/docs/security.md) before running hostile multi-tenant workloads.\n\n```\npip install agentnest\nagentnest doctor\n```\n\nOptional extras:\n\n```\npip install 'agentnest[kubernetes]'\npip install 'agentnest[server]'\npip install 'agentnest[mcp]'\npip install 'agentnest[all]'\npython\nfrom agentnest import NetworkPolicy, Sandbox, Secret, SecurityPolicy\n\npolicy = SecurityPolicy(\n    network=NetworkPolicy.denied(),\n    max_output_bytes=2_000_000,\n    require_image_digest=True,\n)\n\nwith Sandbox(\n    \"python@sha256:<digest>\",\n    security_policy=policy,\n    environment={\"TOKEN\": Secret(\"redacted-in-output\")},\n    memory=\"512m\",\n    cpus=1.0,\n) as sandbox:\n    for event in sandbox.stream_shell(\"python main.py\"):\n        print(event.data, end=\"\")\n\n    checkpoint = sandbox.snapshot(\"workspace.tar\")\n    for artifact in sandbox.artifacts(\"output/**/*\"):\n        print(artifact.path, artifact.sha256)\n```\n\nGive code the network it needs and nothing more. Denied is still the default; an allowlist routes traffic through a filtering proxy that only lets approved domains through.\n\n``` python\nfrom agentnest import NetworkPolicy, Sandbox, SecurityPolicy\n\npolicy = SecurityPolicy(network=NetworkPolicy.allowlist(domains=(\"pypi.org\", \"files.pythonhosted.org\")))\nwith Sandbox(\"python:3.12-slim\", security_policy=policy) as sandbox:\n    sandbox.exec_shell(\"pip install --user requests\").check()   # reaches PyPI\n    blocked = sandbox.exec_python(\"import urllib.request; urllib.request.urlopen('https://evil.example')\")\n    assert not blocked.ok                                       # everything else is refused\n```\n\nA persistent interpreter keeps variables and imports across calls — the code interpreter model, self-hosted.\n\n```\nwith Sandbox(\"python:3.12-slim\") as sandbox:\n    session = sandbox.python_session()\n    session.run(\"import pandas as pd; df = pd.DataFrame({'x': [1, 2, 3]})\")\n    print(session.run(\"df['x'].sum()\").check().result)   # -> 6\n```\n\nBranch a running sandbox's state, explore several continuations, keep the one that worked — parallel A/B attempts and agent tree search without re-running from scratch.\n\n```\nwith Sandbox(\"python:3.12-slim\") as base:\n    base.write_file(\"state.json\", \"{}\")\n    attempt_a = base.fork()\n    attempt_b = base.fork()   # independent copies; neither sees the other's writes\n```\n\nAlso included: `AsyncSandbox`\n\n, deterministic `Template`\n\nbuilds, bounded `SandboxPool`\n\n, Git workspace\nhelpers, browser/GPU presets, MCP tools, YAML profiles, a CLI, and an authenticated remote API.\n\nAgentNest is a self-hosted control layer, not a hosted sandbox service. The\ndistinction that matters: it decides what an agent's code is *allowed to do* and\nrecords what it *did*, across whatever backend you run.\n\n| AgentNest | E2B | Modal Sandboxes | microsandbox | llm-sandbox | |\n|---|---|---|---|---|---|\n| Self-hosted, no account | ✅ | ✅ | ✅ | ||\n| Domain egress allowlist | ✅ | ❌ | ❌ | ❌ | ❌ |\n| Stateful REPL sessions | ✅ | ✅ | ✅ | ✅ | |\n| Forkable state | ✅ | ❌ | ❌ | ❌ | ❌ |\n| Approval hooks + audit events | ✅ | ❌ | ❌ | ❌ | ❌ |\n| Pluggable isolation backend | ✅ | ❌ | ❌ | ❌ | |\n| Auditable in an afternoon (~4k LOC) | ✅ | ❌ | ❌ | ✅ |\n\nSee [benchmarks](/mihirahuja1/agentnestOSS/blob/main/docs/benchmarks.md) for measured cold-start and round-trip latencies.\n\nGive an existing agent a sandboxed code tool without changing its security story:\n\n``` python\nfrom agentnest.integrations.langchain import build_langchain_tool\n\ntool = build_langchain_tool(network_enabled=False)   # a LangChain StructuredTool\n```\n\nThere is a smolagents executor and a framework-neutral `SandboxRunner`\n\ntoo. Or\nexpose AgentNest over the Model Context Protocol so Claude Code, Cursor, or\nClaude Desktop can run code safely in one line of config:\n\n```\n{ \"mcpServers\": { \"agentnest\": { \"command\": \"agentnest\", \"args\": [\"mcp\"] } } }\n```\n\nSee the [integration guide](/mihirahuja1/agentnestOSS/blob/main/docs/guides/integrations.md).\n\n``` php\nflowchart LR\n    App[\"Agent application\"] --> API[\"Sandbox API\"]\n    API --> Guard[\"Policy · approvals · events\"]\n    Guard --> Contract[\"RuntimeBackend\"]\n    Contract --> Docker[\"Docker / gVisor / Kata\"]\n    Contract --> K8s[\"Kubernetes\"]\n    Contract --> Remote[\"Remote / Firecracker\"]\n    Contract --> Plugins[\"Third-party plugins\"]\n```\n\nRead the [quickstart](/mihirahuja1/agentnestOSS/blob/main/docs/quickstart.md), [architecture](/mihirahuja1/agentnestOSS/blob/main/docs/architecture.md), [deployment guide](/mihirahuja1/agentnestOSS/blob/main/docs/deployment.md), and complete [documentation](/mihirahuja1/agentnestOSS/blob/main/docs/index.md).\n\nPlanned: an optional service for teams that need to run many sandboxes at once. Applications will send it a sandbox request, and the manager will create, track, and delete the temporary environments on the team's existing Kubernetes cluster.\n\nThe manager will provide:\n\n- Queues and per-user limits so one application cannot consume every available resource\n- Automatic cleanup if an application disconnects or crashes\n- A dedicated Kubernetes namespace for sandbox workloads\n- gVisor-backed sandboxes for stronger isolation\n- Central logs, audit history, usage metrics, and health checks\n- Warm sandbox pools for faster startup\n\nThis will remain optional. Developers will still be able to use the current `Sandbox`\n\nAPI directly\nwith Docker or Kubernetes. AgentNest will use existing infrastructure rather than replace Docker or\nKubernetes.\n\n```\npip install -e '.[dev,docs]'\nruff check .\nruff format --check .\nmypy agentnest\npytest --cov=agentnest --cov-report=term-missing\nmkdocs build --strict\n```\n\nDocker integration tests are opt-in:\n\n```\nAGENTNEST_DOCKER_TESTS=1 pytest -m integration\n```\n\nApache License 2.0. See [LICENSE](/mihirahuja1/agentnestOSS/blob/main/LICENSE).", "url": "https://wpnews.pro/news/show-hn-agentnest-self-hosted-sandboxes-for-ai-agents", "canonical_source": "https://github.com/mihirahuja1/agentnestOSS", "published_at": "2026-07-23 01:54:06+00:00", "updated_at": "2026-07-23 02:22:43.961576+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "ai-tools", "ai-infrastructure", "developer-tools"], "entities": ["AgentNest", "Docker", "Kubernetes", "PyPI"], "alternates": {"html": "https://wpnews.pro/news/show-hn-agentnest-self-hosted-sandboxes-for-ai-agents", "markdown": "https://wpnews.pro/news/show-hn-agentnest-self-hosted-sandboxes-for-ai-agents.md", "text": "https://wpnews.pro/news/show-hn-agentnest-self-hosted-sandboxes-for-ai-agents.txt", "jsonld": "https://wpnews.pro/news/show-hn-agentnest-self-hosted-sandboxes-for-ai-agents.jsonld"}}