What is agentsandbox?

AgentSandbox is a tool that sets up an isolated Docker container for running AI coding agents, such as Claude Code, Codex, Pi, and OpenCode, inside a specific project directory, without giving them access to the rest of your computer's filesystem or potentially the wider internet. The problem it solves is straightforward: AI coding agents are powerful tools, but running them directly on your machine means they can read or write files anywhere, and can make network connections freely. AgentSandbox wraps them in a container that only sees the one project folder you want them to work in. Installation is a single curl command run from inside your project directory. This runs an interactive wizard that asks which agent you want, which programming language stack to include (Python, Node, Go, or Rust, and you can pick multiple), whether to allow or block outbound network access, and whether to mount the repo as read-only or writable. Once configured, it writes three files into your project: a Dockerfile that describes the container environment, an agents script that launches the chosen agent inside that container, and optionally an init-firewall.sh file when network blocking is selected. With network blocking enabled, outbound traffic from inside the container is restricted via an iptables firewall to only the agent's AI provider endpoint, GitHub, and npm. All other connections are rejected. Agent credentials (API keys and configuration) are mounted into the container from your host machine's config directories, so you do not need to re-authenticate. The generated files are plain text and can be read, edited, or committed to version control.