Just one more sandbox
“Everybody builds sandboxes now.” — the standing joke/meme note for the 2025-2026 wave: every lab, cloud, and OSS project shipped its own agent-isolation runtime, and each new announcement is met with the genre’s signature line (title borrowed from the HoYoverse meme format; USER framing at planting: “Create note Just one more sandbox / Everybody builds sandboxes now”).
Why the wave is real and not just fashion — agents made untrusted code execution a mainline product requirement (browse, click, install, run), and every isolation tier has a vendor staking it:
The roster (all captured in the vault)
| Sandbox | Who | Isolation tier | The angle |
|---|---|---|---|
| microsandbox (OSS) | OSS 8.4k★ | microVM | host-brokered “unexploitable” secrets; agent skills + MCP |
| vibemon (OSS) | stencil-hq | KVM/HVF microVM | speaks the E2B API — SDK compatibility |
| SPACE (OSS) | Perplexity | Firecracker microVM | powers their Computer agent + RL training/eval workloads; template→sandbox→session lifecycle |
| E2B / Daytona / Modal | cloud incumbents | Firecracker | the API grammar everyone else implements |
| box (OSS) (Strands) | AWS | policy-funnel | semantic + temporal policy above isolation; in-VM = wrong threat model |
| monty (OSS) | pydantic | in-process interpreter | <1 ms pool; no fs/env/network inside |
| quicksand (OSS) | OSS | bundled QEMU | library-shaped, no root, snapshots |
| Agent sandbox (seed) | this vault’s map | — | the concept note: spectrum + requirements (secrets, session lifetime, policy placement) |
The pattern worth keeping
- Firecracker is the default substrate (SPACE, E2B, incumbents) — the cloud verdict Brooker confirmed: “VMs are a slam-dunk there”; local/policy variants diverge (Box: funnel; monty: interpreter).
- The E2B API is becoming the lingua franca (vibemon’s whole pitch) — the OpenAI-API dynamic applied to sandboxes; watch for compat layers multiplying.
- Every serious agent product eventually open-sources its sandbox (Perplexity now, AWS Box before) — because the isolation layer is table-stakes infrastructure, not differentiator; the differentiators moved up (policy, tooling, memory).
- The Agent sandbox requirements hold across all of them: secrets brokered outside, snapshot/fork for session lifetime, policy above isolation.
Kin
- Agent sandbox — the concept map this roster populates
- Just one more harness energy: same dynamic as the “everyone builds their own harness” wave Orosz documented — table-stakes layers get rebuilt per-company until an API grammar (E2B?) consolidates them